The North Korea-linked Lazarus Group used post-quantum encryption in a cyberespionage campaign called Operation FlashHole targeting South Korean organizations, according to Mayura Kathir at GBHackers Security, citing Kaspersky researchers. The operation concealed malware communications and payloads behind a multi-stage infection chain that combined spear-phishing, malicious websites, abused financial security software and modular malware running largely in memory.
Kaspersky researchers traced the earliest evidence of Operation FlashHole to July 2025 and identified at least three affected organizations in South Korea across the software, construction and wired-communications equipment sectors. The campaign followed an earlier Lazarus operation called Operation SyncHole, which used watering-hole attacks and abused local software to hit at least six South Korean organizations across software, IT, finance, semiconductor manufacturing and telecommunications. According to the report, the change in victim industries suggests the group expanded its targeting.
Initial Compromise Through INISAFE CrossWeb EX and Tailored Lures
While Operation SyncHole abused the related Cross EX product, Operation FlashHole centered its initial infection chain on INISAFE CrossWeb EX, a financial security application used for accessing online banking and government services. Although the exact exploitation method remains unclear, researchers observed a high-integrity process chain that ultimately ran malicious code in memory.
Lazarus likely used spear-phishing emails to direct selected victims to customized websites hosted on GitHub Pages. These lures included a résumé page and an interior-design portfolio, seemingly tailored to specific targets. On the résumé site, the job seeker's name resembled a Korean equivalent of “John Doe” and one image appeared AI-generated, while the portfolio contained seemingly meaningless details and random companies that looked artificial. These clues suggest AI may have helped create or embellish the lures, though researchers did not determine exactly how the content was produced.
Multi-Stage In-Memory Malware Chain
Following the initial compromise, the CrossWeb EX process launched the legitimate Windows program fsquirt.exe and injected it with shellcode carrying TechHub malware. TechHub handled early-stage delivery and system profiling.
The infection chain then deployed several modular components:
- TouchHub and TouchShift to establish persistence.
- ClientHub and LPEClient to support reconnaissance, payload delivery and flexible payload management.
- Cubridge, a central framework loaded by the earlier components to receive commands and deploy plugins, tools and modules.
Because much of this execution occurred in memory, fewer files were left on disk for detection. LPEClient was previously seen in Operation SyncHole as well.
Post-Quantum Key Establishment in LPEClient
The campaign's key cryptographic change appeared in an updated variant of LPEClient. After profiling a target system, LPEClient retrieved four 1,568-byte blocks containing ML-KEM-1024 public keys. ML-KEM is the key-encapsulation mechanism standardized by NIST and derived from CRYSTALS-Kyber.
Using those public keys, the malware generated key material and sent encrypted ciphertexts to its command-and-control infrastructure. It then combined the resulting shared keys with the Threefish cipher to decrypt a subsequent response carrying a payload, which it reflectively loaded into memory. Meanwhile, Cubridge uses a more robust handshaking process than TechHub by combining the RSA and RC6 algorithms.
According to GBHackers Security, this technique uses post-quantum key establishment as one layer within a broader custom protocol, rather than proving that every stage uses quantum-resistant cryptography or making the malware invisible. Its operational value is adding complexity to the exchange that protects payload delivery and complicating analysis of the command channel.
South Korea's Financial Security Software Ecosystem
Operation FlashHole reflects Lazarus's ongoing focus on South Korea's software ecosystem, where security programs required for financial services can become high-value attack surfaces when vulnerabilities or unsafe interactions are abused. A 2025 USENIX study examining South Korea's mandatory financial-security software documented security weaknesses and reported 19 vulnerabilities, which researchers said were disclosed and patched, providing context for why these widely installed applications require careful security review.
Indicators of Compromise and Defender Takeaways
The report lists five file hashes associated with the campaign, all tied to the file name mscoree.dll:
| File hash | File name |
|---|---|
ec84d6cb2ae7974767aedac246b50a3e | mscoree.dll |
a28cba214058fcae2883d8cffc883abd | mscoree.dll |
c105d6b16f544582772de0159f24c00a | mscoree.dll |
2f8475a90a25624ed02f1d18d4e6d65d | mscoree.dll |
676fabe30a28b53925fba98e34b35986 | mscoree.dll |
For security defenders, the campaign highlights the importance of monitoring unusual activity coming from trusted security software, investigating suspicious in-memory execution, and keeping locally required security applications patched.
This article was written by AI from reporting by gbhackers.com.
