Lazarus hid FlashHole malware traffic with post-quantum keys
Kaspersky ties July 2025 activity to at least three South Korean organizations and an LPEClient build using ML-KEM-1024.
74
Product
INISAFE CrossWeb EX
- Mentions · 7d3
- Mentions · 30d3
- All mentions3
- First seenOct 21, 2026
- Last mentioned3d ago
Timeline
3 articles · newest firstLazarus uses ML-KEM to deliver malware in FlashHole attacks
Kaspersky says phishing led to in-memory loaders and the Cubridge backdoor at South Korean firms, starting in July 2025.
74
Lazarus Operation FlashHole targets South Korean organizations
Kaspersky links at least three firms in three sectors, with earliest evidence in July 2025.
74
Appears with
- Lazarus Groupthreat actor · 3
- Kasperskyorganization · 3
- TechHubmalware · 2
- ClientHubmalware · 2
- Cubridgemalware · 2
- LPEClientmalware · 2
- TouchShiftmalware · 1
- TouchHubmalware · 1
- CrossWeb EXproduct · 1
- GitHubproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.