Kaspersky: Lazarus targets South Korean firms with AI lures and post-quantum encryption
- —Three South Korean companies were compromised in Operation FlashHole, with activity traced to July 2025
- —Lazarus used the ML-KEM-1024 post-quantum algorithm to encrypt data sent to and from infected machines
- —Decoy sites posed as developer resume pages and interior design studios, with AI-generated photos
- —Malware was executed via a flaw in the Inisafe CrossWeb EX security program
Why it matters: Lazarus, tied to major crypto exchange thefts, is among the first attackers to adopt post-quantum encryption, raising the bar for detecting intrusions at crypto firms.
Source: Digital Today
More on this
Security · Oct 24CYFIRMA: North Korea's Lazarus preparing attacks on South Korean government and banks
Security · Oct 28South Korea flags 4.4 million access attempts from North Korean IP range targeting financial firms
Regulation · Sep 18South Korean firms conduct $620 million in stablecoin payments abroad