Lazarus Group Uses Post-Quantum Crypto to Deliver Malware in FlashHole Campaign

North Korean-linked Lazarus Group operatives are deploying post-quantum cryptography to secure malware delivery in a new cyberespionage campaign targeting South Korean organizations. Researchers at Kaspersky named the operation FlashHole and identified its earliest evidence in July 2025.

The attackers utilized the standardized ML-KEM post-quantum cryptographic mechanism to communicate with command-and-control servers. This NIST-approved standard protects data from future decryption threats. The group combined this modern encryption with older malware tools to create a complex infection chain that obscures malicious activity from security monitoring tools.

Technical Execution and Malware Tools

The infection process begins with spear-phishing emails directing victims to tailored GitHub Pages. These sites, which included fake résumés and interior-design portfolios, loaded JavaScript from external domains. Researchers noted that some content appeared artificial, suggesting the possible use of AI to generate lures, though the exact creation method was not confirmed.

Once the code executed, it abused INISAFE CrossWeb EX, a popular South Korean financial security application. The tool’s process launched the legitimate Windows binary fsquirt.exe, which ran shellcode to install TechHub. This downloader retrieved additional malware from private GitHub repositories, including ClientHub and LPEClient.

LPEClient received ML-KEM-1024 public keys from the command-and-control infrastructure to generate shared keys for decrypting incoming payloads. The chain also deployed Cubridge, a modular backdoor that supports file management, command execution, and screenshot capture. Most of the malware operated in memory, leaving few files on disk for detection.

Targeted Sectors and Impact

Kaspersky identified at least three affected companies in South Korea across the software, construction, and wired communication equipment manufacturing sectors. The researchers suspect that more organizations were compromised but could not confirm the full scope. This campaign follows Operation SyncHole, which targeted similar entities using watering-hole attacks.

The shift in targeting and techniques indicates a broadening of Lazarus Group operations. Unlike previous campaigns that abused related Cross EX products, FlashHole specifically leveraged CrossWeb EX. The use of post-quantum encryption highlights the group's effort to protect its communications against advanced decryption methods, even though the initial exploitation method remains unclear.

What should you do?

Security teams should monitor for unusual network traffic involving post-quantum cryptographic handshakes or connections to GitHub Pages from internal systems. Administrators should review logs for the execution of fsquirt.exe or other legitimate binaries spawned by financial security applications like INISAFE CrossWeb EX. Organizations should also audit GitHub Pages usage and restrict access to external JavaScript sources.

What to do and how to stay safe: Lazarus Group

• Monitor network logs for connections to GitHub Pages or Dropbox from endpoints that do not typically access these services, especially if they involve encrypted payloads.
• Inspect process trees for legitimate Windows binaries like fsquirt.exe running under unexpected parent processes, such as financial security applications.
• Review memory-resident processes for signs of modular backdoors like Cubridge or loaders such as ClientHub, which may leave minimal disk artifacts.
• Verify the integrity of phishing lures by checking for AI-generated images or artificial details in emails directing users to external portfolio or résumé sites.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How does the Lazarus Group use post-quantum cryptography in this campaign?

They use the ML-KEM mechanism to establish secure keys with command-and-control servers, allowing them to encrypt and decrypt malware payloads during delivery.

Which South Korean software is being abused in Operation FlashHole?

The attackers abuse INISAFE CrossWeb EX, a financial security tool used for accessing online banking and government services, to execute malicious code.

What sectors are targeted by this campaign?

Kaspersky identified victims in the software, construction, and wired communication equipment manufacturing sectors in South Korea.