Skip to content
Hacker Posts

Lazarus wraps malware delivery in post-quantum crypto (FlashHole)

Kaspersky says Lazarus's Operation FlashHole uses ML-KEM-1024 in its LPEClient loader to encrypt C2 and hide payloads. At least three South Korean firms were hit.

Published 3 min read
researchlazarusnorth-koreapost-quantumthreat-intel

Kaspersky's GReAT team has detailed Operation FlashHole, a campaign it attributes to Lazarus in which an updated LPEClient loader uses ML-KEM-1024 — a NIST post-quantum key-encapsulation algorithm — to negotiate keys with its command-and-control server before loading later payloads in memory. The Securelist writeup is the primary source; BleepingComputer covered it. At least three South Korean organizations were confirmed hit. This is threat intel, not a patchable bug — the value is in the detection surface.

Attribution

Kaspersky assesses "with medium-to-high confidence that the same actor is responsible for both the SyncHole and FlashHole operations," places FlashHole as "the latest wave in the broader Cascade Hole campaign," and notes that the continued use of LPEClient is "a strong indicator supporting this assessment." Kaspersky names Lazarus; we keep that framing rather than stating it as settled fact.

The infection chain

Per Securelist:

  1. Spear-phishing links lead to a GitHub Pages lure (fake résumé / Dream Job theme, AI-generated photo).
  2. The chain likely abuses INISAFE CrossWeb EX V3 (v3.4.1.2), a security client widely deployed in South Korea; the parent process is INISAFECrossWebEXSvc.exe.
  3. fsquirt.exe runs under that process and is injected with shellcode carrying the TechHub DLL, which uses GitHub as its C2 channel.
  4. TechHub deploys TouchHub, which installs TouchShift as a service via DLL side-loading (mscoree.dll); TouchShift loads a second in-memory TechHub.
  5. That instance deploys ClientHub and LPEClient, and LPEClient receives the final payload — Cubridge — through ClientHub.

How the post-quantum crypto is used

The C2 response to LPEClient contains four 1,568-byte blocks, each holding "an ML-KEM-1024 public key"; LPEClient derives shared key/ciphertext pairs from them. Messages are encrypted with GOST (Kaspersky notes KrCERT first described this as a custom DES-like scheme, but "it is actually the GOST algorithm"), and a Threefish-decrypted response carries the next-stage parameters and executable. Kaspersky's read: "The use of post-quantum cryptography shows that the group intends to hide subsequent payloads" — a harvest-now-decrypt-later hedge against future traffic analysis, applied to malware delivery rather than espionage exfil.

Indicators of compromise

Kaspersky published IOCs on Securelist (sample, verbatim):

ClientHub loader (liblzma.dll) MD5:  ff07641dc56914dd90ee0bd7404d7ad7
C2 domains:  javadevhouse[.]co[.]kr, pythonapischool[.]com, cubedesign[.]co[.]kr,
             fp-news[.]co[.]kr, k-wbc[.]co[.]kr, rcsh[.]co[.]kr, www[.]ksog[.]org
File paths:  C:\Windows\System32\RasConv\mscoree.dll
             C:\Windows\System32\RasConv\ActivationStore.dat
             C:\Program Files\Common Files\System\msadc\msadc.inc
Kaspersky verdicts:  MEM:Trojan.Win64.Shellcode.gen, Trojan.Win64.DLLhijack.*,
                     Trojan.Win64.Lazarus.*

The full hash set (six TouchShift mscoree.dll samples) is in the Securelist report; pull it from there rather than from this summary.

Action checklist

  1. Hunt for fsquirt.exe and mscoree.dll executing under INISAFECrossWebEXSvc.exe or other unexpected parents — the side-loading chain is the reliable tell.
  2. Block and alert on the C2 domains above; watch for endpoints reaching GitHub Pages infrastructure they don't normally touch.
  3. If you run INISAFE CrossWeb EX, confirm your version against AhnLab's advisory and the Securelist detail, and prioritize South Korea-facing assets.
  4. Flag the file paths under RasConv and msadc for EDR detection.

Context

Lazarus adopting a NIST-standardized PQC primitive for C2 is the notable shift — not because the crypto is unbreakable today, but because it signals operators building for a future where captured traffic stays confidential. For defenders the math changes nothing: the chain still touches disk and process trees in predictable places, and that is where it gets caught.

Related stories