Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption
Summary
The Lazarus Group, linked to North Korea, is conducting a cyber espionage campaign named Operation FlashHole against South Korean organizations in construction, software, and wire-communication equipment manufacturing. The campaign, active since at least July 2025, uses post-quantum encryption and abuses South Korean security software to deploy malware.
IFF Assessment
This campaign represents a sophisticated threat actor using advanced techniques to target critical industries, posing a significant risk to defenders.
Defender Context
Defenders should be aware of nation-state actors like Lazarus employing novel techniques such as post-quantum encryption and leveraging legitimate software for malicious purposes. This campaign highlights the evolving threat landscape and the need for robust endpoint detection and response (EDR) and network traffic analysis to identify and thwart such advanced persistent threats.