Lazarus group uses post-quantum encryption in South Korea malware campaign

Kaspersky says the FlashHole operation has hit at least three South Korean companies, and it is linked to earlier campaigns it has tracked.

Kaspersky has attributed a campaign it calls FlashHole to the Lazarus Group, which has targeted South Korean organizations since July 2025 using phishing pages that point victims to crafted GitHub pages. Those pages load JavaScript that starts an in-memory execution chain involving the South Korean security tool INISAFE CrossWeb EX and a legitimate Windows binary, which installs a downloader called TechHub. The most notable element is the use of the NIST-approved ML-KEM post-quantum mechanism, with the ML-KEM-1024 keys delivered from the command-and-control server to the LPEClient malware, which then decrypts follow-on payloads. Kaspersky confirmed at least three affected South Korean companies in software, construction and wired communication equipment manufacturing, and suspects more were hit. The final payload is Cubridge, a modular backdoor, and the researchers link FlashHole to the wider Cascade Hole activity and to the earlier Operation SyncHole.