Lazarus“闪洞行动”结合AI钓鱼与后量子加密
卡巴斯基称，Lazarus Group 的 Operation FlashHole 至少自2025年7月起活动，已攻击韩国软件、建筑及有线通信设备领域的至少三家机构。更新后的 LPEClient 使用四次 ML-KEM-1024 密钥交换保护载荷传输，而通过 GitHub Pages 页面投递疑似 AI 生成简历进行鱼叉式钓鱼，是可能的初始入侵路径。卡巴斯基对简历及网站由 AI 生成的判断，以及确切感染触发方式，均仍存在不确定性。
此次行动显示 Lazarus 将疑似由 AI 辅助的社交工程与后量子密码载荷传输结合运用，但该密码层保护的是传输中的流量，并不能检测端点上的恶意软件。
- Kaspersky says Lazarus's Operation FlashHole, active since at least July 2025, hit at least three South Korean software, construction, and telecom equipment firms
- An updated LPEClient tool uses four ML-KEM-1024 key exchanges to protect payload delivery, a design Check Point also documented
- The post-quantum layer guards traffic against future decryption, not endpoint detection, and the most likely way in for the hackers was still phishing
North Korea's most notorious hacking group has been caught protecting its malware with the same post-quantum cryptography that governments and tech firms are still rolling out to safeguard their own data.
In its analysis of a campaign dubbed Operation FlashHole, Kaspersky's Global Research and Analysis Team (GReAT) says an updated version of LPEClient, a Lazarus Group tool, now uses ML-KEM-1024, a key exchange mechanism designed to resist attacks from future quantum computers, to secure the channel it uses to download more malware.
The findings describe a campaign active since at least July 2025 that has hit at least three South Korean organizations in the software, construction, and wired communication equipment manufacturing sectors.
#Lazarus Group#LPEClient#ML-KEM-1024#INISAFE CrossWeb EX#ClientHub#GitHub Pages#Kaspersky Global Research and Analysis Team#Check Point Research