Lazarus uses post-quantum cryptography to deliver malware - Межа

A campaign targeting South Korean organizations uses ML-KEM to protect malware delivery from command-and-control servers. Kaspersky attributes the operation, dubbed FlashHole, to the Lazarus Group.

The attacks began in July 2025 and used phishing pages that directed targets to specially crafted GitHub pages, according to Kaspersky researchers. They identified at least three affected South Korean companies in software, construction and wired communications equipment manufacturing, and suspect that more organizations were targeted.

This is reported by BleepingComputer .

The pages load JavaScript from external domains, triggering an in-memory infection chain involving INISAFE CrossWeb EX, a security tool popular in South Korea. Its process launches the legitimate Windows binary fsquirt.exe, which runs shellcode that installs TechHub. The downloader retrieves additional malware from private GitHub repositories.

LPEClient, malware previously associated with Lazarus, retrieves ML-KEM-1024 public keys from the command-and-control (C2) infrastructure and generates shared keys used to decrypt incoming payloads. Kaspersky’s analysis found that the C2 sends LPEClient “a byte array comprising four 1,568‑byte blocks,” each containing an ML-KEM-1024 public key.

LPEClient generates four pairs of shared keys and ciphertexts from the blocks, encrypts the ciphertexts with the GOST algorithm and sends them to the C2 server through ClientHub, Kaspersky says. The shared secrets provide key material for Threefish, which decrypts a response containing parameters and an executable payload. LPEClient then reflectively loads the final payload, the Cubridge backdoor, into the host’s memory.

ClientHub is a newly observed loader that supports Dropbox communications and direct data exchange with LPEClient. The researchers say LPEClient profiles victims, receives encrypted payloads through ClientHub and evades security monitoring. Cubridge supports file management, command execution, reconnaissance, screenshot capture and loading additional payloads.

Kaspersky also observed tools targeting Chromium-based browsers to collect account credentials, cookies and browsing history. Most of Lazarus’ code runs in memory, the researchers say, although persistence mechanisms leave some files on victims’ disks.

Kaspersky says using ML-KEM, a NIST-approved post-quantum cryptographic standard, stands out in FlashHole because the mechanism is intended to protect data against “hack now decrypt later” attacks. The company believes Lazarus uses it alongside the in-memory execution chain to reduce the risk of detection. “The use of post-quantum cryptography shows that the group intends to hide subsequent payloads,” Kaspersky says.

Kaspersky places FlashHole within the broader Cascade Hole activity and links it to the earlier Operation SyncHole with medium-to-high confidence.

Other topics you might like:

Beware of fake emails pretending to be from the State Tax Service spreading malware. Do not open suspicious attachments to protect your computer.

North Korea fired a ballistic missile from near Wonsan toward the Sea of Japan. It traveled more than 700 kilometers before falling into the water, with no damage reported.