Lazarus uses ML-KEM-1024 to hide payloads in Operation FlashHole
Securelist says at least three South Korean organizations were hit, with the earliest evidence in July 2025.
74
Malware
TouchHub
- Mentions · 7d2
- Mentions · 30d2
- All mentions2
- First seenOct 22, 2026
- Last mentioned3d ago
Timeline
2 articles · newest firstLazarus hid FlashHole malware traffic with post-quantum keys
Kaspersky ties July 2025 activity to at least three South Korean organizations and an LPEClient build using ML-KEM-1024.
74
Appears with
- TechHubmalware · 2
- Kasperskyorganization · 2
- ClientHubmalware · 2
- TouchShiftmalware · 2
- Cubridgemalware · 2
- LPEClientmalware · 2
- CrossWeb EXproduct · 1
- Lazarus Groupthreat actor · 1
- INISAFE CrossWeb EXproduct · 1
- Lazarusthreat actor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.