The Lazarus Group has begun incorporating post-quantum cryptographic protections into malware delivery operations aimed at organizations in South Korea, according to analysis by Kaspersky. The threat actor combines established and newly developed malware families in what researchers describe as a highly intricate infection sequence. The operation, which Kaspersky has named FlashHole, demonstrates the group's shift toward quantum-resistant encryption methods.
Kaspersky's investigation found that the attackers deployed LPEClient, a tool previously linked to Lazarus, to retrieve ML-KEM-1024 public keys from command-and-control infrastructure. The malware then generated shared encryption keys enabling decryption of subsequently delivered payloads. The campaign commenced in July 2025 and relied on phishing pages directing victims to specially constructed GitHub repositories.
The infection chain begins when targets visit malicious GitHub pages that execute JavaScript from external sources. This triggers in-memory execution involving INISAFE CrossWeb EX, a security utility widely deployed across South Korea. The tool's process launched the legitimate Windows binary fsquirt.exe to execute shellcode that installed TechHub, a downloader that retrieves additional malware from private GitHub repositories.
Kaspersky confirmed at least three South Korean organizations across software development, construction, and wired communications equipment manufacturing were compromised, though the researchers suspect broader victimization. The attackers also deployed ClientHub, a loader supporting both Dropbox communications and direct data exchange with LPEClient for victim profiling and encrypted payload delivery.
Additional malware families observed in the campaign include Cubridge, a modular backdoor offering file management, command execution, reconnaissance, screenshot capture, and payload loading capabilities. The researchers also identified tools targeting Chromium-based browsers to extract account credentials, cookies, and browsing history. Most of the Lazarus code executes in memory, with persistence mechanisms leaving minimal traces on disk.
Post-Quantum Encryption Strategy
The deployment of ML-KEM, a NIST-approved post-quantum standard, distinguishes FlashHole from typical Lazarus operations. This algorithm is designed to protect data against "hack now decrypt later" attacks where adversaries collect encrypted traffic for future decryption once quantum computing capabilities mature.
Technical analysis revealed that LPEClient receives from the C2 server "a byte array comprising four 1,568‑byte blocks," each containing an ML‑KEM‑1024 public key. According to Kaspersky, "LPEClient then generates four distinct pairs of shared keys and ciphertexts from these blocks, encrypts the ciphertexts with the GOST algorithm, and transmits them to the C2 server via ClientHub." The resulting shared secrets provide key material for Threefish encryption, which decrypts the response containing parameters and executable payloads.
The final delivered payload is Cubridge, which LPEClient reflectively loads into memory. Kaspersky assesses that Lazarus employs this cryptographic approach combined with in-memory execution to substantially reduce detection likelihood. The researchers state that "The use of post-quantum cryptography shows that the group intends to hide subsequent payloads."
Kaspersky researchers attribute FlashHole to the broader Cascade Hole activity cluster and link it to the earlier Operation SyncHole with medium-to-high confidence.