Lazarus uses ML-KEM to deliver malware in FlashHole attacks
Original title: Lazarus hackers use post-quantum cryptography for malware delivery
Kaspersky says phishing led to in-memory loaders and the Cubridge backdoor at South Korean firms, starting in July 2025.
Kaspersky attributes operation FlashHole to the North Korean Lazarus Group and says it targeted South Korean organizations through phishing pages that sent victims to crafted GitHub pages. The chain uses LPEClient, TechHub, and ClientHub, then reflectively loads the modular Cubridge backdoor, with ML-KEM-1024 protecting payload delivery. Researchers confirmed at least three companies and link the activity to Cascade Hole with medium-to-high confidence.
Unconfirmed: Kaspersky's link to Cascade Hole and Operation SyncHole is medium-to-high confidence, and victims beyond three firms are unconfirmed.
- Attacks began in July 2025 and abused INISAFE CrossWeb EX and fsquirt.exe.
- LPEClient receives four ML-KEM-1024 public keys, then decrypts payloads with Threefish.
- Cubridge supports files, commands, reconnaissance, screenshots, and extra payloads.
- Other tools steal Chromium credentials, cookies, and browsing history.
- Named sectors are software, construction, and wired communications equipment.
Impact: Backdoor access, malware delivery, and browser credential theft
- 1.Watch for phishing pages that redirect targets to crafted GitHub pages.
- ATT&CK
- T1566.002 Spearphishing LinkT1105 Ingress Tool TransferT1620 Reflective Code LoadingT1555.003 Credentials from Web Browsers
- Products
- INISAFE CrossWeb EXGitHub
- Threat actors
- Lazarus Group
- Organizations
- Kaspersky
- Countries
- North KoreaSouth Korea
From the original article
3 min read at bleepingcomputer.com
North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.