Lazarus abuses South Korean security software, adds post-quantum crypto
Kaspersky attributes Operation FlashHole to Lazarus: abuse of Initech's INISAFE CrossWeb EX to deploy malware, with a loader now using ML-KEM-1024 post-quantum encryption for C2.