Lazarus Group Hijacks South Korean Security Software to Deploy Post‑Quantum Encrypted Malware in Supply‑Chain Attack

What happened

North Korea‑linked Lazarus Group has been attributed to a cyber‑espionage campaign called Operation FlashHole, targeting three South Korean organizations across construction, software, and wire‑communication equipment manufacturing. Since at least July 2025, the actors have abused a domestically‑produced security‑software product, inserting a custom loader that encrypts its malicious payloads with a post‑quantum algorithm. The malicious updates were signed with legitimate certificates, allowing the malware to bypass endpoint defenses and remain undetected for months. Kaspersky’s analysis, reported by The Hacker News on 26 Oct 2026, details the use of anomalous code‑signing certificates and C2 beaconing linked to Lazarus.

Why it matters for trust and compliance

• The breach demonstrates why continuous third‑party risk monitoring and verifiable vendor security evidence are essential for maintaining trust and control assurance across frameworks.
• Implement continuous monitoring of vendor updates and certificate usage to detect supply‑chain anomalies.
• Collect and retain forensic evidence of third‑party software integrity for audit readiness.

Who is affected

Recommended actions

1. Create an inventory of all third‑party security tools and validate their supply‑chain provenance.
2. Enable real‑time monitoring of code‑signing certificates and flag any unexpected changes.