Last updated: 23 October 2026.
On 21 October 2026 Kaspersky published research on Operation FlashHole, a campaign it attributes to the Lazarus Group. The targets are organizations in South Korea. Kaspersky says a Lazarus tool named LPEClient now uses ML-KEM-1024, a post-quantum key exchange, to protect the payloads it downloads. The earliest evidence of the operation dates to July 2025.
What Kaspersky Found
Kaspersky identified at least three victims in South Korea, in software, construction and wired communication equipment manufacturing. It believes many more organizations were hit. These sectors differ from those hit in Operation SyncHole, the earlier campaign it ties to the same actor. Software is the only sector common to both.
The lures were tailored. Kaspersky assesses with medium-to-high confidence that the targets received spear-phishing emails with links to fake portfolio and résumé sites hosted on GitHub Pages. One site showed a photo that Kaspersky believes was AI-generated, because it had no EXIF data and an unnatural texture.
Kaspersky could not confirm what exactly triggered the infection. Its research points to a high chance that a visit to the site started a chain that abused CrossWeb EX. That is a financial security program that South Korean banking and government websites require.
How the Post-Quantum Step Works
LPEClient first profiles the infected computer and sends the result to its server, encrypted with the GOST cipher. The server then answers with four blocks of data. Each block holds an ML-KEM-1024 public key. LPEClient builds four pairs of shared keys and ciphertexts from them, encrypts the ciphertexts with GOST and sends them back.
The four shared keys together form the key for Threefish, a block cipher that decrypts the next payload. Kaspersky says the payload must be larger than 4 KB and start with the letters MZ, which marks a Windows executable. LPEClient then loads it into memory. In the case Kaspersky analyzed, the final payload was Cubridge.
ML-KEM is the key encapsulation standard that NIST published as FIPS 203 on 13 August 2024. NIST describes it as believed secure even against an attacker with a quantum computer. Kaspersky writes that the group seems to have adopted post-quantum cryptography faster than many legitimate security products. Its press release says its findings trace the group’s use of post-quantum cryptography back to at least September 2024.
Our reading is narrow. The key exchange hides payload contents while they travel. It does not hide what the malware must do on the host, and Kaspersky’s report describes that behavior and lists indicators of compromise.
The Malware Chain
- TechHub is the first-stage downloader. It talks to private GitHub repositories through the GitHub API. Kaspersky calls it an advanced version of the tool Mandiant named CLOUDBURST and ESET named NickelLoader.
- TouchHub and TouchShift keep the foothold. They use DLL side-loading under the file name mscoree.dll. Kaspersky named TouchHub itself after finding it in TechHub’s repository.
- ClientHub is new. It relays traffic between LPEClient and the server. One version talks to websites and another uses the Dropbox API.
- LPEClient profiles the host and receives payloads. It is the only malware that also appeared in SyncHole.
- Cubridge is the orchestrator. It loads plugins, modules and tools, including an Active Directory query plugin and a browser credential stealer. Kaspersky says Mandiant tracked an earlier version as SIDESHOW.
Kaspersky says the first stages exist only in memory during the initial compromise. A legitimate Windows file, fsquirt.exe, runs under the CrossWeb EX process and receives injected shellcode.
How It Fits Earlier Lazarus Activity
Kaspersky calls FlashHole the latest wave of the wider Cascade Hole campaign. It assesses with medium-to-high confidence that the same actor ran both SyncHole and FlashHole. It also says TechHub, Cubridge and TouchShift were seen earlier in Operation Dream Job, mostly in 2022 and 2023.
A separate cluster uses the COPPERHEDGE backdoor against South Korean organizations. Kaspersky thinks that cluster is involved in making money from attacks, while FlashHole is focused on espionage. Our Lazarus Group profile keeps the government attributions and the sources that disagree on where the group boundary lies.
What Defenders Can Check
Kaspersky reports victims only in South Korea and names no other country. Teams that run or support Korean banking and government software, or that do business with Korean firms, can still use these checks. The first two are based directly on what the report describes. Kaspersky’s report also lists the indicators of compromise and its product detection names (MEM:Trojan.Win64.Shellcode.gen, Trojan.Win64.DLLhijack.* and Trojan.Win64.Lazarus.*).
- Look for fsquirt.exe or other unusual child processes started by CrossWeb EX. Kaspersky saw the parent process INISAFECrossWebEXSvc.exe launch one at a high integrity level.
- Look for an mscoree.dll that loads from any folder other than C:\Windows\System32 or, for 32-bit processes, C:\Windows\SysWOW64. Kaspersky found it in C:\Windows\System32\RasConv. This is DLL side-loading, a technique Lazarus has used before.
- Question GitHub API calls and Dropbox API calls from computers that have no reason to make them.
- Hunt for reflective code loading, because the payloads run from memory and leave little on disk.
- Treat links to portfolios and résumés from unknown senders as hostile, especially if you hire developers. Check which CrossWeb EX version your staff run. Kaspersky saw version 3.4.1.2, which was released in 2023 after a KrCERT advisory, in this chain. A build released after an advisory is not proof of safety on its own.
What Public Sources Show
We checked X and dark web monitoring on 23 October. On X, the most shared posts since 21 October linked to Kaspersky’s report, Kaspersky’s own announcement of 21 October and BleepingComputer’s article.
Our dark web monitoring source showed six posts that mention FlashHole, on Telegram channels and two forums between 21 and 22 October. All of them were copies of the news. These checks say nothing about whether the campaign claims are true, and the dark web posts are not verified.
Post-quantum cryptography is also a planning topic for defenders. Our notes on NIST and CISA post-quantum guidance and on NCSC and EU migration dates cover that side. The South Korea country page gives wider context.