Lazarus hackers use post-quantum cryptography for malware delivery
Kaspersky says Lazarus used post-quantum encryption and an in-memory chain to deliver malware while targeting at least three South Korean companies.
- Kaspersky researchers identified the FlashHole operation, attributing the campaign to the Lazarus Group and revealing attackers use a NIST-approved post-quantum cryptographic mechanism to secure malicious payload delivery.
- Targeting South Korean organizations through a 'rather complex' infection chain, attackers use phishing pages directing victims to INISAFE CrossWeb, which triggers malware downloads from GitHub repositories.
- LPEClient malware receives ML-KEM-1024 public keys from command-and-control infrastructure, obtaining 'a byte array comprising four 1,568byte blocks' before loading the Cubridge backdoor into system memory.
- Using post-quantum encryption protects data from 'hack now decrypt later' attacks, Kaspersky notes, while the modular Cubridge backdoor supports file management and command execution through ClientHub.
- Researchers place FlashHole within the broader Cascade Hole activity and link it to Operation SyncHole; while three companies in South Korea were identified, analysis across 338 million simulations suggests many more organizations were affected.
9 Articles
9 Articles
BleepingComputer
Lazarus hackers use post-quantum cryptography for malware delivery
North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware. [...]
The FlashHole espionage campaign, discovered by Kaspersky and attributed to the Lazarus criminal group, combines AI-assisted social engineering techniques and malware that exploit post-quantity encryption to protect communications.An evolution that opens up new challenges for threat detection and corporate defense The Lazarus article already uses post-quantity encryption in malware: how the cyber challenge changes comes from Cyber Security 360.
North Korean group Lazarus has deployed a new malicious operation against South Korean agencies that has revealed the use of post-quantic cryptography to protect the distribution of 'malware'.
North Korean Hackers Use Post-Quantum Encryption to Hide New Malware From Security Tools
North Korean-linked Lazarus hackers are using post-quantum cryptography in a malware delivery chain designed to conceal later-stage payloads from security tools. The technique appeared in Operation FlashHole, a campaign targeting organizations in South Korea. Instead of relying on encryption alone to hide files on disk, the malware uses a modern key-establishment method to protect payloads […]
Lazarus Hackers Use Post-Quantum Cryptography to Deliver Malware
Copyright protected content copied from PhoneWorld website. North Korean hacking group Lazarus is using post-quantum cryptography to deliver malware in a new cyberattack campaign targeting South Korean organizations. The operation combines older malware tools with new techniques designed to make attacks harder to detect. Cybersecurity researchers at Kaspersky have named the campaign FlashHole. Their investigation found that the hackers use a sta…
Coverage Details
Bias Distribution
- 100% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
