Lazarus hid FlashHole malware traffic with post-quantum keys
Original title: North Korean Hackers Use Post-Quantum Encryption to Conceal Malware in New Cyberespionage Campaign
Kaspersky ties July 2025 activity to at least three South Korean organizations and an LPEClient build using ML-KEM-1024.
Kaspersky describes Operation FlashHole, a Lazarus campaign against South Korean organizations that combined spear-phishing, malicious websites, and abuse of INISAFE CrossWeb EX with mostly in-memory modular malware. An updated LPEClient used ML-KEM-1024 public keys and Threefish to protect a later payload. Researchers traced the earliest evidence to July 2025 and identified at least three affected organizations. How CrossWeb EX was compromised remains unclear.
Unconfirmed: The exact CrossWeb EX exploitation method is unclear, and researchers did not establish that AI created the lures.
- Victims were in software, construction, and wired-communications equipment in South Korea.
- fsquirt.exe was launched under CrossWeb EX and injected with TechHub shellcode.
- TouchHub, TouchShift, ClientHub, LPEClient, and Cubridge followed the initial stage.
- Cubridge used RSA and RC6, while LPEClient used ML-KEM-1024 and Threefish.
- Five listed file hashes are all named mscoree.dll.
Impact: In-memory malware and encrypted command-and-control on compromised systems
| Product | Affected |
|---|---|
| INISAFE CrossWeb EX | — |
- 1.Monitor unusual activity originating from trusted security software.
- 2.Investigate suspicious in-memory execution.
- 3.Keep locally required security applications patched.
- ATT&CK
- T1566.002 Spearphishing LinkT1055 Process InjectionT1620 Reflective Code LoadingT1573 Encrypted Channel
- Products
- INISAFE CrossWeb EX
- Threat actors
- Lazarus Group
- Organizations
- Kaspersky
- Countries
- North KoreaSouth Korea
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 2f8475a90a25624ed02f1d18d4e6d65d | bd mscoree.dll c105d6b16f544582772de0159f24c00a mscoree.dll 2f8475a90a25624ed02f1d18d4e6d65d mscoree.dll 676fabe30a28b53925fba98e34b35986 mscoree.dll No |
| md5 | 676fabe30a28b53925fba98e34b35986 | 0a mscoree.dll 2f8475a90a25624ed02f1d18d4e6d65d mscoree.dll 676fabe30a28b53925fba98e34b35986 mscoree.dll Note: IP addresses and domains are intentionall |
| md5 | a28cba214058fcae2883d8cffc883abd | hash File name ec84d6cb2ae7974767aedac246b50a3e mscoree.dll a28cba214058fcae2883d8cffc883abd mscoree.dll c105d6b16f544582772de0159f24c00a mscoree.dll 2f |
| md5 | c105d6b16f544582772de0159f24c00a | 3e mscoree.dll a28cba214058fcae2883d8cffc883abd mscoree.dll c105d6b16f544582772de0159f24c00a mscoree.dll 2f8475a90a25624ed02f1d18d4e6d65d mscoree.dll 67 |
| md5 | ec84d6cb2ae7974767aedac246b50a3e | tions patched. Indicators of compromise File hash File name ec84d6cb2ae7974767aedac246b50a3e mscoree.dll a28cba214058fcae2883d8cffc883abd mscoree.dll c1 |
From the original article
3 min read at gbhackers.com
North Korea-linked Lazarus Group used post-quantum cryptography in a cyberespionage campaign targeting South Korean organizations, concealing malware communications and payloads behind a multi-stage infection chain. Dubbed Operation FlashHole, the campaign combined spear-phishing, malicious websites, abuse of financial security software and modular malware that largely operated in memory.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.