Habla con un experto
PreciosNoticiasHabla con un experto
Volver a la sala de prensa
Amenazas

Lazarus Hides Malware Behind Post-Quantum Encryption in Operation FlashHole

A North Korea-linked campaign against South Korean firms uses ML-KEM-1024 key exchange, trusted software and in-memory execution to keep its payloads away from security tools.

4T4Tify Team4Tify
Oct 22, 2026·5 min de lectura
Lazarus Hides Malware Behind Post-Quantum Encryption in Operation FlashHole

Lazarus Wraps Malware Payloads in Post-Quantum Crypto: Inside Operation FlashHole

A North Korea-linked intrusion set is now protecting its malware with ML-KEM-1024, the post-quantum key-encapsulation algorithm NIST standardized in FIPS 203. Kaspersky researchers attribute the activity to the Lazarus group and call it Operation FlashHole. The goal isn't to beat quantum computers. It's to keep later-stage payloads out of sight of the security tools watching the endpoint.

What happened

Kaspersky reports at least three organizations in South Korea were affected, in the software, construction and wired-communications equipment sectors. The earliest evidence of the campaign dates to July 2025.

The likely entry point is targeted phishing. Victims were steered to purpose-built lure sites, including a fake résumé portfolio and an interior-design page. Researchers found malicious links embedded in those sites and believe visiting them may have started the infection. They could not confirm every step of the initial compromise, so the exact role of each lure is still an assessment and not a proven sequence.

After initial access, the chain ran malicious code under the process of CrossWeb EX, a financial security program used to access some South Korean banking and government sites. It also leaned on legitimate Windows software and in-memory execution to leave as few traces on disk as possible. How the software was abused is still unconfirmed.

The toolset is modular. It includes TechHub, TouchHub, TouchShift, ClientHub, LPEClient and Cubridge:

  • TechHub delivers later components.
  • Cubridge acts as a central operator, loading modules and plugins on demand instead of shipping one large backdoor.
  • Other components handle persistence, system profiling, file search and theft of browser data (saved passwords, cookies, bookmarks and history).
  • Command-and-control traffic was spread across legitimate platforms such as GitHub and Dropbox, plus compromised websites.

The post-quantum twist

The notable change is in LPEClient, a long-running Lazarus profiler and downloader:

  1. It pulls four ML-KEM-1024 public-key blocks from its C2 server.
  2. It uses them to establish shared keys and sends the matching ciphertexts back through ClientHub.
  3. The derived keys, combined with Threefish, decrypt the next payload, which is loaded straight into memory after steps meant to interfere with security monitoring.

This does not mean the attackers have a quantum computer. ML-KEM is designed to resist future quantum attacks. Here it simply gives the operators a strong, modern way to protect payloads in transit, which makes network inspection and payload recovery harder for defenders. The cryptography isn't the threat. The threat is how it's combined with stealthy delivery, trusted software and memory-only execution.

Kaspersky assesses with medium-to-high confidence that FlashHole is connected to the earlier Operation SyncHole campaign, based on overlaps in targeting and malware.

Why it matters

  • Signature-based detection falls short. Payloads that are encrypted in transit and decrypted only in memory leave few files for scanners to inspect.
  • Trusted software is the cover. Malicious code running under a legitimate financial-security process blends into normal activity.
  • Legitimate cloud services hide C2. Traffic to GitHub or Dropbox rarely raises alarms by default.
  • Supply-chain-style risk. Lazarus has a history of abusing South Korean security software and vendor ecosystems, so the impact can reach well beyond the first victim.

What to do

  • Inventory and patch security plugins such as CrossWeb EX and similar banking or government-access software. Remove them where they aren't needed, and keep the rest current.
  • Hunt for odd process behaviour. Look for unexpected child processes, DLL side-loading (for example, unusual mscoree.dll copies under C:\ProgramData\ subfolders) and in-memory activity originating from trusted applications.
  • Baseline cloud-service usage. Flag GitHub, Dropbox or other cloud API traffic from hosts that have no business reason to use them, and correlate it with endpoint alerts.
  • Harden against targeted phishing. Pay particular attention to recruitment-themed lures (résumés, portfolios) and links to freshly created sites.
  • Lean on behavioural EDR and memory scanning rather than file hashes alone.
  • Load the published IoCs (file hashes, C2 URLs, file paths and domains such as javadevhouse[.]co[.]kr and pythonapischool[.]com) into your SIEM or threat-intel platform, and keep them defanged outside those tools.

Campaigns like this succeed when outdated or forgotten software sits on endpoints that nobody is tracking. Our team's vulnerability scanning service helps find exposed and unpatched third-party components across your estate, so a trusted plugin doesn't become the attacker's way in.

Sources: original research by Kaspersky Securelist; news coverage by Cyber Security News. This article is 4Tify's own summary and analysis.

COMPARTIR