Operation FlashHole：Lazarus 把受信任的安全軟件變成惡意程式投放通道，惡意負載採用後量子加密
The central lesson of a newly documented North Korea-linked espionage campaign is uncomfortable for defenders: the security agent on the endpoint — installed precisely because it is trusted, privileged and ubiquitous — became the loader. Compounding the problem, the payload it carried was wrapped in post-quantum encryption, a class of cryptography that has until now been almost exclusively a defensive proposition.
According to Kaspersky, the Russian cybersecurity firm, the campaign is tracked as Operation FlashHole and has been active since at least July 2025. The Hacker News reported the findings in October 2026, describing intrusions in at least three organisations in South Korea, spanning the construction, software, and wire-communication equipment manufacturing sectors.
Rather than fighting past the endpoint protection layer, the operators are assessed to have abused an established South Korean security product as the delivery mechanism for their payloads. That inversion is what makes the incident worth attention beyond the region. Endpoint agents typically run with elevated privileges and broad visibility over files, processes and network activity. When such a tool is co-opted, its own telemetry and its signed child processes stop functioning as detection sources and start functioning as attacker cover — the malicious activity arrives wrapped in the same provenance defenders are trained to trust.
The post-quantum element compounds the difficulty. Post-quantum algorithms have until now been almost exclusively a defensive proposition, adopted to defeat "harvest now, decrypt later" collection. Their appearance in offensive tooling suggests an actor making a deliberate bet on the long-term confidentiality of stolen data — and it materially complicates any later attempt to decrypt command-and-control traffic captured by network sensors.
Two caveats belong alongside the findings. First, the attribution to Lazarus rests on Kaspersky's assessment, as relayed by The Hacker News; it has not been independently corroborated here, and vendor attribution to state-linked groups remains an inference built on infrastructure, tooling and tradecraft overlap rather than proof. Second, the product-disclosure detail is limited: the report as summarised does not identify the specific security software by name, which leaves other deployments of the same tooling without a clear vendor advisory to act on. Organisations running locally developed endpoint security packages should be checking vendor channels directly rather than assuming they are unaffected.
For defenders, the practical response is architectural rather than vendor-specific. Any privileged agent should be treated as attack surface in its own right: baseline its child-process creation and outbound network behaviour so that anomalies surface, review how its configuration and update channels are secured, and validate that its tamper-protection features cannot be quietly redirected. Assume in parallel that a growing proportion of command-and-control traffic will not be inspectable, and weight endpoint-side detection, memory forensics and identity telemetry accordingly. Finally, treat the use of post-quantum cryptography in malware as an early signal of a wider trend worth tracking — captured traffic from campaigns like this may simply never be readable, whatever computing power is applied later.
The broader point for the IT community is that hardening has a blind spot wherever trust is assumed. The most privileged software in an environment is also the most consequential place for an attacker to stand.
Operation FlashHole：Lazarus 把受信任的安全軟件變成惡意程式投放通道，惡意負載採用後量子加密
一份最新記錄的朝鮮關聯間諜行動，其核心教訓對防禦方相當不利：安裝在端點上的安全代理（endpoint security agent）——正因為它受信任、擁有高權限且無處不在才會被部署——最終卻成為了惡意程式的 loader。更為雪上加霜的是，它所載運的惡意負載以後量子加密（post-quantum encryption）包裹，這類密碼技術迄今幾乎純粹用於防禦。
據俄羅斯網絡安全公司 Kaspersky 指出，該行動代號為 Operation FlashHole，至少自 2025 年 7 月起便持續活躍。The Hacker News 於 2026 年 10 月報道了相關發現，指入侵涉及南韓至少三個組織，橫跨建築、軟件及有線通信設備製造行業。
攻擊者據評估並未嘗試突破端點防護層，而是濫用一款南韓現有的安全產品，將其作為投放惡意負載的機制。正是這種顛倒，令事件的關注價值不限於當地。端點代理通常以提升的權限運行，對檔案、程序及網絡活動擁有廣泛視野。當這類工具被劫持，其自身的 telemetry 及已簽署的子進程便不再是偵測來源，反而成為攻擊者的掩護——惡意活動以防禦人員受訓信任的同一種來源身份出現。
後量子因素進一步加劇了難度。後量子算法迄今幾乎純屬防禦用途，採用目的是為了擊破「先收集、日後解密」（harvest now, decrypt later）的數據蒐集策略。如今它出現在攻擊工具中，顯示某行為者正對被竊數據的長期機密性作出蓄意押注——同時也實質增加了日後解讀網絡傳感器截獲的 command-and-control 流量的難度。
在總結發現之餘，有兩點須一併說明。第一，將事件歸因於 Lazarus 是基於 Kaspersky 的評估，經 The Hacker News 轉述；此處並未獨立核實，而安全廠商將行動歸因於國家關聯組織，向來是基於基礎設施、工具及 tradecraft 重疊所作的推斷，而非確鑿證據。第二，產品披露資訊有限：報告摘要並未指名具體的安全軟件，令其他部署同類工具的機構缺乏明確的廠商通告可供跟進。使用本地開發端點安全方案的機構，應直接查閱廠商渠道，而非假設自己不受影響。
對防禦方而言，實際應對之道在於架構層面，而非針對個別廠商。任何擁有高權限的代理都應被視為攻擊面本身：為其子進程建立及對外網絡行為建立 baseline，以便異常浮現；檢視其配置及更新渠道如何受保護；並驗證其防篡改（tamper-protection）功能無法被悄然轉向。與此同時，應假設越來越多的 command-and-control 流量將無法檢視，並相應加重端點偵測、memory forensics 及身份 telemetry 的比重。最後，應把惡意程式採用後量子密碼視為一個更廣泛趨勢的早期信號，值得持續追蹤——這類行動所截獲的日後流量，無論投入多少運算能力，可能根本永遠無法解讀。
對 IT 社群而言，更廣泛的啟示是：凡有信任被假設之處，加固（hardening）便存在盲點。環境中權限最高的軟件，同時也是攻擊者最具影響力的立足點。