A core vector of the campaign involves abusing trusted South Korean security software, such as INISAFE CrossWeb EX, to execute shellcode and deploy malicious payloads directly into system memory, allowing the actors to evade traditional endpoint detection. Most notably, the threat actors have integrated the NIST-approved ML-KEM-1024 post-quantum cryptography standard into their command-and-control infrastructure. By encrypting communication channels and payload delivery with post-quantum algorithms, the group aims to shield their operational traffic from current analysis and protect exfiltrated data against future decryption attempts. This escalation highlights how advanced threat groups are aggressively outpacing traditional defenders by weaponizing modern cryptographic standards and trusted administrative tools for espionage.
As state-sponsored threat actors rapidly adopt emerging cryptographic standards to mask their operations, organizations must look beyond perimeter defenses and prioritize continuous behavior-based monitoring of legitimate administrative and security tools.
Would you like to explore specific threat hunting strategies for memory-resident malware, or review guidance on securing software supply chains against similar supply-chain compromises?