CONNECT WITH US
Cyber Security

Cyber Security

Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption

The Hacker News logo

Published on

Add as a preferred source on Google
Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption

The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors.

According to Russian cybersecurity company Kaspersky, the campaign has been active since at least July 2025. It's assessed to pick up from where Operation SyncHole left off.

"The group targeted victims more selectively, sending spear‑phishing emails with links to fabricated but relevant sites, such as portfolio and résumé pages tailored to each target," Sojun Ryu, senior security researcher at Kaspersky GReAT, said in an exhaustive analysis.

Operation SyncHole was first documented by Kaspersky in April 2025, detailing the state-sponsored adversary's targeting of South Korea's software, IT, financial, semiconductor manufacturing, and telecommunications industries since November 2024 to deliver malware such as ThreatNeedle, AGAMEMNON, wAgent, SIGNBT, and COPPERHEDGE.

The attacks were characterized by the exploitation of a security flaw in iniLINE Cross EX for malware delivery. Cross EX is a mandatory financial security software program installed by South Korean internet users on their computers to support security software across various browser environments when accessing online banking and government services.

The exploit was designed to launch the legitimate "SyncHost.exe" process and inject shellcode into it to load the ThreatNeedle backdoor. The attack chain also incorporated a one-day vulnerability in the Innorix Agent file transfer solution version 9.2.18.496 for lateral movement.

Operation FlashHole continues the prior wave's targeting of South Korea-focused software to breach targets. Where SyncHole exploited Cross EX, FlashHole has been found to abuse Initech's INISAFE CrossWeb EX , another mandatory financial security solution necessary to access online banking and government portals in the country.


Source link
Related Topics:Cyber Security

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.