Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption

As cited

Copy frozen at 2026-10-27 15:26 UTC (site build).

threat intel

Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption

The Lazarus Group, linked to North Korea, has conducted a cyber espionage campaign called Operation FlashHole targeting at least three South Korean organizations in construction, software, and wire-communication equipment manufacturing. The campaign, active since at least July 2025, abuses local security software to deploy malware using post-quantum encryption.

Why it matters: South Korean organizations in critical manufacturing and infrastructure sectors face active espionage from a nation-state adversary; practitioners should review whether Lazarus indicators of compromise (IOCs) match their environment and assess post-quantum encryption capabilities in their threat detection.

Source published

2026-10-27 11:32 UTC

First seen by Cybersecurity Tracker

2026-10-27 14:34 UTC