A Lazarus malware campaign uses post-quantum cryptography to protect malicious payload delivery during attacks against South Korean organizations. Researchers named the operation FlashHole and linked it to the North Korean hacking group.
The campaign combines established malware with newly identified tools and relies heavily on execution in memory. Meanwhile, its delivery process uses ML-KEM-1024, a standardized post-quantum key encapsulation mechanism, to establish secrets for decrypting incoming payloads.
FlashHole Targets South Korean Businesses
According to the researchers, FlashHole activity began in July 2025. They identified at least three affected companies across software, construction and wired communication equipment manufacturing.
However, they suspect the campaign reached additional organizations. The confirmed cases therefore represent a minimum rather than a complete victim count.
The attacks used phishing pages that directed targets to specially crafted GitHub pages. Those pages then loaded JavaScript from external domains, initiating a multistage infection chain.
The chain involved INISAFE CrossWeb EX, a security application widely used in South Korea. Its process executed the legitimate Windows program fsquirt.exe, which the attackers used to run shellcode.
That shellcode installed TechHub, a downloader that retrieved further malware from private GitHub repositories.
New Loaders Support Lazarus Malware Delivery
FlashHole also introduced ClientHub, a loader that supports communication through Dropbox and direct exchanges with LPEClient.
Researchers have previously associated LPEClient with Lazarus operations. In this campaign, it profiles victims, receives encrypted payloads through ClientHub and uses techniques designed to evade security monitoring.
Together, these components divide the infection process across several tools. TechHub retrieves additional malware, while ClientHub supports communications and LPEClient handles subsequent payload processing.
Much of the malicious code runs directly in memory. However, persistence mechanisms still leave some files on the infected system’s disk.
Post-Quantum Mechanism Protects Payload Exchange
The campaign’s use of ML-KEM distinguishes it from more conventional malware delivery methods. The NIST-approved mechanism establishes shared secrets that other encryption algorithms can use to protect data.
In FlashHole, LPEClient receives four blocks from its command-and-control infrastructure. Each block contains a 1,568-byte ML-KEM-1024 public key.
LPEClient then generates a separate shared secret and corresponding ciphertext for each public key. Next, it encrypts the ciphertexts using the GOST algorithm and sends them back through ClientHub.
The resulting shared secrets provide key material for Threefish encryption. LPEClient uses that material to decrypt a server response containing configuration parameters and an executable payload.
Therefore, ML-KEM supports the key-establishment stage rather than directly encrypting the final malware. Threefish protects the response that carries it.
Researchers believe this layered process helps conceal later payloads and reduce detection opportunities.
Cubridge Provides Remote Access and Surveillance
The final payload is Cubridge, a modular backdoor that LPEClient reflectively loads into the host’s memory.
Cubridge supports file management, command execution and reconnaissance. It can also capture screenshots and load additional payloads onto compromised systems.
Alongside the backdoor, researchers observed tools targeting Chromium-based browsers. These tools collect account credentials, cookies and browsing history.
As a result, the campaign combines remote access capabilities with browser data theft. Its modular design also allows attackers to introduce further functionality after the initial compromise.
Researchers Link FlashHole to Earlier Operations
Researchers place FlashHole within a broader cluster of activity known as Cascade Hole. They also link it to the earlier Operation SyncHole with medium-to-high confidence.
The findings show how Lazarus malware operations combine familiar components with new delivery and encryption techniques.
However, the use of post-quantum cryptography does not imply that attackers used a quantum computer. Here, the mechanism helps establish secrets for concealed payload delivery, alongside an infection chain that largely operates in memory.
0 responses to “Lazarus Malware Uses Post-Quantum Cryptography in Attacks”