CERT24Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum EncryptionLoading data…
CERT24Threat Observatory
Period

Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption

The cyber espionage campaign Operation FlashHole, attributed to the Lazarus Group, has targeted at least three organizations in South Korea in the construction, software, and wire-communication equipment manufacturing sectors. The campaign abuses the widely used South Korean financial security software INISAFE CrossWeb EX to deliver malware and uses the ML-KEM-1024 algorithm to encrypt malware communications.

← Back to intelligence

Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption

The cyber espionage campaign Operation FlashHole, attributed to the Lazarus Group, has targeted at least three organizations in South Korea in the construction, software, and wire-communication equipment manufacturing sectors. The campaign abuses the widely used South Korean financial security software INISAFE CrossWeb EX to deliver malware and uses the ML-KEM-1024 algorithm to encrypt malware communications.