Lazarus uses post-quantum ML-KEM encryption to hide malware in South Korean attacks

North Korea's Lazarus Group is using post-quantum cryptography to conceal the delivery of malware in attacks on South Korean organizations, according to Kaspersky research reported by BleepingComputer on October 21, 2026. The campaign, which Kaspersky calls FlashHole, has been active since July 2025 and relies on ML-KEM, a NIST-approved post-quantum key encapsulation standard, to protect the exchange that delivers its backdoor.

What happened

According to BleepingComputer, Kaspersky identified at least three victims in the software, construction and wired communication equipment manufacturing sectors and suspects many more organizations were affected. The researchers place FlashHole within a broader cluster of activity they call Cascade Hole and link it with medium-to-high confidence to Operation SyncHole, an earlier Lazarus campaign that also targeted South Korea.

The infection chain begins with phishing pages that redirect victims to specially crafted GitHub pages. These load JavaScript from external domains, triggering an in-memory execution chain that involves INISAFE CrossWeb EX, a security product widely used in South Korea. That tool's process launches the legitimate Windows binary fsquirt.exe, which runs shellcode. Most of the chain executes in memory, although persistence mechanisms leave some files on disk, BleepingComputer reports.

Technical details

Kaspersky describes several components in the toolset:

• TechHub: a downloader that fetches additional malware from private GitHub repositories.
• ClientHub: a loader that supports Dropbox-based communications and exchanges data directly with LPEClient.
• LPEClient: malware previously associated with Lazarus that profiles victims, receives encrypted payloads and evades monitoring.
• Cubridge: a modular backdoor for file management, command execution, reconnaissance, screenshots and loading further payloads.
• Browser stealers: tools that collect credentials, cookies and browsing history from Chromium-based browsers.

The post-quantum element sits in LPEClient. According to BleepingComputer, it retrieves four ML-KEM-1024 public keys from the command-and-control server, generates four shared secrets and ciphertexts, encrypts the ciphertexts with the GOST algorithm and sends them back through ClientHub. The shared secrets then provide key material for the Threefish cipher, which decrypts the server's response containing configuration parameters and the Cubridge payload. LPEClient loads Cubridge reflectively into memory.

Kaspersky believes this approach, combined with in-memory execution, minimizes the risk of detection, and that the use of post-quantum cryptography shows the group's intent to keep later-stage payloads hidden from analysts who capture network traffic.

Who is affected

The campaign targets South Korean organizations, with confirmed victims in software, construction and communications equipment manufacturing. Organizations that use South Korean web security plugins such as INISAFE CrossWeb EX may be of particular interest to the group.

What to do

BleepingComputer's report does not include specific detection guidance from Kaspersky. Based on the described chain, defenders can monitor for unusual child processes or shellcode activity under security plugin processes and fsquirt.exe, scrutinize outbound connections to private GitHub repositories and Dropbox from endpoints that do not normally use them, and keep web security plugins updated. Because the encrypted delivery hides payloads on the wire, endpoint memory scanning and behavioral detection are more important than network inspection for this campaign.