North Korea’s Evolved Lazarus: Deceived With AI, Hidden With Post-Quantum Cryptography
IT DAILY ·
✦ AI Summary
Senior security researcher Ryu So-jun presented Lazarus's recent activities and "Operation FlashHole" at the "SAS 2026" event.
Kaspersky said Lazarus carried out attacks combining AI and post-quantum cryptography (PQC), and that at least 3 organizations were affected in South Korea's construction, SW, and wired telecommunications equipment manufacturing sectors.
The attack used targeted phishing to draw victims in before connecting to a Watering Hole, and investigators found that PQC algorithm "ML-KEM-1024" was applied to LPEClient.
At the "SAS 2026" event held in Bali, Indonesia, on the 21st, Ryu So-jun, a senior security researcher on Kaspersky's Global Research and Analysis Team (GReAT), gave a presentation on the recent activities of the North Korea-linked hacking group Lazarus.
According to the presentation, Lazarus was confirmed to have carried out cyberattack activity combining AI and post-quantum cryptography (PQC). In connection with this, senior security researcher Ryu So-jun introduced a cyberespionage operation believed to have been carried out by Lazarus, "Operation FlashHole."
The estimated targets affected by the attack included some companies in South Korea's construction sector, some companies in the domestic SW sector, and some companies in the domestic wired telecommunications equipment manufacturing sector.
Kaspersky said it had detected signs last year of targeted attacks by Lazarus aimed at six sectors in South Korea. The targeted sectors were IT, software, semiconductors, finance, and telecommunications, among six sectors in total.
One of those cases was "Operation SinkHole." This attack was a "Watering Hole"-type attack that exploited software vulnerabilities in South Korea's financial sector. It compromised legitimate websites, inserted malicious code, and then used vulnerabilities in outdated security software on visitors' PCs.
Lazarus had been quiet since February 2025, but reemerged about four months later with a new attack method. The new operation was named "Operation FlashHole," and Kaspersky found that this attack showed technical and tactical advancement over last year's attack. Kaspersky said at least 3 organizations were affected, and the impacted sectors were South Korea's construction industry, the SW industry, and the wired telecommunications equipment manufacturing industry.
The attack showed a flow in which targeted phishing was added to draw targets in with tailored phishing, then linked to a Watering Hole attack. Lazarus sent phishing emails tailored to the victims and then lured them to a site for the Watering Hole attack.
The disguise and luring techniques in this process resembled the characteristics of lure-based attacks disguised as job-hunting activity, also seen in "Operation DreamJob." During Kaspersky's investigation, a fake resume impersonating a developer of advanced network equipment was discovered, and the fake resume included an AI-generated photo. Kaspersky researchers inferred that the attacker may have used AI to create a fake website tailored to the target.
At the same time, one of the defining features of this attack was post-quantum cryptography. Lazarus applied the PQC algorithm "ML-KEM-1024" to "LPEClient," which it had used for years. PQC is an encryption technology intended to protect communications from potential attacks by quantum computers.
LPEClient established an encrypted connection with the C2 server based on the PQC algorithm, then downloaded additional malware, which ran in the victim PC's memory. It was also reported to have updated functions for evading detection by security solutions.
Researcher Ryu said Lazarus is an organization that is thorough in concealing its attack activities, and explained that it often uses South Korean proxy points as C2 servers. He added that it appears to have applied PQC for the purpose of preventing exposure during that process.
He also said that Lazarus targeted the SW sector as a common target industry both last year and this year. Ryu interpreted this as an intention to compromise SW companies, steal source code, and use it in subsequent attacks.
Source: IT DAILY · Kim Ho-jun
Original: https://www.itdaily.kr/news/articleView.html?idxno=242353
References
This article was produced with the help of an automated content generation algorithm.
Source: IT DAILY
View originalThis article was summarized and organized by BizCrush based on the original article from IT DAILY. For exact quotations and full details, please refer to the original article.