Cybersecurity
Kaspersky links Lazarus to post-quantum malware delivery
Kaspersky said the Lazarus Group ran a campaign against South Korean organisations that used ML-KEM for payload delivery and relied on phishing pages, GitHub, Dropbox and several malware tools.
- Kaspersky said it identified a campaign it called FlashHole and linked it to Lazarus Group.
- The researchers said the attacks began in July 2025 and targeted South Korean organisations in software, construction and wired communication equipment manufacturing.
- Kaspersky said the attackers used ML-KEM-1024 to exchange keys with command-and-control infrastructure and decrypt later payloads.
- The infection chain used phishing pages, GitHub pages, INISAFE CrossWeb EX, fsquirt.exe, TechHub, ClientHub and Cubridge.
Kaspersky said the operation began with phishing pages that pointed targets to specially prepared GitHub pages. Those pages loaded JavaScript from outside domains and started an in-memory chain that involved INISAFE CrossWeb EX and the Windows binary fsquirt.exe.
The company said fsquirt.exe ran shellcode that installed TechHub, which then fetched more malware from private GitHub repositories. It said ClientHub handled Dropbox communications and direct exchange with LPEClient.
Kaspersky said LPEClient collected ML-KEM-1024 public keys from command-and-control servers, formed shared keys and used them to decrypt later payloads. It said Cubridge was then loaded into memory as the final payload.
The researchers said Cubridge provided file handling, command execution, reconnaissance and screenshot capture, and that they had also seen tools aimed at Chromium-based browsers. Kaspersky said most of Lazarus' code ran in memory, although some persistence mechanisms left files on disk, and it linked FlashHole to Cascade Hole and to Operation SyncHole with medium-to-high confidence.
Named in this story
Companies
- Kaspersky
- analysed the malware and named the campaign FlashHole
Organisations
- Lazarus Group
- was the group Kaspersky attributed the campaign to
Products and systems
- ML-KEM-1024
- was the post-quantum mechanism used for key exchange
- LPEClient
- was used to receive keys and decrypt later payloads
- INISAFE CrossWeb EX
- was the security tool loaded during the infection chain
- fsquirt.exe
- was the legitimate Windows binary that ran shellcode
- TechHub
- was the downloader that fetched additional malware
- ClientHub
- was the loader that handled Dropbox traffic and direct exchange
- Cubridge
- was the final backdoor loaded into memory
Places
- South Korea
- was the country where the targeted organisations were based
How the source tells it
Mostly technical and source-led, with a mild novelty frame around post-quantum cryptography and some threat emphasis from the researchers' description of the campaign.
- novelty The article marks the post-quantum mechanism as the notable feature of the operation and treats it as the unusual element in the delivery chain.
- threat emphasis It heightens concern by stressing the complexity of the infection chain and the idea that the method reduced detection risk.