Two experts get into why Lazarus exploiting a Windows zero-day is particularly concerning despite the vulnerability’s “Important” CVSS rating. And how kernel-level rootkits like FudModule can undermine the security tools defenders rely on, and what organizations can do when patching or traditional mitigations aren’t immediately possible.
John Strand, Owner, Black Hills Information Security (https://www.linkedin.com/in/john-strand-a1b4b62)
“This story highlights an important shift in how organizations need to think about defense. Effective cybersecurity can no longer be reduced to firewall rule changes, patching, and configuration updates. Those remain important, but they’re no longer sufficient on their own.
“Security teams need to start training for the moments when those traditional options aren’t available. What happens when a critical system can’t be patched? What happens when operational requirements prevent you from making firewall changes? Those situations are becoming increasingly common, especially in legacy environments and critical infrastructure.
“That’s where compensating controls become essential. Organizations should be regularly exercising these scenarios and asking, ‘What can we do today to reduce risk while we wait for a patch or a permanent fix?’ Whether it’s increased monitoring, network segmentation, deception technologies, stricter access controls, or enhanced threat hunting, teams need to understand which defensive options are available and when to deploy them.
“The goal of compensating controls isn’t to eliminate the risk. It’s to buy time. As zero-day vulnerabilities continue to emerge at a faster pace, organizations need strategies that slow attackers down and reduce their opportunities while vendors develop patches and defenders work to implement them.
“The organizations that will be most successful over the next several years won’t necessarily be the ones that patch the fastest. They’ll be the ones that have rehearsed how to operate safely when patching isn’t immediately possible.”
Denis Calderone, CTO, Suzu Labs (https://www.linkedin.com/in/deniscalderone)
“Lazarus has now exploited use-after-free vulnerabilities in Windows built-in drivers three times in two years to deploy the same rootkit. They went from appid.sys to AFD.sys to AFD.sys again. For a while, the standard playbook for getting kernel access was bring-your-own-vulnerable-driver: load a signed but buggy third-party driver, exploit it, get kernel privileges. Defenders adapted with driver allowlisting. Lazarus adapted by finding bugs in drivers that Windows ships by default. AFD.sys handles every socket operation on every Windows machine. You can’t blocklist it.
“Once the use-after-free fires, the attacker gets a kernel read/write primitive, and from there FudModule takes over. This is a rootkit that disables EDR callbacks, zeros out ETW provider registrations, and hides its own processes from the tools security teams rely on. The latest version, v3.1, adds the ability to tamper with Smart App Control, which means the rootkit is evolving faster than the mitigations Microsoft is building around it. And this CVE carries a CVSS 7.0, rated Important. There are 42 Critical patches in the same August Patch Tuesday release. If your vulnerability management program triages by severity score, this one is going to land in the middle of the queue behind remote code execution bugs that nobody has actually exploited yet. That’s exactly backwards.
“CISA added CVE-2026-68820 to the Known Exploited Vulnerabilities catalog on August 11 with a federal remediation deadline of August 25, so needless to say, get this one patched right away, regardless of the CVSS score. Given that Lazarus had at least five weeks of active exploitation before the fix shipped, organizations in defense, aerospace, and adjacent sectors should be particularly diligent and treat anything unpatched since early July as potentially compromised. Check Point’s report includes the full IOC list covering file hashes, C2 domains, and the specific malware components used in the campaigns. Hunt for evidence of the MISTPEN downloader. It beacons out using Microsoft Graph API and OneDrive traffic, so look for anomalous indicators from workstations that don’t typically use those tools. Also look for unsigned DLLs loaded alongside legitimate PDF viewers and any evidence of ETW provider or kernel callback manipulation. Lazarus has shown that it’s possible to render EDR telemetry useless from the kernel level, and too many defenders still treat their EDR as a single source of truth. That dependency is exactly what FudModule is built to exploit.”
Hackers claim medical data breach affecting nearly 19 million people in Poland
Posted in Commentary with tags Hacked on August 14, 2026 by itnerdPolish healthcare platform MyDr has confirmed (translation here) a cyberattack after hackers claimed to have stolen data belonging to 18.8 million people, roughly half of Poland’s population.
The attackers claim to possess more than 2.5 terabytes of data, while MyDr said the affected information likely dates from 2024 and earlier and that it is still conducting a forensic investigation to determine the scope of the breach.
MyDr processes information including PESEL national identification numbers, prescriptions, medical appointments and other personally identifiable information. As evidence of the breach, the attackers reportedly provided journalists with a prominent Polish politician’s PESEL number, two phone numbers and 25 prescriptions.
“We are dealing with one of the largest data leaks in history,” Deputy Prime Minister and Minister of Digital Affairs Krzysztof Gawkowski said.
Denis Calderone, CTO, Suzu Labs:
“This is Poland’s third major cyber incident in as many months, and this one is the worst. Water treatment and energy infrastructure attacks are disruptive, but they’re largely recoverable. In this case we’re talking about a major EMR vendor servicing over 12,000 clinics nationwide. It’s reported that PESEL numbers (national identity numbers), prescriptions, and diagnoses for 18.8 million people were exposed. That’s roughly half the country who just had their personal identification numbers compromised. Ouch!
“MyDr processes roughly three million medical consultations and 2.7 million prescriptions every month. PM Tusk was quick to frame this as a private company, not a state institution. But when a single private vendor is holding that volume of clinical data and national identity numbers, the line between private vendor and public infrastructure is gone. The US learned this lesson with Change Healthcare in 2024. Change was a payments clearinghouse, not an EMR, but the architectural failure was the same: one vendor became the single point of failure for a national healthcare ecosystem. Change hit 192 million Americans. MyDr reportedly hit 18.8 million Poles. Similar proportional impact.
“The Polish government is advising citizens to lock their PESEL numbers through the mObywatel app, and that’s a good first step. But PESEL locking covers specific financial transactions and doesn’t extend to every context where an identity number can be misused. And then there’s the medical data. Prescriptions and diagnoses aren’t just PII, they’re blackmail material. A politician’s 25 prescriptions were already used as proof of the breach. Scale that across 18.8 million people and you have a dataset that will fuel identity fraud, targeted phishing, and extortion for years.
“The full details of how the attackers got in haven’t been disclosed yet. Healthcare organizations and third-party EMR vendors everywhere should be attentive to the revelations from this incident and shore up their own defenses accordingly. The regulatory timing is worth noting. Poland implemented the EU’s NIS2 directive into law on April 3 of this year, 17 months past the EU deadline, and healthcare is a covered sector. But entity registration isn’t due until October, mandatory ISMS implementation until April 2027, and the first cybersecurity audits until 2028. This breach landed in the exact gap between the law existing on paper and anyone having to prove they comply. Countries also need to stop treating national identity numbers as secrets. PESEL, Social Security numbers, and their equivalents were designed as indexes, not authentication factors.”
Damon Small, Board of Directors, Xcape, Inc.:
“Centralizing health records creates immense systemic liability, especially when exfiltration compromises half a nation’s population. While the threat actor identity and precise initial access vector remain unknown, the theft of 2.5 terabytes of medical data from Polish aggregator MyDr exposes 18.8 million people to extortion, targeted medical insurance fraud, and identity theft. Medical records remain among the most valuable assets on the black market, yet exfiltrating terabytes of sensitive files unnoticed highlights a glaring absence of basic network egress monitoring. Security leaders must recognize that protecting health data requires more than perimeter defense. Organizations must deploy strict data loss prevention controls, implement rate-limiting and anomaly detection on database queries, and establish real-time egress monitoring to flag massive data movements before records leave for the public Internet.
“Critical Takeaways
“We may not know who stole the data or how they got in, but we certainly know nobody was watching the exit.”
Seemant Sehgal, Founder & CEO, BreachLock:
“Half a population’s medical records exposed in a single incident, and the story almost always becomes about the attacker, when the conversation needs to focus on the years leading up to the attack. 2.5 terabytes does not leave a network quietly. That kind of exfiltration takes time, and time means signals. The decisions that shape an incident like this are made long before anyone finds a way in, and that is where the most valuable reflection has to start.”
Leave a comment »