CuraSec

tag: Lazarus-Group · 2 items

Learn Lazarus Operation FlashHole Uses Post-Quantum Encryption Against South Korean Targets
2026-10-27 · The Hacker News · source ↗ #lazarus-group#malware#nation-state
  • Engineer — Learn: Post-quantum encryption in Lazarus C2 malware is a novel evasion technique worth tracking for future detection design, but no patch or config action is needed unless you run South Korean security software products in scope for this campaign.
  • SOC/IR — Learn: Lazarus Group expanding its encryption tradecraft to post-quantum algorithms in malware signals a shift worth noting for nation-state detection coverage, but the summary provides no IOCs, Sigma rules, or ATT&CK mappings to act on today.
  • Leader — Skip
Act archived Lazarus Exploits Patched Windows Zero-Day for SYSTEM Access via Dream Job
2026-08-13 · The Hacker News · source ↗ #lazarus-group#windows-zero-day#apt
  • Engineer — Act: A nation-state actor achieved SYSTEM-level privilege escalation via an actively exploited Windows zero-day — patch the now-available Microsoft fix across all Windows endpoints immediately, prioritizing internet-facing and privileged systems.
  • SOC/IR — Act: Operation Dream Job is an active Lazarus campaign with a novel backdoor; pull Check Point’s research for IOCs and behavioral signatures, then hunt for related artifacts on endpoints in your estate since the campaign’s known timeframe, especially if you defend defense or aerospace clients.
  • Leader — Plan: If your organization operates in defense or aerospace, brief leadership on Lazarus targeting and verify whether your threat intelligence program covers nation-state espionage campaigns at this tier; confirm your security team has applied the Windows patch and is hunting for the associated backdoor.