Cybersecurity researchers at **Kaspersky** have uncovered a new campaign, 'FlashHole', attributed to the notorious **Lazarus Group**. This operation stands out due to its integration of post-quantum cryptography, specifically the standardized **ML-KEM** mechanism, to secure communications for malware delivery. ### A Complex Infection Chain The attacks, which reportedly began in July 2025, leverage a multi-stage infection process targeting South Korean entities. The initial vector involves phishing pages that redirect victims to specially crafted **GitHub** pages. .jpg) *FlashHole attack chain Source: Kaspersky* These GitHub pages load JavaScript from external domains, initiating an in-memory execution chain. A key component of this chain exploits **INISAFE CrossWeb EX**, a security tool widely used in South Korea. The security tool's process is then hijacked to execute the legitimate Windows binary `fsquirt.exe`, which in turn runs shellcode. This shellcode installs **TechHub**, a downloader responsible for retrieving additional malware from private GitHub repositories.  *Infection chain overview Source: Kaspersky* Kaspersky has identified at least three affected organizations in South Korea across the software, construction, and wired communication equipment manufacturing sectors, with suspicions of a wider impact. ### Evolving Malware and Evasion Techniques The 'FlashHole' campaign utilizes a suite of malware, including the previously identified **LPEClient**. This malware is responsible for profiling victims, receiving encrypted payloads via **ClientHub** (a new loader supporting **Dropbox** communications), and actively evading security monitoring.  *LPEClient evolution Source: Kaspersky* Another significant component is **Cubridge**, a modular backdoor offering extensive capabilities such as file management, command execution, reconnaissance, screenshot capturing, and the ability to load further payloads. The attackers have also deployed additional tools specifically targeting **Chromium**-based browsers to exfiltrate credentials, cookies, and browsing history. Notably, much of the **Lazarus Group**'s code in this operation runs in memory, significantly reducing its footprint and enhancing stealth, although some persistence mechanisms do leave files on disk. .jpg) *Cubridge communications Source: Kaspersky* ### The Quantum Leap in Encryption The most striking aspect of 'FlashHole' is the adoption of the **ML-KEM** post-quantum cryptographic mechanism. **ML-KEM** is a **NIST**-approved standard designed to protect data against 'hack now, decrypt later' attacks, where encrypted data is harvested today in anticipation of future quantum computing capabilities that could break current encryption standards. Technical analysis reveals that **LPEClient** obtains multiple **ML-KEM-1024** public keys from its **C2** server. It then generates shared keys and ciphertexts, encrypts these with the **GOST** algorithm, and transmits them back to the **C2** via **ClientHub**. These shared secrets are then used as key material for **Threefish**, another encryption algorithm, to decrypt the final payload – **Cubridge** – which **LPEClient** reflectively loads into the host's memory. Kaspersky believes this sophisticated use of post-quantum cryptography, combined with an in-memory execution chain, aims to minimize detection risk. "The use of post-quantum cryptography shows that the group intends to hide subsequent payloads," Kaspersky stated. Researchers link 'FlashHole' to the broader **Cascade Hole** activity and, with medium-to-high confidence, to the earlier **Operation SyncHole**.