North Korean hackers, known as the Lazarus Group, are using a post-quantum cryptographic mechanism called ML-KEM to secure the delivery of malicious payloads in new operations targeting South Korean organizations.
The vulnerability or weakness
The attacks exploited a post-quantum cryptographic mechanism called ML-KEM, which is a NIST-approved standard. The technique allowed the hackers to communicate with the command-and-control server for malware delivery.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
This attack poses a significant risk to businesses, particularly in the software, construction, and wired communication equipment manufacturing sectors, by compromising operations and potentially leading to data breaches and financial losses.
Industries affected
The attacks primarily affected South Korean organizations in the software, construction, and wired communication equipment manufacturing sectors.
Users affected
Users of affected organizations faced the risk of having their systems compromised, potentially leading to data theft, operational disruptions, and reputational damage.
Build these skills
Sources
- Lazarus hackers use post-quantum cryptography for malware delivery (BleepingComputer)
