# Lazarus Group Uses Post-Quantum Encryption in Operation FlashHole Against South Korea

> The North Korea-linked Lazarus Group used post-quantum encryption in Operation FlashHole to target South Korean organizations, according to GBHackers Security.

- Canonical URL: https://coreiten.com/en/article/lazarus-group-post-quantum-encryption-in-operation-flashhole
- Language: en
- Section: Security
- Author: Sami
- Published: 2026-10-22T12:01:14+03:00
- Modified: 2026-10-22T12:01:14+03:00
- Publisher: CoreITen (https://coreiten.com)
- Keywords: Lazarus Group, Operation FlashHole, Kaspersky, INISAFE CrossWeb EX, LPEClient, Cubridge, ML-KEM-1024

## Summary

The North Korea-linked Lazarus Group utilized post-quantum cryptography in an espionage campaign called Operation FlashHole targeting South Korean organizations.

- Kaspersky researchers traced the earliest evidence of Operation FlashHole to July 2025 and identified at least three affected organizations across software, construction, and wired-communications equipment sectors.
- The campaign relied on spear-phishing emails directing victims to customized GitHub Pages featuring artificial intelligence-generated lures like a résumé page and an interior-design portfolio.
- Attackers abused INISAFE CrossWeb EX, a mandatory financial security application, to inject shellcode into the legitimate Windows program fsquirt.exe and execute in-memory malware.
- An updated variant of the LPEClient malware retrieved four 1,568-byte blocks containing ML-KEM-1024 public keys standardized by NIST to encrypt communication and decrypt subsequent payloads.
- The report lists five file hashes associated with the campaign, all sharing the file name mscoree.dll.

**Why it matters:** This campaign marks a notable tactical evolution as state-sponsored threat actors begin integrating NIST-standardized post-quantum cryptography into their malware communication channels.

---

The North Korea-linked Lazarus Group used post-quantum encryption in a cyberespionage campaign called Operation FlashHole targeting South Korean organizations, according to Mayura Kathir at GBHackers Security, citing Kaspersky researchers. The operation concealed malware communications and payloads behind a multi-stage infection chain that combined spear-phishing, malicious websites, abused financial security software and modular malware running largely in memory.

Kaspersky researchers traced the earliest evidence of Operation FlashHole to July 2025 and identified at least three affected organizations in South Korea across the software, construction and wired-communications equipment sectors. The campaign followed an earlier Lazarus operation called Operation SyncHole, which used watering-hole attacks and abused local software to hit at least six South Korean organizations across software, IT, finance, semiconductor manufacturing and telecommunications. According to the report, the change in victim industries suggests the group expanded its targeting.

### Initial Compromise Through INISAFE CrossWeb EX and Tailored Lures

While Operation SyncHole abused the related Cross EX product, Operation FlashHole centered its initial infection chain on INISAFE CrossWeb EX, a financial security application used for accessing online banking and government services. Although the exact exploitation method remains unclear, researchers observed a high-integrity process chain that ultimately ran malicious code in memory.

Lazarus likely used spear-phishing emails to direct selected victims to customized websites hosted on GitHub Pages. These lures included a résumé page and an interior-design portfolio, seemingly tailored to specific targets. On the résumé site, the job seeker's name resembled a Korean equivalent of “John Doe” and one image appeared AI-generated, while the portfolio contained seemingly meaningless details and random companies that looked artificial. These clues suggest AI may have helped create or embellish the lures, though researchers did not determine exactly how the content was produced.

### Multi-Stage In-Memory Malware Chain

Following the initial compromise, the CrossWeb EX process launched the legitimate Windows program `fsquirt.exe` and injected it with shellcode carrying TechHub malware. TechHub handled early-stage delivery and system profiling.

The infection chain then deployed several modular components:

- TouchHub and TouchShift to establish persistence.
- ClientHub and LPEClient to support reconnaissance, payload delivery and flexible payload management.
- Cubridge, a central framework loaded by the earlier components to receive commands and deploy plugins, tools and modules.

Because much of this execution occurred in memory, fewer files were left on disk for detection. LPEClient was previously seen in Operation SyncHole as well.

### Post-Quantum Key Establishment in LPEClient

The campaign's key cryptographic change appeared in an updated variant of LPEClient. After profiling a target system, LPEClient retrieved four 1,568-byte blocks containing ML-KEM-1024 public keys. ML-KEM is the key-encapsulation mechanism standardized by NIST and derived from CRYSTALS-Kyber.

Using those public keys, the malware generated key material and sent encrypted ciphertexts to its command-and-control infrastructure. It then combined the resulting shared keys with the Threefish cipher to decrypt a subsequent response carrying a payload, which it reflectively loaded into memory. Meanwhile, Cubridge uses a more robust handshaking process than TechHub by combining the RSA and RC6 algorithms.

According to GBHackers Security, this technique uses post-quantum key establishment as one layer within a broader custom protocol, rather than proving that every stage uses quantum-resistant cryptography or making the malware invisible. Its operational value is adding complexity to the exchange that protects payload delivery and complicating analysis of the command channel.

### South Korea's Financial Security Software Ecosystem

Operation FlashHole reflects Lazarus's ongoing focus on South Korea's software ecosystem, where security programs required for financial services can become high-value attack surfaces when vulnerabilities or unsafe interactions are abused. A 2025 USENIX study examining South Korea's mandatory financial-security software documented security weaknesses and reported 19 vulnerabilities, which researchers said were disclosed and patched, providing context for why these widely installed applications require careful security review.

### Indicators of Compromise and Defender Takeaways

The report lists five file hashes associated with the campaign, all tied to the file name `mscoree.dll`:

| File hash | File name |
| --- | --- |
| ec84d6cb2ae7974767aedac246b50a3e | mscoree.dll |
| a28cba214058fcae2883d8cffc883abd | mscoree.dll |
| c105d6b16f544582772de0159f24c00a | mscoree.dll |
| 2f8475a90a25624ed02f1d18d4e6d65d | mscoree.dll |
| 676fabe30a28b53925fba98e34b35986 | mscoree.dll |

For security defenders, the campaign highlights the importance of monitoring unusual activity coming from trusted security software, investigating suspicious in-memory execution, and keeping locally required security applications patched.

## Sources

- [gbhackers.com](https://gbhackers.com/post-quantum-encryption/)

## Related topics

- [Lazarus Group](https://coreiten.com/en/topic/lazarus-group)