Lazarus xakerlari zararli dastur yetkazib berish uchun post-kvant kriptografiyasidan foydalanmoqda

Lazarus xakerlari zararli dastur yetkazib berish uchun post-kvant kriptografiyasidan foydalanmoqda

Bill Toulas tomonidan

2026-yil 21-oktabr

16:31

0

Shimoliy Koreya xakerlari yangi operatsiyalarda eski va yangi zararli dasturlarni birlashtirgan holda zararli yuk yetkazib berishni ta'minlash uchun post-kvant kriptografik mexanizmidan foydalanmoqda.

Kampaniya Janubiy Koreya tashkilotlarini "ancha murakkab" infeksiya zanjiri orqali nishonga oladi. Kaspersky kiberxavfsizlik kompaniyasi tadqiqotchilari operatsiyani FlashHole deb nomladilar va uni Lazarus guruhiga bog'ladilar.

Zararli dastur tahlili shuni ko'rsatdiki, tahdid aktori zararli dastur yetkazib berish uchun buyruq va boshqaruv (C2) serveri bilan aloqa qilishda standartlashtirilgan ML-KEM post-kvant kriptografik mexanizmidan foydalangan.

Kaspersky ma'lumotiga ko'ra, hujumchilar avval Lazarus bilan bog'liq bo'lgan LPEClient zararli dasturidan foydalanib, C2 infratuzilmasidan ML-KEM-1024 ochiq kalitlarini olgan va keyinchalik keladigan yuklarni shifrlashni ochish imkonini beruvchi umumiy kalitlarni yaratgan.

Tadqiqotchilarning aytishicha, hujumlar 2025-yil iyul oyida boshlangan va nishonlarni maxsus tayyorlangan GitHub sahifalariga yo'naltiruvchi fishing sahifalariga tayangan.

FlashHole hujum zanjiri Manba: Kaspersky

Bu sahifalar tashqi domenlardan JavaScript kodini yuklaydi, bu esa INISAFE CrossWeb EX — Janubiy Koreyada mashhur xavfsizlik vositasi — ishtirokidagi xotirada bajariladigan zanjirni ishga tushiradi.

Xavfsizlik vositasining jarayoni qonuniy Windows binar fayli fsquirt.exe ni bajargan, bu esa TechHub — qo'shimcha zararli dasturlarni shaxsiy GitHub omborlaridan olishga mas'ul yuklovchini o'rnatadigan shellkodni ishga tushirish uchun ishlatilgan.

Infeksiya zanjiri umumiy ko'rinishi Manba: Kaspersky

Kaspersky Janubiy Koreyadagi kamida uchta kompaniyani — dasturiy ta'minot, qurilish va simli aloqa uskunalari ishlab chiqarish sohalarida — aniqlagan, ammo ko'plab boshqa tashkilotlar ham ta'sirlangan deb gumon qilmoqda.

Bu hujumlarda kuzatilgan yana bir yangi vosita — ClientHub, bu yuklovchi Dropbox aloqalarini hamda LPEClient bilan to'g'ridan-to'g'ri ma'lumot almashishni qo'llab-quvvatlaydi.

Tadqiqotchilar LPEClient qurbonlarni profillaydi, ClientHub orqali shifrlangan yuklarni oladi va xavfsizlik monitoringidan qochadi, deb ta'kidlaydilar.

LPEClient evolyutsiyasi Manba: Kaspersky

Hujumlarda kuzatilgan yana bir zararli dastur — Cubridge, bu modulli orqa eshik bo'lib, fayl boshqaruvi, buyruq bajarish va razvedka imkoniyatlarini taqdim etadi, shuningdek skrinshot olish va zararlangan tizimlarga qo'shimcha yuklarni yuklashni ham qo'llab-quvvatlaydi.

Kaspersky shuningdek Chromium asosidagi brauzerlar uchun hisob ma'lumotlari, cookie-fayllar va ko'rish tarixini nishonga oladigan qo'shimcha vositalarni ham ko'rgan.

Tadqiqotchilar Lazarus kodining aksariyati xotirada ishlashini, ammo doimiylik mexanizmlari qurbon diskida ba'zi fayllarni qoldirishini ta'kidlaydilar.

Cubridge aloqalari Manba: Kaspersky

Post-kvant shifrlash

FlashHole operatsiyasida ML-KEM post-kvant kriptografik mexanizmidan foydalanish alohida e'tiborga loyiq, chunki bu NIST tomonidan tasdiqlangan standart bo'lib, "hozir xakerlik qil, keyin shifrlashni och" hujumlaridan ma'lumotlarni himoya qilish usuli sifatida ko'plab dasturiy loyihalarda mavjud.

Texnik tahlil shuni ko'rsatdiki, LPEClient C2 dan "to'rtta 1 568 baytli blokdan iborat bayt massivi" olgan, har biri ML-KEM-1024 ochiq kalitini o'z ichiga olgan.

"LPEClient keyin bu bloklardan to'rtta alohida umumiy kalitlar va shifrlangan matnlar juftligini yaratadi, shifrlangan matnlarni GOST algoritmi bilan shifrlaydi va ularni ClientHub orqali C2 serveriga yuboradi," deb tushuntiradi Kaspersky.

Umumiy sirlar Threefish — yana bir shifrlash algoritmi — uchun kalit materialini ta'minlaydi, bu esa parametrlar va bajariladigan yukni o'z ichiga olgan javobni shifrlashni ochadi.

Yakuniy yuk — Cubridge, uni LPEClient xost xotirasiga reflektiv tarzda yuklaydi.

Kaspersky Lazarus bu usulni xotirada bajariladigan zanjir bilan birga ishlatib, aniqlash xavfini minimal darajaga tushirishni maqsad qilgan deb hisoblaydi.

"Post-kvant kriptografiyasidan foydalanish guruh keyingi yuklarni yashirish niyatida ekanligini ko'rsatadi," deydi Kaspersky.

Kaspersky tadqiqotchilari FlashHole ni kengroq Cascade Hole faoliyati doirasiga joylashtiradilar va uni avvalgi Operation SyncHole bilan o'rta-yuqori ishonch bilan bog'laydilar.

Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining atigi 37% to'xtatiladi

Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalangach, oldini olish keskin pasayadi.

Blue Report 2026 mijoz ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnika-texnika himoyalarni o'lchaydi.

Hisobotni oling

Tegishli maqolalar:

FBI Texasda DPRK IT ishchi noutbuk fermalarini reyd qildi, AQSh fuqarolari hibsga olindi

Yaponiyaning Onamae Desktop Cloud xakerlandi, 27 000 tagacha server ta'sirlandi

ClickFix hech qachon bunchalik katta bo'lmagan, va AI vositalari uning eng ishonarli jozibasi

OVHcloud CLI GitHub'da orqa eshik bilan chiqarildi, ishlab chiquvchilar sirlarini o'g'irlash uchun

Xakerlar AOMEI yangilash serverlarini egallab, zararli dasturlarni yashirin tarqatdi

Lazarus hackers use post-quantum cryptography for malware delivery

By Bill Toulas

October 21, 2026

04:31 PM

0

North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware.

The campaign targets South Korean organizations through a “rather complex” infection chain. Researchers at cybersecurity company Kaspersky dubbed the operation FlashHole and attributed it to the Lazarus Group.

Analysis of the malware revealed that the threat actor used the standardized ML-KEM post-quantum cryptographic mechanism to communicate with the command-and-control (C2) server for malware delivery.

Kaspersky says the attackers used LPEClient malware, previously associated with Lazarus, to receive ML-KEM-1024 public keys from its C2 infrastructure and generate shared keys that allowed it to decrypt subsequently incoming payloads.

According to the researchers, the attacks started in July 2025 and relied on phishing pages directing targets to specially crafted GitHub pages.

FlashHole attack chain

Source: Kaspersky

These pages load JavaScript code from external domains, triggering an in-memory execution chain that involved INISAFE CrossWeb EX, a security tool popular in South Korea.

The security tool’s process executed the legitimate Windows binary fsquirt.exe, which was used to run shellcode that installed TechHub, a downloader responsible for retrieving additional malware from private GitHub repositories.

Infection chain overview

Source: Kaspersky

Kaspersky identified at least three companies in South Korea, in the software, construction, and wired communication equipment manufacturing sectors, but suspects that many more organizations were affected.

Another new tool seen in these attacks is ClientHub, a loader that supports Dropbox communications as well as direct data exchange with LPEClient.

The researchers note that LPEClient profiles victims, receives encrypted payloads through ClientHub, and evades security monitoring.

LPEClient evolution

Source: Kaspersky

Another malware observed in the attacks is Cubridge, a modular backdoor that provides file management, command execution, and reconnaissance capabilities, and also supports screenshot capturing and loading additional payloads on infected systems.

Kaspersky has also seen additional tools targeting Chromium-based browsers for account credentials, cookies, and browsing history.

The researchers note that most of Lazarus’ code runs in memory, though persistence mechanisms leave some files on the victim’s disk.

Cubridge communications

Source: Kaspersky

Post-quantum encryption

The use of the ML-KEM post-quantum cryptographic mechanism stands out in operation FlashHole since it is a NIST-approved standard present in multiple software projects as a way to protect data from “hack now decrypt later” attacks.

The technical analysis showed that LPEClient obtained from the C2 "a byte array comprising four 1,568‑byte blocks," each containing an ML‑KEM‑1024 public key.

"LPEClient then generates four distinct pairs of shared keys and ciphertexts from these blocks, encrypts the ciphertexts with the GOST algorithm, and transmits them to the C2 server via ClientHub," Kaspersky explains.

The shared secrets supply the key material for Threefish, another encryption algorithm, which decrypts the response containing parameters and an executable payload.

The final payload is Cubridge, which LPEClient reflectively loads into the host’s memory.

Kaspersky believes Lazarus uses this method along with an in-memory execution chain to lower detection risk to a minimum.

“The use of post-quantum cryptography shows that the group intends to hide subsequent payloads," Kaspersky says.

Kaspersky researchers place FlashHole within the broader Cascade Hole activity and link it to the earlier Operation SyncHole with medium-to-high confidence.

Once attackers have valid credentials, only 37% of their actions are blocked

Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.

The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.

Get the report

Related Articles:

FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested

Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected

ClickFix has never been bigger, and AI tools are its most convincing lure yet

OVHcloud CLI releases backdoored on GitHub to steal developer secrets

Hackers hijack AOMEI update servers to secretly spread malware