RuRiK@lunardevotee
but it could survive the change
will we survive to stay the same?
1000th prison in my eyes
i'm no stranger to the sight.
#POSTMORTEM #postmortemroblox
5401293.7K
Posts with #postmortem
Public posts on X that use #postmortem.
MIKE @mikenevermiss
cryptopsihoz @rimtolnLAZARUS ALREADY ENCRYPTS ITS MALWARE AGAINST QUANTUM COMPUTERS. Operation FlashHole, found by Kaspersky GReAT: AI-made résumé lures, a GitHub Pages site, a hole in a Korean banking plugin, then malware that lives in memory the idea: they swap keys like it's 2035 i went through the report. 3 confirmed victims in South Korea: a software dev, a construction company, a wired-telecom equipment maker. first attacks july 2025 ▹ how the chain works 1. LURE: AI-generated photo of a 'senior network engineer' · résumé later swapped for an interior designer portfolio · GitHub account created sep 2025 2. SITE: hosted on GitHub Pages · the same GitHub account doubles as C2 3. LOADER: the page pulls an external JS file from the attacker server · suspected bug in CrossWeb EX, a plugin Korean banks and gov sites require 4. MEMORY: TechHub · Cubridge · TouchShift · LPEClient updated + 2 new tools, TouchHub and ClientHub · C2 over GitHub and Dropbox 5. INJECT: the chain ends inside Fsquirt.exe, the stock Windows Bluetooth file-transfer binary 6. LPEClient: profiles AV + Windows security state → ML-KEM-1024 handshake → reflective load straight into memory alone each piece is old Lazarus. together it's a fake job seeker, a trusted bank plugin and a C2 channel nobody can decrypt later ▹ what post-quantum encryption actually is today's key exchange (RSA, ECDH) rests on factoring and discrete logs. Shor's algorithm on a big enough quantum computer breaks both ML-KEM is NIST standard FIPS 203 (aug 2024), built from CRYSTALS-Kyber. its hardness sits on lattices (module-LWE), where no fast quantum attack is known ML-KEM-1024 is the top level, AES-256 class · public key 1,568 bytes · ciphertext 1,568 bytes · 32-byte shared secret the point is harvest now, decrypt later: whoever records the C2 traffic today and waits 10 years for a quantum box still gets nothing ▹ why it matters Lazarus has run this since at least sep 2024, more than a year before the report. same group the FBI tied to the $1.5B Bybit hack. my bet: the wallet-drainer crews copy it next