Lazarus Uses Post-Quantum Cryptography to Deliver Malware in FlashHole Campaign
Summary
Kaspersky says Lazarus’s FlashHole campaign targeted South Korean organizations using a malware chain that included LPEClient and ML-KEM-1024 to secure payload delivery; researchers identified at least three affected companies.
Key points
- Kaspersky attributes FlashHole to Lazarus and links it to Cascade Hole activity and, with medium-to-high confidence, the earlier Operation SyncHole.
- Attacks reportedly began in July 2025, using phishing pages that directed targets to crafted GitHub pages.
- The infection chain used INISAFE CrossWeb EX and Windows fsquirt.exe to run shellcode that installed TechHub, a downloader retrieving malware from private GitHub repositories.
- LPEClient used ML-KEM-1024 key material with GOST and Threefish encryption to decrypt C2-delivered payloads; ClientHub supported Dropbox communications and direct exchange with LPEClient.
- The final payload, Cubridge, is a modular backdoor with file management, command execution, reconnaissance, screenshot capture, and additional-payload loading capabilities.
- Researchers identified at least three South Korean companies in software, construction, and wired communications equipment manufacturing, and suspect more organizations were affected.
Article Details
- Attack Vectors
- Phishing pages directed targets to specially crafted GitHub pages.
- The pages loaded JavaScript from external domains, triggering an in-memory execution chain involving INISAFE CrossWeb EX.
- A process associated with INISAFE CrossWeb EX executed the legitimate Windows binary fsquirt.exe to run shellcode and install the TechHub downloader.
- TechHub retrieved additional malware from private GitHub repositories.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationLPEClient used ML-KEM-derived shared secrets and encryption algorithms to protect payloads and C2 responses.T1055 · Process InjectionLPEClient reflectively loaded the final Cubridge payload into host memory.T1057 · Process DiscoveryLPEClient profiles victims.T1059.001 · PowerShellThe security tool's process used the legitimate Windows binary fsquirt.exe to run shellcode.T1059.007 · JavaScriptJavaScript loaded from external domains on the crafted pages triggered the in-memory execution chain.T1083 · File and Directory DiscoveryCubridge provides file-management capabilities.T1115 · Clipboard DataCubridge supports capturing screenshots on infected systems.T1217 · Browser Information DiscoveryAdditional tools targeted Chromium-based browsers to collect browsing history.T1555.003 · Credentials from Web BrowsersAdditional tools targeted Chromium-based browsers for account credentials and cookies.T1566.002 · Spearphishing LinkThe operation used phishing pages to direct South Korean targets to specially crafted GitHub pages.
People
Threat Actors
Malware
ClientHubAnother new tool seen in these attacks is ClientHub, a loader that supports Dropbox communications as well as direct data exchange with LPEClient.CubridgeAnother malware observed in the attacks is Cubridge, a modular backdoor that provides file management, command execution, and reconnaissance capabilities, and also supports screenshot capturing and loading additionalLPEClientKaspersky says the attackers used LPEClient malware, previously associated with Lazarus, to receive ML-KEM-1024 public keys from its C2 infrastructure and generate shared keys that allowed it to decrypt subsequentlyTechHubexecuted the legitimate Windows binary fsquirt.exe, which was used to run shellcode that installed TechHub, a downloader responsible for retrieving additional malware from private GitHub repositories.
Vendors
Products
ChromiumKaspersky has also seen additional tools targeting Chromium-based browsers for account credentials, cookies, and browsing history.Dropbox DocSendAnother new tool seen in these attacks is ClientHub, a loader that supports Dropbox communications as well as direct data exchange with LPEClient.INISAFE CrossWeb EXThese pages load JavaScript code from external domains, triggering an in-memory execution chain that involved INISAFE CrossWeb EX, a security tool popular in South Korea.Microsoft WindowsThe security tool’s process executed the legitimate Windows binary fsquirt.exe, which was used to run shellcode that installed TechHub, a downloader responsible for retrieving additional malware from private GitHub
Countries
Industries
ConstructionKaspersky identified at least three companies in South Korea, in the software, construction, and wired communication equipment manufacturing sectors, but suspects that many more organizations were affected.SoftwareKaspersky identified at least three companies in South Korea, in the software, construction, and wired communication equipment manufacturing sectors, but suspects that many more organizations were affected.wired communication equipment manufacturingKaspersky identified at least three companies in South Korea, in the software, construction, and wired communication equipment manufacturing sectors, but suspects that many more organizations were affected.