Asl matn EN tilida, manba saytidan olindi. Manba ↗

North Korea-linked Lazarus Group used post-quantum cryptography in a cyberespionage campaign targeting South Korean organizations, concealing malware communications and payloads behind a multi-stage infection chain.

Dubbed Operation FlashHole, the campaign combined spear-phishing, malicious websites, abuse of financial security software and modular malware that largely operated in memory.

The campaign followed Operation SyncHole, a Lazarus operation that targeted South Korean entities using watering-hole attacks and abused local software. The shift in victim industries suggests the group broadened its targeting.

Operation SyncHole previously affected at least six organizations across software, IT, finance, semiconductor manufacturing and telecommunications.

The initial infection chain centered on INISAFE CrossWeb EX, a financial security application used to support access to online banking and government services.

Unlike SyncHole, which abused the related Cross EX product, FlashHole leveraged CrossWeb EX.

Operation FlashHole attack flow during initial compromise (Source : Kaspersky).

The exact exploitation method remains unclear, but researchers observed a high-integrity process chain that ultimately executed malicious code in memory.

Lazarus likely directed selected victims to tailored websites through spear-phishing emails.

The lures included a résumé page and an interior-design portfolio hosted on GitHub Pages, each seemingly customized for its intended target.

One résumé image appeared AI-generated, while the portfolio’s details looked artificial. These clues suggest AI may have helped produce or embellish the lures, but researchers did not establish precisely how the content was created.

After initial compromise, the legitimate Windows program fsquirt.exe was launched under the CrossWeb EX process and injected with shellcode carrying TechHub malware.

Kaspersky Researchers traced, the earliest evidence to July 2025 and identified at least three affected organizations in South Korea’s software, construction and wired-communications equipment sectors.

The chain then deployed TouchHub and TouchShift for persistence, followed by ClientHub and LPEClient.

These components helped load Cubridge, a central framework for receiving commands and deploying plugins, tools and modules. Much of the execution took place in memory, reducing the files available for on-disk detection.

The campaign’s most notable cryptographic development appeared in an updated LPEClient variant. After profiling a system, LPEClient obtained four 1,568-byte blocks containing ML-KEM-1024 public keys.

The job seeker’s name resembles the Korean version of “John Doe,” and the portfolio was populated with seemingly meaningless details and random companies.

ML-KEM is the NIST-standardized key-encapsulation mechanism derived from CRYSTALS-Kyber. The malware generated key material from those public keys and sent encrypted ciphertexts to its command-and-control infrastructure.

Suspected use of an AI-generated image on the résumé site (Source : Kaspersky).

It then used the resulting shared keys with the Threefish cipher to decrypt a later response containing a payload, which was reflectively loaded into memory.

This is not simply a claim that attackers have built encryption proof against future quantum computers.

The reported technique uses post-quantum key establishment as one layer in a broader, custom protocol; it does not by itself make malware invisible or prove that every stage uses quantum-resistant cryptography.

Cubridge employs a more robust handshaking process than TechHub, combining the RSA and RC6 algorithms.

Cubridge’s communication sequence (Source : Kaspersky).

Its significance is operational: it adds complexity to the exchange used to protect subsequent payload delivery and complicates analysis of the malware’s command channel.

The broader campaign reflects Lazarus’s established focus on South Korea’s software ecosystem.

Security applications installed to support financial services can become high-value attack surfaces when vulnerabilities or unsafe interactions are abused.

A 2025 USENIX study of South Korea’s mandatory financial-security software documented security weaknesses and reported 19 vulnerabilities, which researchers said had been disclosed and patched.

The USENIX study gives context for why these widely deployed programs warrant careful security review.

Operation FlashHole also illustrates Lazarus’s continuing shift toward modular tooling. TechHub handled early-stage delivery and profiling, while ClientHub and Cubridge enabled flexible payload management and task execution.

LPEClient, seen in both FlashHole and SyncHole, remained a key component for reconnaissance and payload delivery.

For defenders, the case underscores the value of monitoring unusual activity originating from trusted security software, investigating suspicious in-memory execution, and keeping locally required security applications patched.

Indicators of compromise

File hashFile name
ec84d6cb2ae7974767aedac246b50a3emscoree.dll
a28cba214058fcae2883d8cffc883abdmscoree.dll
c105d6b16f544582772de0159f24c00amscoree.dll
2f8475a90a25624ed02f1d18d4e6d65dmscoree.dll
676fabe30a28b53925fba98e34b35986mscoree.dll

Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.