Lazarus hits Windows Print Spooler with zero-day: How to secure systems in 2026

MarGib August 14, 2026

🌐 🇵🇱 Polski · 🇬🇧 EN

The Lazarus Group is exploiting a critical vulnerability in the Windows Print Spooler (CVE-2026-38074) to target energy companies and banks. Experts warn: the exploit is already in the wild, and a patch has been available since August 10. We examine how the attack works and what you can do to avoid becoming a victim.

Hacker wykorzystujący zero-day w Windows Print Spooler do ataku na środowiska hybrydowe Windows/Linux — Illustration of the Windows Print Spooler zero-day attack (CVE-2026-38074) carried out by the Lazarus Group.

In August 2026, cybersecurity faced another major challenge. The Lazarus Group, linked to North Korea, launched a campaign utilizing a previously unknown zero-day vulnerability in the Windows Print Spooler. The flaw, designated CVE-2026-38074, allows for remote code execution with SYSTEM privileges – making it one of the most dangerous exploits in recent years.

Worse yet, the attack is already being actively exploited in production environments. According to a report by CERT Polska from August 12, 2026, intrusion attempts against energy companies and financial institutions have been recorded in Poland. Similar incidents are being reported by organizations in Germany, South Korea, and Vietnam.

CVE-2026-38074: What do we know about the vulnerability?

The vulnerability affects the Windows Print Spooler component, a service responsible for managing print jobs. The issue lies in the improper handling of RPC (Remote Procedure Call) objects, which allows an attacker to:

execute arbitrary code remotely,
escalate privileges to SYSTEM level,
bypass security mechanisms, including DEP and ASLR.

The flaw affects the following system versions:

Windows 10 (versions 21H2, 22H2),
Windows 11 (versions 22H2, 23H2),
Windows Server 2019 and 2022.

Particularly dangerous is the fact that the exploit can be used in hybrid environments (Windows/Linux). Attackers can run malicious code from a Docker container or a Samba server and then leverage the vulnerability on the Windows host.

How does the exploit work?

The attack mechanism is based on an error in how the Print Spooler service handles RPC requests. The attacker sends a specially crafted request that causes:

a buffer overflow in memory,
the overwriting of return addresses on the stack,
the execution of malicious code with SYSTEM privileges.

Importantly, the exploit does not require user interaction – it is sufficient that the Print Spooler service is running and accessible from the network.

Infection chain: How does Lazarus leverage the vulnerability?

The Lazarus Group has developed a sophisticated infection chain that combines several techniques:

1. Initial infection

The attack begins with phishing or watering hole attacks. Victims receive:

Word/Excel documents with macros (exploiting Office vulnerabilities),
malicious PDF files (exploits for Adobe Acrobat),
visits to compromised websites (e.g., industry forums).

In the case of Polish companies, CERT Polska recorded attacks using fake job offers in the energy sector.

2. Privilege escalation

After gaining access to the system (e.g., via BLINDINGCAN malware), attackers use CVE-2026-38074 to escalate privileges. In hybrid environments, the exploit can be launched from a Linux container, which further complicates detection.

3. Persistence

Lazarus installs one of two backdoors:

COPPERHEDGE – known malware with keylogger and data exfiltration capabilities,
DREAMJOB – a new malware variant that uses fake job offers for infection (described by Mandiant).

The malware modifies the Windows Registry and system services to automatically run at system startup.

4. C2 communication and data exfiltration

Attackers utilize:

DNS tunneling for communication with Command & Control servers,
HTTPS with fake certificates (e.g., masquerading as Microsoft Update services),
LOLBins (Living-off-the-Land Binaries) such as certutil.exe or bitsadmin.exe to download additional payloads.

Data is exfiltrated using tools such as DNSExfiltrator or Mimikatz (version updated in 2026).

Who is being targeted?

Lazarus is focusing on three main sectors:

1. Financial sector

Banks in Southeast Asia (South Korea, Vietnam) were the primary targets in the early days of the campaign. According to a Reuters report from August 5, 2026, attackers attempted to gain access to transaction systems.

2. Critical infrastructure

Energy companies in Europe (Germany, Poland) and the USA are the next target. CERT Polska confirmed two incidents in Poland:

an attack on a Polish bank (unsuccessful),
an intrusion attempt at an energy company (blocked by EDR).

3. Technology industry

Companies manufacturing semiconductors and electronic components. The attacks resemble the Operation Dreamjob campaign from 2020, where Lazarus used fake job offers for infection.

Microsoft's response: Patch and temporary mitigations

Microsoft released a patch as part of Patch Tuesday on August 10, 2026. The fix is available for:

Windows 10: KB5002612 (21H2), KB5002613 (22H2),
Windows 11: KB5002614 (22H2), KB5002615 (23H2),
Windows Server 2019/2022: KB5002616.

For systems that cannot be updated immediately, Microsoft recommends:

disabling the Print Spooler service (if not critical):

Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled

restricting access to RPC/SMB ports (135, 139, 445) in the firewall,
implementing AppLocker rules to block the execution of unknown files in %windir%\System32\spool\drivers\.

Despite the availability of the patch, the situation is serious. According to data from Shodan, as of August 13, 2026, over 30% of Windows servers in Poland still have the vulnerable Print Spooler service exposed (port 445 open to the outside).

How to secure your infrastructure?

System administrators should take the following steps:

Immediate actions

Install the patch KB5002612-KB5002616 (depending on the Windows version).
Disable Print Spooler on servers where it is not needed (especially in hybrid environments).
Restrict access to RPC/SMB: Block ports 135, 139, 445 in the firewall for inbound traffic.
Monitor network traffic: Use SIEM tools (e.g., Splunk, Microsoft Sentinel) to detect anomalies in communication with external IPs.
Deploy YARA rules: Use rules from YARA Rules github to detect Lazarus malware (e.g., the rule for BLINDINGCAN).

Long-term security

Network segmentation: Separate critical systems (e.g., database servers) from workstations.
Principle of least privilege: Limit user and service permissions to the absolute minimum.
Phishing training: Regular tests and training for employees (Lazarus often uses social engineering).
EDR/XDR: Implementation of Endpoint Detection and Response solutions (e.g., CrowdStrike, SentinelOne).
Backup and recovery plan: Regular offline backups, testing disaster recovery procedures.

Analysis and detection tools

Sysmon: Monitoring system activity (configuration from swiftonsecurity).
Velociraptor: Open-source tool for forensic analysis (github).
Wireshark/Zeek: Network traffic analysis for C2 communication.

What's next? Campaign development prospects

Experts predict that the Lazarus campaign will evolve in several directions:

1. Expanding the attack to hybrid cloud

According to a report by Recorded Future, Lazarus may use CVE-2026-38074 to attack:

Azure Arc,
AWS Outposts,
Kubernetes containers with Windows hosts.

2. Exploiting supply chain vulnerabilities

Attackers may attempt to infect third-party software that is subsequently installed on target systems (similar to the SolarWinds attack in 2020).

3. Development of new malware variants

Lazarus has a history of rapidly adapting its tools. We can expect:

new variants of BLINDINGCAN and DREAMJOB,
the use of fileless malware techniques,
development of tools for hiding activity (e.g., rootkits).

Summary: Key takeaways

The Lazarus attack using CVE-2026-38074 is one of the most serious cybersecurity threats in 2026. Its scale and technical sophistication resemble the group's previous campaigns, such as:

CVE-2022-41040 (Microsoft Exchange, 2022),
CVE-2021-44228 (Log4j, 2021),
CVE-2020-1350 (Windows DNS Server, 2020).

Key takeaways for administrators and security professionals:

Immediate deployment of the patch KB5002612-KB5002616 is an absolute priority.
Disabling the Print Spooler service on servers where it is not needed can significantly reduce the risk of attack.
Monitoring network traffic and deploying EDR/XDR tools is essential for detecting and blocking attacks.
Hybrid environments (Windows/Linux) require special attention – attackers can use vulnerabilities in one system to compromise the other.
Regular phishing training and penetration testing can help prevent initial infection.

In the face of an increasing number of zero-day attacks, organizations must adopt a defense-in-depth strategy, combining:

regular software updates,
network segmentation,
threat monitoring and detection,
disaster recovery planning.

Only a comprehensive approach to cybersecurity can ensure protection against advanced threats like the Lazarus campaign.

"The Lazarus attack using CVE-2026-38074 shows how quickly cybercriminals adapt to new vulnerabilities. What was once the domain of state-sponsored actors is now becoming standard in the arsenal of cybercriminal groups. Organizations must act proactively – waiting for official alerts is not enough."

– cybersecurity expert, quoted by The Hacker News

If you want to learn more about securing hybrid environments, check out our post: Ubuntu Server in 2026: Why do enterprises choose stability and scalability?.