Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption
Summary: Kaspersky attributed Operation FlashHole to the North Korea-linked Lazarus Group, which has targeted at least three South Korean organizations in construction, software, and wire-communication equipment manufacturing since at least July 2025. The campaign abuses Initech's INISAFE CrossWeb EX, a mandatory financial security program in South Korea, to launch the legitimate fsquirt.exe binary and sideload a malicious DLL called TechHub, and its latest malware uses the post-quantum algorithm ML-KEM-1024 to encrypt communications with attacker servers.
What's compelling: Lazarus has been using quantum-resistant cryptography to protect its malware communications since at least September 2024, more than a year before this disclosure, meaning traffic you capture today may stay unreadable. The entry point is software South Korean users are required to install for banking and government services, so the tool meant to provide trust is the delivery mechanism.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026