Kaspersky ties Lazarus Group to South Korean campaign using post-quantum encryption

Kaspersky attributes Operation FlashHole, a cyber espionage campaign, to the North Korea-linked Lazarus Group, which hit at least three South Korean organizations. It dates FlashHole to at least July 2025 and says it continues Operation SyncHole. Kaspersky places FlashHole within the broader Cascade Hole activity and links it to Operation SyncHole with medium-to-high confidence.

The campaign abuses Initech’s INISAFE CrossWeb EX, mandatory financial security software for South Korean online banking and government portals. The precise initial-access vector is unclear, but indicators point to malicious GitHub Pages sites and suspected spear-phishing e-mails linking to them. Visiting a malicious GitHub Pages site triggers an in-memory chain where CrossWeb EX launches fsquirt.exe, which runs shellcode to install TechHub through DLL sideloading.

The latest malware version uses ML-KEM-1024, a post-quantum cryptographic algorithm, to open an encrypted channel with the attackers’ server. That connection downloads and runs additional malware directly in memory. Kaspersky says the post-quantum cryptography shows Lazarus intends to hide subsequent payloads, and that combining it with in-memory execution minimizes detection risk.

The targeted organizations work in construction, software, and wired communication equipment manufacturing. LPEClient receives from the C2 four 1,568-byte blocks, each holding an ML-KEM-1024 public key, then derives four shared-key and ciphertext pairs. LPEClient encrypts the ciphertexts with GOST and sends them to the server via ClientHub. The shared secrets key Threefish to decrypt the server response holding configuration data and an executable payload.

LPEClient profiles victims and then receives encrypted payloads through ClientHub while evading security monitoring. ML-KEM is a NIST-approved post-quantum standard used in multiple software projects to protect against harvest-now-decrypt-later attacks. Kaspersky observed tools that steal credentials, cookies, and browsing history from Chromium-based browsers. Kaspersky says most Lazarus code runs in memory, though some files remain on the victim’s disk because of persistence mechanisms.

Kaspersky researcher Sojun Ryu says findings trace Lazarus’s use of quantum-resistant cryptography to at least September 2024, more than a year before disclosure. Ryu says Lazarus keeps expanding operations, launching new campaigns, introducing new tools, and reworking familiar tools to meet its needs. “What deserves closer attention is Lazarus’s adoption of cryptography designed to withstand future quantum threats,” Ryu said.

SyncHole delivered ThreatNeedle, AGAMEMNON, wAgent, SIGNBT, and COPPERHEDGE. Between 2022 and 2023, AhnLab disclosed Lazarus attacks that exploited a software flaw to distribute SCSKAppLink.dll through watering holes from compromised IIS servers. AhnLab’s July 2023 report said Lazarus hacks Korean websites and modifies their content, and vulnerable INISAFE CrossWeb EX V6 systems visiting such a site install SCSKAppLink.dll through the INISAFECrossWebEXSvc.exe vulnerability.

SyncHole exploited a security flaw in iniLINE Cross EX to deliver malware. Cross EX is mandatory financial security software that South Korean users install for online banking and government services across browsers. The SyncHole exploit launched legitimate SyncHost.exe and injected shellcode to load ThreatNeedle. SyncHole used a one-day Innorix Agent vulnerability, version 9.2.18.496, to enable lateral movement.

TechHub is an advanced CLOUDBURST and NickelLoader downloader that contacts GitHub for TouchHub and ClientHub and for device and running-process data. TouchHub uses DLL sideloading to launch rogue DLL TOUCHSHIFT, also known as mscoree.dll, which persists by running another TechHub instance in memory. A second TechHub instance then downloads and loads LPEClient into memory; LPEClient acts as a conduit for Cubridge.

Cubridge, an improved SIDESHOW and LightlessCan backdoor that Kaspersky also assesses as an advanced CookiePlus version, contacts a command-and-control server for plugins and modules. Cubridge gathers system information, runs commands, and steals files and web browser data.

ClientHub is an undocumented backdoor in two versions: one contacts an attacker-controlled server using HTTPS, and the other uses the Dropbox API. ClientHub plugins create ZIP archives and collect files matching a search pattern. The plugins also delete specific files, monitor local drive changes, and return collected status information.

LPEClient is a longstanding victim-profiling and payload-delivery tool used since 2019. In August 2026, Check Point tied LPEClient deployment to zero-day CVE-2026-68820. Check Point described CVE-2026-68820 as a privilege-escalation flaw in the Windows Ancillary Function Driver for WinSock used to deploy the FudModule rootkit. LPEClient reflectively loads the final payload, Cubridge, into the host’s memory.

A joint July 2026 advisory from KISA and domestic cybersecurity vendors highlighted Lazarus exploitation of financial-security-program vulnerabilities such as AnySign4PC. The advisory tied Lazarus to backdoors Struggle, also called SIGNBT 3.0, and Brandoor, also called COPPERHEDGE.

AhnLab said attackers lured victims to malicious URLs through spear-phishing and watering-hole attacks to install backdoor malware, calling the activity Operation Double Barrel. FlashHole coincided with new South Korean attacks using the COPPERHEDGE backdoor. At least one COPPERHEDGE infection exfiltrated data to dark-web leak site ULOSE, resembling Gunra ransomware attacks on South Korean targets.

Researchers advise organizations to bolster phishing defenses, watch for suspicious application behavior, and investigate unusual activity tied to trusted software and online services. “The use of post-quantum cryptography shows that the group intends to hide subsequent payloads,” Kaspersky said.