Lazarus uses ML-KEM-1024 to hide payloads in Operation FlashHole
Original title: North Korean Hackers Use Post-Quantum Encryption to Hide New Malware From Security Tools
Securelist says at least three South Korean organizations were hit, with the earliest evidence in July 2025.
Kaspersky's Securelist describes Operation FlashHole, in which Lazarus uses ML-KEM-1024 and Threefish so LPEClient can protect later payloads delivered from command-and-control and loaded in memory. The chain is assessed to begin with phishing sites, then run under the CrossWeb EX process, using modular malware including TechHub, Cubridge and LPEClient. At least three organizations in South Korea's software, construction and wired communications equipment sectors were affected. Securelist links the activity to Operation SyncHole with medium-to-high confidence.
Unconfirmed: Securelist could not confirm the initial compromise or how CrossWeb EX was abused, and rates the SyncHole link medium-to-high confidence.
- LPEClient obtains four ML-KEM-1024 public-key blocks from its command-and-control server.
- Some components communicate through GitHub, Dropbox or compromised websites.
- Tools can collect system details and steal browser passwords, cookies, bookmarks and history.
- How CrossWeb EX was abused was not confirmed.
- Securelist published several file hashes and domains, including javadevhouse[.]co[.]kr.
Impact: Steals browser data and delivers later in-memory payloads
- 1.Review and update South Korean financial security software such as CrossWeb EX.
- 2.Investigate unusual child processes or memory activity from trusted applications.
- 3.Look for unexpected GitHub or Dropbox use and correlate it with web traffic.
- Products
- CrossWeb EX
- Threat actors
- Lazarus
- Organizations
- Kaspersky
- Countries
- North KoreaSouth Korea
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cubedesign.co.kr | .]kr Suspicious domain pythonapischool[.]com C2 URL hxxps://cubedesign[.]co[.]kr/news C2 URL hxxps://cubedesign[.]co[.]kr/mobile/fashion |
| domain | fp-news.co.kr | hxxps://cubedesign[.]co[.]kr/mobile/fashion C2 URL hxxps://fp-news[.]co[.]kr/shop/cart C2 URL hxxps://k-wbc[.]co[.]kr/skin/social/so |
| domain | javadevhouse.co.kr | ile hash ff07641dc56914dd90ee0bd7404d7ad7 Suspicious domain javadevhouse[.]co[.]kr Suspicious domain pythonapischool[.]com C2 URL hxxps:// |
| domain | k-wbc.co.kr | n C2 URL hxxps://fp-news[.]co[.]kr/shop/cart C2 URL hxxps://k-wbc[.]co[.]kr/skin/social/social_view.php C2 URL hxxps://rcsh[.]co[.] |
| domain | pythonapischool.com | Suspicious domain javadevhouse[.]co[.]kr Suspicious domain pythonapischool[.]com C2 URL hxxps://cubedesign[.]co[.]kr/news C2 URL hxxps://c |
| domain | rcsh.co.kr | /k-wbc[.]co[.]kr/skin/social/social_view.php C2 URL hxxps://rcsh[.]co[.]kr/modules/bbs/tiles/bbs_div/inputForm.php C2 URL hxxps:// |
| domain | www.ksog.org | .]kr/modules/bbs/tiles/bbs_div/inputForm.php C2 URL hxxps://www[.]ksog[.]org/insert_file/handle.php File path C:\ProgramData\Dell\De |
| md5 | 2f8475a90a25624ed02f1d18d4e6d65d | 883abd File hash c105d6b16f544582772de0159f24c00a File hash 2f8475a90a25624ed02f1d18d4e6d65d File hash 676fabe30a28b53925fba98e34b35986 File hash b4a7ef |
| md5 | 676fabe30a28b53925fba98e34b35986 | 24c00a File hash 2f8475a90a25624ed02f1d18d4e6d65d File hash 676fabe30a28b53925fba98e34b35986 File hash b4a7eff35f048f06fb0a2d7631f23a7d File hash ff0764 |
| md5 | a28cba214058fcae2883d8cffc883abd | icator File hash ec84d6cb2ae7974767aedac246b50a3e File hash a28cba214058fcae2883d8cffc883abd File hash c105d6b16f544582772de0159f24c00a File hash 2f8475 |
| md5 | b4a7eff35f048f06fb0a2d7631f23a7d | e6d65d File hash 676fabe30a28b53925fba98e34b35986 File hash b4a7eff35f048f06fb0a2d7631f23a7d File hash ff07641dc56914dd90ee0bd7404d7ad7 Suspicious domai |
| md5 | c105d6b16f544582772de0159f24c00a | b50a3e File hash a28cba214058fcae2883d8cffc883abd File hash c105d6b16f544582772de0159f24c00a File hash 2f8475a90a25624ed02f1d18d4e6d65d File hash 676fab |
| md5 | ec84d6cb2ae7974767aedac246b50a3e | Indicators of compromise (IoCs):- Type Indicator File hash ec84d6cb2ae7974767aedac246b50a3e File hash a28cba214058fcae2883d8cffc883abd File hash c105d6 |
| md5 | ff07641dc56914dd90ee0bd7404d7ad7 | b35986 File hash b4a7eff35f048f06fb0a2d7631f23a7d File hash ff07641dc56914dd90ee0bd7404d7ad7 Suspicious domain javadevhouse[.]co[.]kr Suspicious domain |
| url | https://cubedesign.co.kr/mobile/fashion | chool[.]com C2 URL hxxps://cubedesign[.]co[.]kr/news C2 URL hxxps://cubedesign[.]co[.]kr/mobile/fashion C2 URL hxxps://fp-news[.]co[.]kr/shop/cart C2 URL hxxps |
| url | https://cubedesign.co.kr/news | se[.]co[.]kr Suspicious domain pythonapischool[.]com C2 URL hxxps://cubedesign[.]co[.]kr/news C2 URL hxxps://cubedesign[.]co[.]kr/mobile/fashion C2 U |
| url | https://fp-news.co.kr/shop/cart | s C2 URL hxxps://cubedesign[.]co[.]kr/mobile/fashion C2 URL hxxps://fp-news[.]co[.]kr/shop/cart C2 URL hxxps://k-wbc[.]co[.]kr/skin/social/social_view. |
| url | https://k-wbc.co.kr/skin/social/social_view.php | e/fashion C2 URL hxxps://fp-news[.]co[.]kr/shop/cart C2 URL hxxps://k-wbc[.]co[.]kr/skin/social/social_view.php C2 URL hxxps://rcsh[.]co[.]kr/modules/bbs/tiles/bbs_div |
| url | https://rcsh.co.kr/modules/bbs/tiles/bbs_div/inputForm.php | hxxps://k-wbc[.]co[.]kr/skin/social/social_view.php C2 URL hxxps://rcsh[.]co[.]kr/modules/bbs/tiles/bbs_div/inputForm.php C2 URL hxxps://www[.]ksog[.]org/insert_file/handle.php |
| url | https://www.ksog.org/insert_file/handle.php | sh[.]co[.]kr/modules/bbs/tiles/bbs_div/inputForm.php C2 URL hxxps://www[.]ksog[.]org/insert_file/handle.php File path C:\ProgramData\Dell\Dell1.tmp File path C:\Pr |
From the original article
4 min read at cybersecuritynews.com
North Korean-linked Lazarus hackers are using post-quantum cryptography in a malware delivery chain designed to conceal later-stage payloads from security tools. The technique appeared in Operation FlashHole, a campaign targeting organizations in South Korea. Instead of relying on encryption alone to hide files on disk, the malware uses a modern key-establishment method to protect payloads […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.