Security1 hOctober 22, 2026, 03:31

Lazarus uses post-quantum cryptography for malware delivery

Kaspersky attributed the FlashHole campaign to Lazarus Group, which has targeted South Korean organizations since July 2025. The malware uses the ML-KEM-1024 post-quantum standard to exchange keys with its C2 server and decrypt payloads delivered through phishing GitHub pages.

BleepingComputer

Open source

Lazarus uses post-quantum cryptography for malware delivery

Attacks began in July 2025 against South Korean organizations
LPEClient fetches ML-KEM-1024 keys from C2 to decrypt payloads
Infection chain abuses INISAFE CrossWeb EX and fsquirt.exe
Final payload is Cubridge backdoor with remote control features

#Kaspersky#Lazarus#GitHub

MacSync malware uses public iCloud calendars to deliver new payloads

Security

Hacked HBO Reddit Account Used for Malware Delivery via ClickFix Attack

Security

Attackers use GitHub poem to infect thousands of servers with malware

Security

Lazarus uses post-quantum cryptography for malware delivery

MacSync malware uses public iCloud calendars to deliver new payloads

Hacked HBO Reddit Account Used for Malware Delivery via ClickFix Attack

Attackers use GitHub poem to infect thousands of servers with malware

Malaysia's MyDigital ID to Adopt Post-Quantum Cryptography