A malware campaign targeting South Korean organizations is using post-quantum cryptography to protect payloads delivered from command-and-control infrastructure. Kaspersky named the operation FlashHole and attributed it to the North Korean Lazarus Group, according to a BleepingComputer report published on October 21, 2026.
The attacks reportedly began in July 2025. Kaspersky identified at least three affected companies operating in software, construction, and wired communication equipment manufacturing. The researchers suspect that other organizations were compromised, but that broader impact remains an assessment rather than a confirmed victim count.
Phishing leads to an in-memory execution chain
FlashHole begins with phishing pages that direct targets to specially constructed GitHub pages. Those pages load JavaScript from external domains, initiating a multi-stage chain designed to keep most malicious code in memory.
The operation abuses INISAFE CrossWeb EX, a legitimate security product widely used in South Korea. An INISAFE process launches the legitimate Windows executable fsquirt.exe, which then runs shellcode.
That shellcode installs TechHub, a downloader responsible for retrieving additional malware from private GitHub repositories. Subsequent stages introduce several distinct components:
- TechHub downloads further tools from private GitHub repositories.
- LPEClient profiles compromised systems, attempts to evade security monitoring, and processes encrypted payloads received through ClientHub.
- ClientHub, described as a new loader in these attacks, supports Dropbox communications and direct exchanges with LPEClient.
- Cubridge is a modular backdoor capable of reconnaissance, file management, command execution, screenshot capture, and loading additional payloads.
- Unnamed credential-stealing tools target Chromium-based browsers for account credentials, cookies, and browsing history.
Cubridge is reflectively loaded into the host’s memory. Although much of the chain runs without writing its main components to storage, the persistence mechanisms leave some files on disk.
These names describe separate malware families or components within FlashHole. Kaspersky attributes their use in this campaign to Lazarus; they should not be treated as interchangeable names for either the operator or the operation.
ML-KEM protects the next payload stage
The cryptographic exchange occurs through LPEClient. The malware obtains a byte array from the command-and-control server containing four blocks of 1,568 bytes each. Every block carries an ML-KEM-1024 public key.
LPEClient uses those keys to generate four separate pairs of shared secrets and ciphertexts. It encrypts the ciphertexts with the GOST algorithm and sends them to the server through ClientHub. The shared secrets supply key material for Threefish, which decrypts the server response containing configuration parameters and the executable payload.
ML-KEM is a NIST-approved post-quantum key-encapsulation standard intended to resist future attacks by quantum-capable systems. In FlashHole, however, its immediate purpose is operational: shielding malware delivery between the infected host and the command infrastructure.
Kaspersky assesses that the combination of this encrypted exchange and memory-resident execution is intended to reduce visibility into later payload stages. The cryptography does not eliminate behavioral evidence elsewhere in the chain, including the unusual process execution, external script loading, GitHub-based retrieval, and activity associated with the loaders and backdoor.
Defensive focus: process ancestry and staged network activity
Defenders—particularly organizations using INISAFE CrossWeb EX—can focus detection on the observed sequence rather than relying solely on payload inspection. Relevant behaviors include:
- an INISAFE process unexpectedly launching
fsquirt.exe; - shellcode or other anomalous in-memory execution following that process relationship;
- downloads from private GitHub repositories associated with an earlier phishing or script-loading event;
- unexpected Dropbox traffic from processes involved in the loader chain;
- Chromium credential, cookie, or browsing-history access following the initial compromise;
- reflective loading and memory-only execution consistent with Cubridge deployment.
Disk-focused scanning alone may miss much of the activity because the core chain primarily executes in memory. Endpoint telemetry that preserves process ancestry, memory-execution events, browser-data access, and outbound connections offers a better basis for identifying the sequence.
Kaspersky places FlashHole within the broader Cascade Hole activity and links it to the earlier Operation SyncHole with medium-to-high confidence. That relationship is an analytical assessment; the campaign name, malware components, and attributed operator remain separate elements of the reporting.
