Lazarus Uses Post-Quantum Cryptography to Deliver Malware

Researchers at cybersecurity company Kaspersky say the Lazarus Group used post-quantum cryptography to protect malware delivery in an operation targeting South Korean organizations. Kaspersky named the campaign FlashHole and described its infection chain as “rather complex.”

According to the researchers, attacks began in July 2025 and used phishing pages that sent targets to specially crafted GitHub pages. JavaScript loaded from external domains triggered an in-memory execution chain involving INISAFE CrossWeb EX, a security tool popular in South Korea. Its process ran the legitimate Windows binary fsquirt.exe to execute shellcode, which installed TechHub, a downloader that retrieved more malware from private GitHub repositories.

Kaspersky identified at least three affected South Korean companies in software, construction, and wired communication equipment manufacturing, and suspects more organizations were affected. The researchers observed ClientHub, a loader that supports Dropbox communications and direct data exchange with LPEClient. LPEClient profiles victims, receives encrypted payloads through ClientHub, and evades security monitoring. Another tool, Cubridge, is a modular backdoor with file management, command execution, reconnaissance, screenshot capture, and additional payload-loading capabilities.

Kaspersky says LPEClient used the standardized ML-KEM mechanism to receive ML-KEM-1024 public keys from command-and-control infrastructure and generate shared keys for decrypting incoming payloads. It sent encrypted ciphertexts to the server through ClientHub; shared secrets supplied key material for Threefish to decrypt a response containing parameters and an executable payload. The final Cubridge payload was reflectively loaded into memory. Kaspersky links FlashHole to broader Cascade Hole activity and, with medium-to-high confidence, to the earlier Operation SyncHole.