North Korean Lazarus hackers use post-quantum cryptography in campaign against South Korean firms

Kaspersky uncovers 'FlashHole' operation combining old and new malware with quantum-resistant encryption

By LineZotpaper

Published21 October 2026

Read Time2 min

North Korea's Lazarus hacking group has been observed using a post-quantum cryptographic mechanism to secure malicious payload delivery in a campaign targeting South Korean companies, according to researchers at Kaspersky. Dubbed FlashHole, the operation uses a complex infection chain that combines both old and new malware, with the group employing the standardized ML-KEM post-quantum mechanism to communicate with command-and-control servers.

Kaspersky's analysis, published Tuesday, details an attack chain that began in July 2025 and relies on phishing pages directing targets to specially crafted GitHub pages. These pages load JavaScript code from external domains, triggering an in-memory execution chain involving a South Korean security tool called INISAFE CrossWeb EX. The process is then used to execute the legitimate Windows binary fsquirt.exe, which runs shellcode that installs TechHub, a downloader responsible for retrieving additional malware from private GitHub repositories.

The researchers identified at least three affected companies in the software, construction, and wired communication equipment manufacturing sectors, but suspect many more organizations were compromised.

Among the tools deployed in the operation are LPEClient, which uses the ML-KEM-1024 post-quantum cryptographic mechanism to establish shared keys with command-and-control servers; ClientHub, a loader that supports Dropbox communications and direct data exchange; and Cubridge, a modular backdoor providing file management, command execution, reconnaissance, and screenshot capabilities. Additional tools target Chromium-based browsers for account credentials, cookies, and browsing history.

Kaspersky believes the use of post-quantum cryptography is intended to minimize detection risks. 'The use of post-quantum cryptography shows that the group intends to hide subsequent payloads,' the researchers said.

The group has been linked with medium-to-high confidence to the broader Cascade Hole activity and the earlier Operation SyncHole.

Analysis

Why This Matters

This marks one of the first known uses of post-quantum cryptography by a major threat actor, signaling that adversaries are adopting quantum-resistant encryption to evade future decryption and current detection.
The targeting of South Korean organizations across multiple sectors highlights the persistent espionage threat from North Korea, which could extend to other regions.
The complex, multi-stage in-memory execution chain demonstrates evolving evasion techniques that could become standard among advanced persistent threat groups.

Background

North Korea's Lazarus Group has been active since at least 2009, conducting cyber-espionage and financially motivated operations, including the 2014 Sony Pictures hack, the 2017 WannaCry ransomware attack, and numerous cryptocurrency thefts. Post-quantum cryptography, such as the ML-KEM standard approved by the U.S. National Institute of Standards and Technology (NIST), is designed to resist attacks from future quantum computers. While the technology is meant to protect data from 'hack now, decrypt later' threats, Lazarus has co-opted it to secure its own command-and-control communications.

Key Perspectives

[Kaspersky]: The researchers assess that Lazarus is using ML-KEM to lower detection risk and hide payloads, placing FlashHole within the broader Cascade Hole activity with medium-to-high confidence. They note that most of the Lazarus code runs in memory, though persistence mechanisms leave some files on disk.

[Security industry]: The campaign underscores a trend of advanced persistent threat groups incorporating state-of-the-art cryptographic techniques, forcing defenders to develop new detection methods that go beyond signature-based tools.

[Skeptics]: Some analysts may question whether the use of ML-KEM truly represents a strategic shift or is simply an opportunistic adoption of available libraries. Additionally, the medium-to-high confidence attribution leaves room for doubt about whether the operation was carried out by Lazarus or another element of North Korea's cyber apparatus.

What to Watch

Whether other threat actors, particularly state-sponsored groups, begin adopting post-quantum cryptography in their toolkits.
Further disclosures from Kaspersky or other firms about additional victims of FlashHole, which the researchers suspect are numerous.
Potential changes in South Korea's cybersecurity posture in response to the campaign, and any public attribution by South Korean authorities.

Sources

Lazarus hackers use post-quantum cryptography for malware delivery · BleepingComputer

Checked

10 claims in this story checked against 1 source: 7 supported.

Show each claim

SupportedLazarus, described as North Korean hackers, used post-quantum cryptography for malware delivery in the FlashHole campaign targeting South Korean organizations.BleepingComputer: “North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware. The campaign targets South Korean organizations”
SupportedKaspersky dubbed the operation FlashHole, which combines old and new malware with quantum-resistant encryption.BleepingComputer: “Researchers at cybersecurity company Kaspersky dubbed the operation FlashHole”
SupportedThe researchers said, “The use of post-quantum cryptography shows that the group intends to hide subsequent payloads.”BleepingComputer: ““The use of post-quantum cryptography shows that the group intends to hide subsequent payloads,” Kaspersky says.”
Not in the sourcesKaspersky’s analysis was published Tuesday.
SupportedThe attack chain began in July 2025 and used phishing pages directing targets to specially crafted GitHub pages.BleepingComputer: “According to the researchers, the attacks started in July 2025 and relied on phishing pages directing targets to specially crafted GitHub pages.”
SupportedKaspersky identified at least three affected South Korean companies in the software, construction, and wired communication equipment manufacturing sectors.BleepingComputer: “Kaspersky identified at least three companies in South Korea, in the software, construction, and wired communication equipment manufacturing sectors”
Partly supportedKaspersky suspects many more organizations were compromised.BleepingComputer: “but suspects that many more organizations were affected.”
SupportedLPEClient uses ML-KEM-1024 to generate shared keys after receiving public keys from C2 infrastructure.BleepingComputer: “the attackers used LPEClient malware, previously associated with Lazarus , to receive ML-KEM-1024 public keys from its C2 infrastructure and generate shared keys”
Partly supportedClientHub supports Dropbox communications and direct data exchange.BleepingComputer: “Another new tool seen in these attacks is ClientHub, a loader that supports Dropbox communications as well as direct data exchange with LPEClient.”
SupportedKaspersky links FlashHole to broader Cascade Hole activity and the earlier Operation SyncHole with medium-to-high confidence.BleepingComputer: “Kaspersky researchers place FlashHole within the broader Cascade Hole activity and link it to the earlier Operation SyncHole with medium-to-high confidence.”