Lazarus uses AI and post-quantum crypto in Operation FlashHole attacks
- —Campaign has run since July 2025, hitting three South Korean organizations
- —Infection likely exploited a vulnerability in the legitimate CrossWeb EX tool
- —LPEClient uses ML-KEM-1024 to secure its link to attacker servers
- —New TouchHub and ClientHub tools install malware, one version relays via Dropbox
Why it matters: Post-quantum encryption in Lazarus hands makes attacks on crypto firms and exchanges harder to detect, and the group keeps targeting them.
Source: Код Дурова