Shimoliy Koreya xakerlari yangi kiberjosuslik kampaniyasida zararli dasturlarni yashirish uchun post-kvant shifrlashdan foydalanadi

Shimoliy Koreya bilan bog'liq Lazarus Group Janubiy Koreya tashkilotlarini nishonga olgan kiberjosuslik kampaniyasida post-kvant kriptografiyasidan foydalandi va zararli dastur aloqalari hamda yuklamalarni ko'p bosqichli infeksiya zanjiri ortida yashirdi.

FlashHole operatsiyasi deb nomlangan kampaniya spear-fishing, zararli veb-saytlar, moliyaviy xavfsizlik dasturidan suiiste'mol qilish va asosan xotirada ishlaydigan modulli zararli dasturlarni birlashtirdi.

Kampaniya SyncHole operatsiyasidan keyin keldi — bu Lazarus operatsiyasi Janubiy Koreya subyektlarini watering-hole hujumlari va mahalliy dasturdan suiiste'mol qilish orqali nishonga olgan edi. Jabrlanuvchi sohalarning o'zgarishi guruh nishonini kengaytirganini ko'rsatadi.

SyncHole operatsiyasi avval dasturiy ta'minot, IT, moliya, yarimo'tkazgich ishlab chiqarish va telekommunikatsiya sohalaridagi kamida oltita tashkilotga ta'sir ko'rsatgan.

Dastlabki infeksiya zanjiri INISAFE CrossWeb EX — onlayn bank va davlat xizmatlariga kirishni qo'llab-quvvatlash uchun ishlatiladigan moliyaviy xavfsizlik ilovasi atrofida markazlashgan.

SyncHole'dan farqli o'laroq, u tegishli Cross EX mahsulotidan suiiste'mol qilgan bo'lsa, FlashHole CrossWeb EX'dan foydalandi.

FlashHole operatsiyasining dastlabki buzilish paytidagi hujum oqimi (Manba: Kaspersky).

Aniq ekspluatatsiya usuli noaniq qolmoqda, ammo tadqiqotchilar yakunda zararli kodni xotirada bajaradigan yuqori yaxlitlikka ega jarayon zanjirini kuzatishdi.

Lazarus, ehtimol, tanlangan jabrlanuvchilarni spear-fishing elektron pochta xabarlari orqali moslashtirilgan veb-saytlarga yo'naltirgan.

Aldovlar GitHub Pages'da joylashtirilgan rezyume sahifasi va ichki dizayn portfelini o'z ichiga olgan, har biri mo'ljallangan nishoniga moslashtirilgandek ko'rinadi.

Bitta rezyume tasviri sun'iy intellekt tomonidan yaratilgandek ko'rinadi, portfel tafsilotlari esa sun'iy ko'rinadi. Bu ishoralar aldovlarni yaratish yoki bezashda sun'iy intellekt yordam bergan bo'lishi mumkinligini ko'rsatadi, ammo tadqiqotchilar kontent qanday yaratilganini aniq aniqlamadi.

Dastlabki buzilishdan so'ng, qonuniy Windows dasturi fsquirt.exe CrossWeb EX jarayoni ostida ishga tushirildi va TechHub zararli dasturini o'z ichiga olgan shellcode bilan in'ektsiya qilindi.

Kaspersky tadqiqotchilari eng erta dalilni 2025-yil iyul oyiga bog'lashdi va Janubiy Koreyaning dasturiy ta'minot, qurilish va simli aloqa uskunalari sohalaridagi kamida uchta ta'sirlangan tashkilotni aniqlashdi.

Keyin zanjir doimiylik uchun TouchHub va TouchShift'ni, so'ngra ClientHub va LPEClient'ni joylashtirdi.

Bu komponentlar Cubridge — buyruqlarni qabul qilish va plaginlar, vositalar va modullarni joylashtirish uchun markaziy ramka — yuklanishiga yordam berdi. Bajarilishning katta qismi xotirada sodir bo'ldi, bu diskda aniqlash uchun mavjud fayllarni kamaytirdi.

Kampaniyaning eng e'tiborga molik kriptografik rivojlanishi yangilangan LPEClient variantida paydo bo'ldi. Tizimni profillashdan so'ng, LPEClient ML-KEM-1024 ochiq kalitlarini o'z ichiga olgan to'rtta 1 568 baytli blokni oldi.

Ish izlovchining ismi koreyscha "John Doe" versiyasiga o'xshaydi va portfel ma'nosiz tafsilotlar va tasodifiy kompaniyalar bilan to'ldirilgan.

ML-KEM — CRYSTALS-Kyber'dan olingan NIST standartlashtirilgan kalit-kapsulatsiya mexanizmi. Zararli dastur ushbu ochiq kalitlardan kalit materialini yaratdi va shifrlangan shifrmato'nni o'zining buyruq-va-nazorat infratuzilmasiga yubordi.

So'ngra u natijaviy umumiy kalitlarni Threefish shifri bilan ishlatib, yuklamani o'z ichiga olgan keyingi javobni shifrdan ochdi va u xotiraga reflektiv tarzda yuklandi.

Bu shunchaki hujumchilar kelajakdagi kvant kompyuterlariga qarshi shifrlash isbotini yaratganligi haqidagi da'vo emas.

Xabar qilingan texnika post-kvant kalit o'rnatishni kengroq, maxsus protokolda bir qatlam sifatida ishlatadi; bu o'z-o'zidan zararli dasturni ko'rinmas qilmaydi yoki har bir bosqich kvantga chidamli kriptografiyadan foydalanishini isbotlamaydi.

Cubridge TechHub'dan ko'ra mustahkamroq qo'l siqish jarayonini ishlatadi va RSA hamda RC6 algoritmlarini birlashtiradi.

Cubridge'ning aloqa ketma-ketligi (Manba: Kaspersky).

Uning ahamiyati operatsion: u keyingi yuklama yetkazib berishni himoya qilish uchun ishlatiladigan almashinuvga murakkablik qo'shadi va zararli dasturning buyruq kanali tahlilini murakkablashtiradi.

Kengroq kampaniya Lazarusning Janubiy Koreya dasturiy ta'minot ekotizimiga e'tibor qaratishini aks ettiradi.

Moliyaviy xizmatlarni qo'llab-quvvatlash uchun o'rnatilgan xavfsizlik ilovalari zaifliklar yoki xavfsiz bo'lmagan o'zaro ta'sirlar suiiste'mol qilinganda yuqori qiymatli hujum yuzalariga aylanishi mumkin.

Janubiy Koreyaning majburiy moliyaviy xavfsizlik dasturiy ta'minotini o'rgangan 2025-yilgi USENIX tadqiqoti xavfsizlik zaifliklarini hujjatlashtirdi va 19 ta zaiflikni xabar qildi, tadqiqotchilar ularning ochib berilgan va tuzatilganini aytishdi.

USENIX tadqiqoti bu keng tarqalgan dasturlar nima uchun ehtiyotkor xavfsizlik tekshiruvini talab qilishini tushuntirish uchun kontekst beradi.

FlashHole operatsiyasi, shuningdek, Lazarusning modulli vositalarga o'tishining davom etishini ko'rsatadi. TechHub erta bosqichli yetkazib berish va profillashni bajardi, ClientHub va Cubridge esa moslashuvchan yuklama boshqaruvi va vazifa bajarilishini ta'minladi.

FlashHole va SyncHole'da ko'ringan LPEClient, razvedka va yuklama yetkazib berish uchun asosiy komponent bo'lib qoldi.

Himoyachilar uchun bu holat ishonchli xavfsizlik dasturidan kelib chiqqan g'ayrioddiy faoliyatni kuzatish, shubhali xotirada bajarilishni tekshirish va mahalliy talab qilinadigan xavfsizlik ilovalarini yangilab turish qiymatini ta'kidlaydi.

Buzilish ko'rsatkichlari

Eslatma: IP manzillar va domenlar tasodifiy hal qilish yoki giperhavola qilishning oldini olish uchun ataylab defang qilingan (masalan, [.]). Faqat MISP, VirusTotal yoki SIEM kabi nazorat qilinadigan tahdid razvedka platformalarida qayta fang qiling.

North Korea-linked Lazarus Group used post-quantum cryptography in a cyberespionage campaign targeting South Korean organizations, concealing malware communications and payloads behind a multi-stage infection chain.

Dubbed Operation FlashHole, the campaign combined spear-phishing, malicious websites, abuse of financial security software and modular malware that largely operated in memory.

The campaign followed Operation SyncHole, a Lazarus operation that targeted South Korean entities using watering-hole attacks and abused local software. The shift in victim industries suggests the group broadened its targeting.

Operation SyncHole previously affected at least six organizations across software, IT, finance, semiconductor manufacturing and telecommunications.

The initial infection chain centered on INISAFE CrossWeb EX, a financial security application used to support access to online banking and government services.

Unlike SyncHole, which abused the related Cross EX product, FlashHole leveraged CrossWeb EX.

Operation FlashHole attack flow during initial compromise (Source : Kaspersky).

The exact exploitation method remains unclear, but researchers observed a high-integrity process chain that ultimately executed malicious code in memory.

Lazarus likely directed selected victims to tailored websites through spear-phishing emails.

The lures included a résumé page and an interior-design portfolio hosted on GitHub Pages, each seemingly customized for its intended target.

One résumé image appeared AI-generated, while the portfolio’s details looked artificial. These clues suggest AI may have helped produce or embellish the lures, but researchers did not establish precisely how the content was created.

After initial compromise, the legitimate Windows program fsquirt.exe was launched under the CrossWeb EX process and injected with shellcode carrying TechHub malware.

Kaspersky Researchers traced, the earliest evidence to July 2025 and identified at least three affected organizations in South Korea’s software, construction and wired-communications equipment sectors.

The chain then deployed TouchHub and TouchShift for persistence, followed by ClientHub and LPEClient.

These components helped load Cubridge, a central framework for receiving commands and deploying plugins, tools and modules. Much of the execution took place in memory, reducing the files available for on-disk detection.

The campaign’s most notable cryptographic development appeared in an updated LPEClient variant. After profiling a system, LPEClient obtained four 1,568-byte blocks containing ML-KEM-1024 public keys.

The job seeker’s name resembles the Korean version of “John Doe,” and the portfolio was populated with seemingly meaningless details and random companies.

ML-KEM is the NIST-standardized key-encapsulation mechanism derived from CRYSTALS-Kyber. The malware generated key material from those public keys and sent encrypted ciphertexts to its command-and-control infrastructure.

Suspected use of an AI-generated image on the résumé site (Source : Kaspersky).

It then used the resulting shared keys with the Threefish cipher to decrypt a later response containing a payload, which was reflectively loaded into memory.

This is not simply a claim that attackers have built encryption proof against future quantum computers.

The reported technique uses post-quantum key establishment as one layer in a broader, custom protocol; it does not by itself make malware invisible or prove that every stage uses quantum-resistant cryptography.

Cubridge employs a more robust handshaking process than TechHub, combining the RSA and RC6 algorithms.

Cubridge’s communication sequence (Source : Kaspersky).

Its significance is operational: it adds complexity to the exchange used to protect subsequent payload delivery and complicates analysis of the malware’s command channel.

The broader campaign reflects Lazarus’s established focus on South Korea’s software ecosystem.

Security applications installed to support financial services can become high-value attack surfaces when vulnerabilities or unsafe interactions are abused.

A 2025 USENIX study of South Korea’s mandatory financial-security software documented security weaknesses and reported 19 vulnerabilities, which researchers said had been disclosed and patched.

The USENIX study gives context for why these widely deployed programs warrant careful security review.

Operation FlashHole also illustrates Lazarus’s continuing shift toward modular tooling. TechHub handled early-stage delivery and profiling, while ClientHub and Cubridge enabled flexible payload management and task execution.

LPEClient, seen in both FlashHole and SyncHole, remained a key component for reconnaissance and payload delivery.

For defenders, the case underscores the value of monitoring unusual activity originating from trusted security software, investigating suspicious in-memory execution, and keeping locally required security applications patched.

Indicators of compromise

Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.