Lazarus uses post-quantum crypto ML-KEM to deliver malware in FlashHole attacks on South Korea
AIFlow_ML · x · 2026-10-22
Kaspersky revealed FlashHole, a Lazarus Group campaign that uses the standardized ML-KEM-1024 post-quantum cryptographic mechanism to secure C2 communications and decrypt payloads — a first for malware delivery.
Active since July 2025, the chain uses phishing pages leading to crafted GitHub pages, exploits South Korea's popular INISAFE CrossWeb EX security tool for in-memory execution, abuses the legitimate fsquirt.exe to run shellcode, then installs the TechHub downloader (pulling malware from private GitHub repos) and the new ClientHub loader. At least three South Korean firms in software, construction, and wired telecom equipment were confirmed hit, with likely more affected.
More from Safety
- Anthropic's RSP bars external evaluators with close personal ties to anyone at the company — morqon · 2026-10-22
- London AO Summit expands lineup with DeepMind, ARIA speakers on autonomous organizations — weballergy · 2026-10-22
- Internet Freedom Foundation slams CERT-In for vague, alarming botnet warning SMS campaign — kingslyj · 2026-10-22
- US announces $389M investment in advanced chips for fusion, AI data centers — Polymarket · 2026-10-22
- DeepSeek V4.1 Flash Finds CVEs at $2.40 Each, 27x Cheaper Than Opus 5 — teortaxesTex · 2026-10-22
- eMudhra exits CA business amid trust concerns, dubbed a face-saving move — basedjensen · 2026-10-22