Lazarus Hackers Use Post-Quantum Encryption to Deliver Malware in South Korea

North Korean hackers linked to the Lazarus Group are using post-quantum cryptography to protect malware delivery in a campaign targeting organizations in South Korea.

Cybersecurity researchers at Kaspersky Lab dubbed the operation Flash Hole and described its infection chain as “fairly complex.” The campaign combines previously known Lazarus malware with newer tools and uses standardized ML-KEM post-quantum encryption to communicate with command-and-control (C2) servers.

Researchers said the campaign began in July 2025 and initially relied on a phishing page that redirected targets to a specially crafted GitHub page.

Flash Hole attack chain targets South Korean organizations

At least three organizations in South Korea’s software, construction, and wired communications equipment manufacturing sectors were affected. Kaspersky suspects that additional organizations may also have been targeted.

The phishing pages load JavaScript from an external domain and initiate an in-memory execution chain involving INISAFE CrossWeb EX, a widely used security tool in South Korea.

A security tool process launched the legitimate Windows binary fsquirt.exe, which was used to execute shellcode and install TechHub. The downloader then retrieved additional malware from private GitHub repositories.

Kaspersky identified another new tool called ClientHub. The loader supports communication through Dropbox and direct data exchange with LPEClient.

LPEClient, a malware family previously associated with Lazarus, profiles victims and receives encrypted payloads through ClientHub while attempting to evade security monitoring.

The attack also deployed Cubridge, a modular backdoor with capabilities for file management, command execution, reconnaissance, screenshot capture, and loading additional payloads onto infected systems.

Kaspersky identified other tools designed to target Chromium-based browsers and steal account credentials, cookies, and browsing history.

Most of the Lazarus malware code executes in memory, although some files remain on the victim’s disk because of a persistence mechanism.

How Lazarus uses ML-KEM post-quantum encryption

Post-quantum cryptography is a prominent part of the Flash Hole operation. ML-KEM is a NIST-approved standard used in software projects to protect data against “hack later, decrypt later” attacks.

According to Kaspersky’s technical analysis, LPEClient received a byte array containing four 1,568-byte blocks from the C2 server. Each block contained an ML-KEM-1024 public key.

“LPEClient generates four different pairs of shared keys and ciphertext from these blocks, encrypts the ciphertext with the GOST algorithm, and sends it to the C2 server via ClientHub,” Kaspersky explained.

The resulting shared secret provides key material for Threefish, another cryptographic algorithm used to decrypt the server’s response, including parameters and an executable payload.

The final payload is Cubridge, which LPEClient loads directly into the host’s memory.

Kaspersky believes Lazarus uses post-quantum encryption together with in-memory execution chains to reduce the risk of detection.

“The use of post-quantum cryptography indicates that the group intends to hide subsequent payloads,” the researchers said.

Kaspersky places Flash Hole within a broader activity cluster known as Cascading Hole and links it with a moderate to high degree of confidence to the earlier SyncHole operation.

The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.

Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report