Kaspersky: Lazarus malware in Operation FlashHole uses ML-KEM-1024 post-quantum encryption against South Korean firms

Kaspersky researchers say the North Korea-linked Lazarus group has been using ML-KEM-1024, one of the post-quantum key-exchange algorithms standardised by NIST, inside a malware toolchain aimed at South Korean companies. The report, published on 21 October 2026 and covered by BleepingComputer the same day, names the operation FlashHole. The cryptography is the headline, but the more useful lessons for defenders are in how the infection starts: spear-phishing, fake résumé pages on GitHub Pages, and abuse of a security program that many South Korean users are required to install.

Key points

• Kaspersky named the campaign Operation FlashHole, attributed it to Lazarus, and links it to the earlier Operation SyncHole and the broader Cascade Hole activity with medium-to-high confidence.
• Its earliest evidence dates to July 2025, the campaign was first noticed in January, and at least three South Korean organizations in software, construction and wired communication equipment manufacturing were hit; Kaspersky expects many more.
• The malware chain ends in a modular backdoor called Cubridge; its component LPEClient uses ML-KEM-1024 public keys supplied by the command server as part of encrypting traffic.
• Kaspersky says the post-quantum cryptography shows the group "intends to hide subsequent payloads", so the purpose is concealment of later stages, not protection against future quantum computers.
• Kaspersky lists 7 file hashes, 16 file paths and 8 command-and-control entries as indicators.

What happened

According to Kaspersky's Securelist report, the operation starts with spear-phishing emails that point to fabricated résumé and portfolio sites hosted on GitHub Pages. Those pages load JavaScript from external domains. Visiting the site likely starts an infection chain built on INISAFE CrossWeb EX, a security product popular in South Korea; Kaspersky notes that the page it analysed did not make clear exactly what triggered the chain, so "likely" is the researchers' own caution.

From there the reported chain runs as follows. A legitimate Windows binary, fsquirt.exe, is started under CrossWeb EX and injected with shellcode that installs TechHub, a downloader that pulls further malware from private GitHub repositories. TechHub leads to TouchHub, which installs a service, and to TouchShift, which side-loads a DLL disguised as mscoree.dll. TechHub also deploys ClientHub and LPEClient, which in turn lead to Cubridge, which Kaspersky calls the orchestrator. TouchHub and ClientHub are new in this report; TechHub, Cubridge, TouchShift and LPEClient were known from earlier work.

What each piece does, according to Kaspersky and BleepingComputer:

• ClientHub is a loader that supports communication over Dropbox (in one sample) and exchanges data directly with LPEClient. Kaspersky assesses with medium-to-high confidence that ClientHub is an advanced version of CookiePlus, a previously known Lazarus tool.
• LPEClient profiles the victim, receives encrypted payloads through ClientHub, and evades security monitoring.
• Cubridge is a modular backdoor that handles file management, command execution, reconnaissance and screenshots, and loads more payloads; it is loaded reflectively into memory, which means it never exists as a normal file on disk.
• Further tools target Chromium-based browsers to steal credentials, cookies and browsing history.

For command and control, TechHub uses GitHub repositories, while Cubridge and ClientHub use compromised South Korean websites.

The post-quantum part

ML-KEM is the key-encapsulation mechanism standardised as FIPS 203, published by NIST on 13 August 2024. Two parties use it to agree a shared secret key over a public channel, and its security rests on the Module Learning with Errors problem, which is believed to resist quantum attackers. It comes in three parameter sets, ML-KEM-512, ML-KEM-768 and ML-KEM-1024, in order of increasing strength and decreasing performance.

In FlashHole, the command server sends LPEClient four blocks of 1,568 bytes, each holding an ML-KEM-1024 public key. LPEClient generates four shared-secret and ciphertext pairs, encrypts the ciphertexts with the GOST cipher and sends them back through ClientHub. The shared secrets then supply key material for Threefish, which decrypts the server's reply containing parameters and an executable payload. That payload is Cubridge.

Why would a state-linked group bother? Kaspersky's own conclusion is that it is about hiding later payloads. That is our reading of the quote: encrypted payload delivery makes it harder for defenders to inspect later stages. There is no sign in the reports that quantum computers are involved; the attackers are using the new standard as a convenient, strong building block.

A caution on the details: Kaspersky's page describes the Threefish key as 256 bytes built from the four shared keys. Four ML-KEM shared secrets of the standard size would not obviously add up to that, so we do not repeat that figure as established and we recommend reading the original report for the exact construction.

Background

FlashHole is the latest part of a long-running Lazarus effort against South Korea that has repeatedly leaned on the same local software. In April 2025, Kaspersky described Operation SyncHole, which combined watering-hole attacks with exploitation of South Korean software, including a Cross EX version and a one-day vulnerability in Innorix Agent used for lateral movement. Press coverage at the time (The Hacker News, CyberInsider) reported at least six South Korean organizations compromised between November 2024 and February 2025, across software, IT, finance, semiconductor manufacturing and telecommunications. One Japanese outlet gave a different start year, so we use the Kaspersky-sourced dates reported by the English-language outlets.

According to the new report, FlashHole's earliest evidence dates to July 2025, shortly after SyncHole ended, which supports Kaspersky's medium-to-high-confidence view that the same actor ran both. The researchers also see links to Dream Job activity, the long-running Lazarus approach of fake job offers and recruitment lures. The résumé and portfolio sites in this campaign are the mirror image of that: instead of a fake job for the victim, a fake candidate for the recruiter.

The report also notes that South Korea plans to phase out mandatory security software starting in 2026. The country's reliance on locally mandated tools such as CrossWeb EX has long made them a prized target, since they run on many machines, with high privileges, in organizations that must use them.

How to defend against this

Kaspersky's page has no dedicated mitigation section, so the following is our reading of what the chain implies, not Kaspersky's advice:

1. Treat résumé and portfolio links as untrusted. HR and recruiting staff are natural targets, as are developers who review candidates' GitHub pages. Open them in an isolated browser profile or a disposable VM.
2. Hunt for odd parent-child process relationships. The chain depends on fsquirt.exe, normally the Windows Bluetooth file transfer tool, running under another security tool's process. That pairing is unusual and a good detection candidate.
3. Watch for DLL side-loading of mscoree.dll from unexpected folders, and for services installed shortly after a browser session.
4. Block or alert on traffic to GitHub repositories and Dropbox from processes that are not browsers or sync clients. Legitimate services are being used as command channels, so domain reputation alone will not help.
5. Check the indicators in the Securelist report against your logs: 7 file hashes (six for TouchShift, one for the ClientHub loader), 16 listed file paths (14 unique) and 8 command-and-control entries.
6. Rotate browser-stored credentials on any machine where Cubridge or the browser stealers are found; session cookies in particular can bypass multi-factor authentication.

What it means

For defenders, the encryption layer reduces what network captures and sandboxes can reveal about later stages, so detection has to move to the endpoint: process behaviour, memory scanning and the initial lure. It is also another reminder that "post-quantum" is not only a defensive term. A published, standardised algorithm is available to anyone, attackers included.

For developers and security teams outside Korea, the technique matters more than the target list. Fake candidate pages hosted on a trusted platform, malicious scripts loaded from third-party domains, and legitimate system binaries used as launchers all work against any organization that opens links from strangers. Hosting on GitHub Pages and private GitHub repositories lets attackers borrow the platform's reputation.

For the post-quantum transition, the lesson is a modest one: the standard is working as designed, and its first headline use in the wild is by an attacker who wants confidentiality for its own traffic. That does not weaken the case for adopting ML-KEM; it just means the algorithm is a tool and says nothing about who is using it.

What we don't know yet

• The full set of victims. Kaspersky has identified at least three organizations and expects many more.
• What exactly triggers the chain when a victim visits the malicious page; the report is cautious on that.
• Whether the same construction appears in other Lazarus toolsets. Kaspersky links FlashHole to Cascade Hole and SyncHole, but we have not seen another vendor's independent confirmation yet.
• The full cryptographic construction, including the Threefish key size noted above.

What to watch next

Other vendors may confirm or extend the findings. Watch for Kaspersky and other threat-intelligence teams to publish detections for the named malware, and for further reports of attackers using ML-KEM or other NIST post-quantum algorithms in malware command channels. Organizations in South Korea that use CrossWeb EX should check their logs against the indicators and consult the Securelist report directly.

Sources

• Kaspersky Securelist: Operation FlashHole (primary)
• BleepingComputer: Lazarus hackers use post-quantum cryptography for malware delivery
• NIST: FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard
• The Hacker News: Lazarus hits six South Korean firms (Operation SyncHole)
• CyberInsider: Lazarus group breached semiconductor and software firms in South Korea