North Korea-Linked Lazarus Uses Post-Quantum Crypto to Hide Malware

The Lazarus group from North Korea is using post-quantum encryption technologies to cover malware in their operation that targets South Korean companies. According to Kaspersky researchers, this operation, called FlashHole, consists of a combination of previously used tools and newly created malware.

The campaign has been active since at least July 2025 and has affected at least three organizations. The targets work in software, construction, and wired communication equipment manufacturing. Researchers believe other organizations may also have been exposed.

Lazarus Uses a Complex Infection Chain

Kaspersky says the attacks begin with phishing pages that lead targets to websites hosted on GitHub Pages. Some pages appear to be professional portfolio or résumé sites. Their aim is to persuade victims to visit and start the infection process.

The attack chain then abuses INISAFE CrossWeb EX, a security tool used in South Korea. Its process launches a genuine Windows program called fsquirt.exe. Attackers use this process to run hidden code and install TechHub, a downloader that retrieves more malware from private GitHub repositories.

This method helps attackers hide among normal software processes. Also, it runs most of the malware directly in the computer memory without creating too many files. However, some files help the attackers keep access after a restart.

Kaspersky identified at least three affected organizations, but has not named them. Researchers suspect the operation reached more victims. They link the campaign to earlier Lazarus activity.

New and Older Malware Work Together

FlashHole combines familiar Lazarus tools with newer malware. Among these tools is LPEClient, which the group has used in past operations. This software extracts details about a compromised machine, including information about installed security software on the machine, facilitating further payload delivery.

The operation further employs TechHub to download additional software. Also, the other component, ClientHub, serves as a loader and enables communication either via Dropbox or through direct exchanges with LPEClient. The tools facilitate the transfer of malware and information between the infected system and C2 server.

The final payload is made of Cubridge, a modular backdoor providing the attackers with control over the attacked system. The control takes place in forms such as file management, command execution, information gathering, capturing screenshots, and execution of more malware.

Kaspersky also discovered tools for stealing information from Chromium-based browsers. The information includes saved passwords, browsing history, plus cookies. With the passwords, hackers can access user accounts, whereas cookies allow for session hijacking.

These tools enable Lazarus to steal data and maintain access to systems. The mix of older malware and updated tools can also make the attack harder to track.

ML-KEM-1024 Protects Malware Delivery

The most notable feature of FlashHole is its use of ML-KEM-1024, a standardized post-quantum cryptographic mechanism. The US National Institute of Standards and Technology (NIST) approved ML-KEM to help protect communications against future threats from quantum computers.

The mechanism is not malware itself. Instead, it helps two sides create shared secret keys to protect later communications. In this campaign, LPEClient receives public keys from the C2 server and uses them to create shared keys and encrypted data.

LPEClient sends the encrypted material back through ClientHub. The malware then uses the key material with the Threefish encryption algorithm to decrypt a response containing instructions and another payload. It loads the final malware directly into computer memory.

This makes it harder for outsiders to read the traffic of attackers or inspect the payload during delivery. Nonetheless, post-quantum cryptography does not stop the detection all malware. It offers security for communications, but there are vulnerabilities that open the way for the activities of attackers to take place.

The use of ML-KEM stands out because the technology prepares systems for future quantum computing risks. Lazarus is applying it to hide malicious activity. Kaspersky says the approach helps protect later payloads from inspection.

Separately, Anthropic’s AI research has identified weaknesses in cryptographic systems, including a post-quantum scheme, highlighting the importance of evaluating how these protections perform against emerging threats.

Researchers Link FlashHole to Earlier Attacks

Kaspersky places FlashHole within a wider set of activity called Cascade Hole. Researchers also link it to Operation SyncHole, a campaign that targeted South Korean organizations in a similar way. They assess the connection with medium-to-high confidence, based on the targets, infection methods, and reuse of LPEClient.

The use of South Korean security software by the group is also important. When attackers abuse a trusted tool already on the computer of a victim, their activity may look less suspicious. Therefore, organizations need to review unusual behavior from trusted programs, not just block unknown applications.

Security teams have to make sure that employees receive training in recognizing targeted phishing emails and testing unknown links. They must also update anti-malware software regularly & limit user access rights. Further, they should always follow up on any suspicious activity on cloud- and source code-hosting services. These steps can reduce the chance that a phishing visit leads to a wider breach.

The findings of Kaspersky show how quickly threat groups can change their tools. Organizations should check both endpoint activity and the security of software used in daily work.