Lazarus Switches to INISAFE CrossWeb EX for Post-Quantum Payload Delivery in FlashHole
Lazarus has iterated from SyncHole to FlashHole by abusing another mandatory Korean security package and embedding post-quantum encryption. The shift exposes reliance on long-standing supply-chain weaknesses in financial authentication software while official reporting lags on the cryptographic advance. Pattern predicts continued focus on South Korean critical sectors through early 2027.
Operational significance lies in the narrowing gap between state tooling and commodity post-quantum libraries. Selective targeting and tailored lures indicate Lazarus is conserving resources after SyncHole exposure. Next phase will likely involve lateral movement through the same Innorix Agent flaw observed in 2025, followed by attempts against semiconductor and telecom firms already on the group’s prior list.
Kaspersky: Additional FlashHole variants using lattice-based crypto will surface in Q1 2027 targeting financial institutions.
Sources (2)
- [1]Kaspersky GReAT FlashHole Analysis(https://securelist.com/lazarus-flashhole-2025/)
- [2]AhnLab Operation Double Barrel Report(https://www.ahnlab.com/en/security-intelligence/operation-double-barrel/)