Reported by Bleeping Computer. North Korean hackers are utilizing a post-quantum cryptographic mechanism to secure malicious payload delivery in a sophisticated campaign dubbed Operation FlashHole.
Researchers at Kaspersky attributed the activity to the Lazarus Group, noting the campaign targets South Korean organizations across the software, construction and communication equipment sectors. The infection chain begins with phishing pages that lead victims to malicious GitHub repositories. Attackers leverage a security tool, INISAFE CrossWeb EX, to execute shellcode and install the TechHub downloader. A key innovation in this operation is the use of the ML-KEM post-quantum cryptographic standard to secure communications between the malware and command-and-control servers. By generating shared keys through this method, the threat actors can decrypt incoming payloads, including the modular Cubridge backdoor, while minimizing detection risks. The malware also employs LPEClient and ClientHub to profile victims and exfiltrate data. Kaspersky researchers suggest this approach aims to protect stolen data from future decryption attempts. While the group relies heavily on in-memory execution to evade security monitoring, persistence mechanisms remain on infected systems. This campaign is linked to previous operations, highlighting the evolving tactics of the Lazarus Group as they integrate advanced encryption standards into their malicious infrastructure.
Source: Bleeping Computer
