Skip to content
Hacker Posts

Lazarus abuses South Korean security software, adds post-quantum crypto

Kaspersky attributes Operation FlashHole to Lazarus: abuse of Initech's INISAFE CrossWeb EX to deploy malware, with a loader now using ML-KEM-1024 post-quantum encryption for C2.

Published 3 min read
researchlazarusnorth-koreasouth-koreamalware

Kaspersky's Global Research and Analysis Team has published Operation FlashHole, a campaign it attributes to the North Korea-linked Lazarus group that abuses mandatory South Korean security software to plant malware — and whose newest loader wraps its command-and-control channel in post-quantum encryption. The report, by GReAT researcher Sojun Ryu, is the primary source for everything below; treat the attribution as Kaspersky's assessment rather than established fact.

What the campaign does

The operation abuses Initech's INISAFE CrossWeb EX, a security program widely required for online banking and government portals in South Korea. Kaspersky assesses FlashHole picks up where its earlier SyncHole campaign — which abused iniLINE's Cross EX — left off. The precise initial-access vector is hedged: Kaspersky says "signs point to" malicious GitHub Pages sites.

Once in, the toolset is modular:

  • TechHub — a downloader that pulls payloads from GitHub.
  • TouchHub — a parent installer for TouchShift.
  • TouchShift — a dropper for keyloggers, screenshot tools, and backdoors.
  • ClientHub — a backdoor that communicates over HTTPS or the Dropbox API.
  • LPEClient — a victim-profiling and payload-delivery tool Lazarus has used since 2019.
  • Cubridge — an orchestration component that fetches plugins and modules.

The post-quantum twist

The notable detail: the latest malware version uses ML-KEM-1024 — the NIST-standardized post-quantum key encapsulation mechanism — to establish an encrypted connection to the attackers' server before downloading and running further malware in memory. Kaspersky's Sojun Ryu said, "Our findings trace its use back to at least September 2024." The practical effect today is not quantum resistance for its own sake but a C2 handshake that network-inspection tooling and TLS-fingerprinting defenses may not recognize or decrypt.

Kaspersky ties a separate privilege-escalation zero-day into the broader Lazarus picture: CVE-2026-68820, a flaw in the Windows Ancillary Function Driver for WinSock used to deploy the FudModule rootkit — reported by Check Point in August 2026, distinct from FlashHole itself. Kaspersky also describes a parallel COPPERHEDGE wave hitting several South Korean organizations, with data in one case leaked to the ULOSE dark-web site.

Targets and timeline

Kaspersky names at least three South Korean organizations in the construction, software, and wire-communication equipment manufacturing sectors, with activity dating back at least to July 2025.

What to do today

  1. If you operate INISAFE CrossWeb EX or Cross EX, treat the software supply chain as a live threat vector: verify installer integrity and update channels, and watch for unexpected child processes spawned by the security client.
  2. Hunt for the toolset's behavior — downloaders reaching GitHub for payloads, backdoors beaconing to the Dropbox API, and in-memory execution following an unusual outbound handshake.
  3. Don't rely on TLS inspection alone against the ML-KEM-1024 C2: anomalous outbound connections preceding in-memory payload execution are the more durable signal.
  4. Read the GReAT writeup for the technical detail; Kaspersky did not publish a consolidated IOC block in the coverage we reviewed, so pull indicators from the report directly rather than any secondary summary.

Context

Lazarus abusing mandatory, high-privilege endpoint software to reach South Korean targets is a years-long pattern — SyncHole before this, and the group's long history of financially and intelligence-motivated intrusions. The post-quantum C2 is the genuinely new element, and an early data point in a shift defenders should expect more of: attackers adopting PQC not for future-proofing but because it breaks today's inspection assumptions.

Related stories