FlashHole: Lazarus uses post-quantum ML-KEM for malware

Kaspersky researchers have described FlashHole, an espionage campaign they attribute to the North Korean Lazarus group. What is new is the cryptography: an updated version of the LPEClient malware uses ML-KEM-1024, the post-quantum key encapsulation mechanism standardised by NIST, to agree with the command-and-control (C2) server on the keys that protect later payloads. According to Agenda Digitale, the findings were presented by Kaspersky’s GReAT team at the Security Analyst Summit in Bali.

What happened

According to Kaspersky, as reported by BleepingComputer and Cybersecurity360, the campaign has been active since at least July 2025 and has hit at least three organisations in South Korea, in software, construction and wired communication equipment manufacturing; the researchers believe there are more victims. Kaspersky places FlashHole within the broader Cascade Hole activity and links it with medium-to-high confidence to the earlier Operation SyncHole; Cybersecurity360 also mentions techniques already seen in Operation DreamJob.

The lures are targeted phishing emails and fraudulent websites with CVs and portfolios. According to Cybersecurity360 and Agenda Digitale, profile photos and sites were generated or tailored to each target with artificial intelligence.

The infection chain

According to the reconstruction reported by BleepingComputer:

1. the phishing pages lead to specially crafted GitHub pages, which load JavaScript from external domains;
2. the code triggers an in-memory chain involving INISAFE CrossWeb EX, a web security and authentication component widely used in South Korea. The sources do not give a CVE: Cybersecurity360 speaks of a “potential exploit path”, Agenda Digitale of a flaw in software that runs with elevated privileges;
3. the CrossWeb EX process launches the legitimate Windows binary fsquirt.exe (the Bluetooth file transfer wizard), used to run shellcode;
4. the shellcode installs a downloader that fetches more malware from private GitHub repositories: BleepingComputer calls it TechHub, Cybersecurity360 TouchHub;
5. the new ClientHub loader communicates via Dropbox and exchanges data directly with LPEClient;
6. LPEClient profiles the victim, receives encrypted payloads through ClientHub and evades security monitoring;
7. the final payload is Cubridge, a modular backdoor (file management, commands, reconnaissance, screenshots, extra modules), reflectively loaded into memory by LPEClient.

Kaspersky also saw tools that steal credentials, cookies and browsing history from Chromium-based browsers. According to BleepingComputer most of the code stays in memory, but persistence leaves some files on disk; Agenda Digitale instead describes an LPEClient that writes almost nothing to disk and tampers with memory permissions to blind EDR tools.

How the ML-KEM exchange works

From the C2, LPEClient receives four 1,568-byte blocks, each an ML-KEM-1024 public key. For each key it generates a shared secret and the matching ciphertext; the four ciphertexts are in turn encrypted with the GOST algorithm and sent to the C2 through ClientHub. The shared secrets supply the key material for Threefish, which LPEClient uses to decrypt the response: parameters and an executable payload. According to Kaspersky the aim is to hide the payloads and keep the risk of detection to a minimum.

The practical consequence for defenders: recorded network traffic is not enough to rebuild the payloads without the C2’s private keys or the secrets held in the infected machine’s memory. Agenda Digitale stresses the effect on forensics, since it becomes hard to establish afterwards what went over the channel. Analysis shifts to the endpoint and its memory.

MITRE ATT&CK techniques

Techniques matching the behaviour described:

• T1566.002 Spearphishing Link and T1203 Exploitation for Client Execution (CrossWeb EX, if confirmed);
• T1055 Process Injection (fsquirt.exe) and T1620 Reflective Code Loading (Cubridge);
• T1102 Web Service (GitHub, Dropbox) and T1573.002 Asymmetric Cryptography;
• T1555.003 Credentials from Web Browsers, T1539 Steal Web Session Cookie, T1113 Screen Capture.

The articles do not list indicators of compromise: take them from Kaspersky’s technical material.

Impact for European and Italian companies

CrossWeb EX belongs to the South Korean banking and government ecosystem: direct exposure mainly concerns organisations with offices, subsidiaries or suppliers in South Korea. The rest of the chain is not specific: fake professional profiles, abuse of GitHub and Dropbox, in-memory execution. Agenda Digitale recalls that North Korean espionage has already hit defence and aerospace contractors in several European countries and points to second- and third-tier subcontractors in strategic supply chains as the weak link: for NIS2 entities this is a supply chain security issue.

What to do now

1. Train the people who receive applications and proposals: job offers, CVs and portfolios are the lure; verify identities through an independent channel.
2. Inventory the components required by banking or government sites and any software running with elevated privileges: update them and remove those you do not need.
3. Limit user privileges, as the researchers recommend.
4. Watch cloud services used as C2: access to private GitHub repositories and to the Dropbox API from processes that should not do it.
5. Hunt for process anomalies: fsquirt.exe started by an unusual parent or opening network connections, code loaded only in memory.
6. Protect browser credentials: restrict password saving in Chromium browsers through enterprise policies and, after a compromise, revoke sessions and cookies as well as changing passwords.
7. In an incident, capture memory before shutting down or reinstalling the machine: with in-memory payloads and traffic that cannot be rebuilt, it is often the main evidence.

How ARXDOME helps

ARX Horizon lets you query threat intelligence sources for indicators of compromise; ARX Trace runs collections and searches across multiple machines and shows events with MITRE ATT&CK mapping; ARX Sentry collects logs and events from computers and servers; ARX Shield isolates a suspicious machine from the network pending analysis.

Last updated: 23 October 2026