Copyright protected content copied from PhoneWorld website.
North Korean hacking group Lazarus is using post-quantum cryptography to deliver malware in a new cyberattack campaign targeting South Korean organizations. The operation combines older malware tools with new techniques designed to make attacks harder to detect.
Cybersecurity researchers at Kaspersky have named the campaign FlashHole. Their investigation found that the hackers use a standardized post-quantum encryption mechanism to secure communication between infected systems and their command-and-control (C2) servers.
Lazarus Hackers Use Post-Quantum Cryptography to Deliver Malware
The attacks reportedly began in July 2025. Researchers identified at least three affected companies operating in the software, construction, and wired communication equipment manufacturing sectors in South Korea. However, they believe the campaign may have targeted more organizations.
How the FlashHole Campaign Works
The attackers use phishing pages to direct victims to specially designed GitHub pages. These pages load JavaScript code from external domains, starting a complex infection process that allows the hackers to install malware on targeted systems.
The attack chain also abuses INISAFE CrossWeb EX, a security tool commonly used in South Korea. The tool’s process launches a legitimate Windows executable called fsquirt.exe, which the attackers use to execute malicious code.
This process installs TechHub, a downloader that retrieves additional malware from private GitHub repositories.
The campaign also uses ClientHub, a malware loader that supports communication through Dropbox and direct data exchange with LPEClient. This helps the attackers deliver additional malicious components to compromised systems.
Multiple Malware Tools Used in Attacks
LPEClient plays a central role in the campaign. The malware collects information about infected systems, receives encrypted payloads, and helps the attackers avoid security monitoring.
Another tool, called Cubridge, is a modular backdoor that gives attackers several ways to control compromised computers. It supports file management, command execution, system reconnaissance, screenshot capturing, and the installation of additional malware.
Kaspersky also identified tools designed to steal sensitive information from Chromium-based browsers. These tools can target account credentials, cookies, and browsing history.
Researchers noted that much of the malicious code runs directly in system memory instead of being stored as files on the device. This technique can make detection more difficult because security tools may have fewer files to examine. However, some components still leave files on infected systems to maintain access.
Why Post-Quantum Cryptography Matters
One of the most notable features of FlashHole is its use of ML-KEM-1024, a standardized post-quantum key encapsulation mechanism approved by the US National Institute of Standards and Technology (NIST).
Post-quantum cryptography is designed to protect communications against attacks from future quantum computers. It can also help address the risk of attackers collecting encrypted information today and attempting to decrypt it later when more powerful technology becomes available.
In the FlashHole campaign, Lazarus uses ML-KEM to establish shared cryptographic keys between its malware and command-and-control infrastructure.
According to Kaspersky, LPEClient receives data containing four ML-KEM-1024 public keys from the C2 server. It then generates four separate pairs of shared keys and ciphertexts. The malware encrypts the ciphertexts using the GOST algorithm and sends them back to the server through ClientHub.
The resulting shared secrets provide key material for the Threefish encryption algorithm. This allows LPEClient to decrypt the server’s response, which contains configuration information and an executable payload.
The final payload is Cubridge, which LPEClient loads directly into the system’s memory.
Kaspersky believes this combination of post-quantum cryptography and in-memory execution helps Lazarus conceal its subsequent payloads and reduce the chances of detection.
Links to Earlier Lazarus Operations
Researchers have placed FlashHole within the broader Cascade Hole activity and linked it to the earlier Operation SyncHole campaign with medium-to-high confidence.
The findings highlight how advanced hacking groups are combining established malware with newer cryptographic methods to improve their attacks. While post-quantum encryption is being developed to strengthen cybersecurity, its use in this campaign shows that malicious actors can also adopt modern security technologies to protect their own communications and conceal malware delivery.
The discovery reinforces the need for organizations to strengthen phishing defenses, monitor suspicious application behavior, and investigate unusual activity involving trusted software and online services.
The post Lazarus Hackers Use Post-Quantum Cryptography to Deliver Malware appeared first on PhoneWorld.