Lazarus Group Deploys ML-KEM Encryption in Operation FlashHole Against South Korean Construction and Software Firms

North Korean hackers gained encrypted command-and-control access to South Korean organizations by using post-quantum cryptography to hide their malware delivery. The Lazarus Group needed victims to visit tailored phishing pages that abused a legitimate financial security tool. This initial access allowed the attackers to install modular backdoors that ran primarily in memory, making detection difficult for traditional security tools.

In plain English

The attackers used a modern encryption method called ML-KEM to protect the communication between their servers and infected computers. This standard is designed to resist attacks from future quantum computers. By using it, the group concealed the malicious payloads they sent to victims. The malware received public keys from command-and-control servers to generate shared secrets. These secrets allowed the malware to decrypt incoming instructions and additional tools without exposing them to network monitoring.

The background

Kaspersky researchers named the operation FlashHole and linked it to the Lazarus Group. The attacks began in July 2025 and targeted firms in software, construction, and wired communications. Victims were directed to fake GitHub pages hosting résumés or interior design portfolios. Some content appeared to be generated by artificial intelligence. These pages loaded malicious JavaScript that triggered execution chains involving the INISAFE CrossWeb EX security application.

What changes now

The campaign combined several malware families, including LPEClient, TechHub, ClientHub, and Cubridge. LPEClient profiles victims and receives encrypted payloads through ClientHub. TechHub acts as a downloader retrieving tools from private GitHub repositories. Cubridge provides file management, command execution, and screenshot capabilities. Most of the code runs in memory, leaving few files on disk for forensic analysis. Persistence mechanisms do leave some artifacts behind.

What made it possible

Teams usually see post-quantum cryptography used for forward secrecy in legitimate communications, not for hiding command-and-control traffic. This incident shows that attackers are adopting emerging standards to evade detection. Security teams should check whether their network monitoring tools can inspect encrypted traffic flows that use non-standard protocols. Organizations must verify that their endpoint detection solutions can identify malicious behavior even when payloads are delivered in memory.

Background: Malware families

Malware families group threats by shared code and behavior. Recognizing these patterns lets you block entire clusters instead of hunting individual files. This reduces monitoring noise, lowers response costs, and helps you choose tools that detect the specific tactics used against your industry sector.

Read the full guide: Malware Families Explained: Why Small Teams Need Specific Defense

What to do and how to stay safe: Lazarus Group

• Monitor for unusual outbound connections from legitimate financial security applications like INISAFE CrossWeb EX.
• Inspect memory processes for signs of shellcode injection or unexpected execution of Windows binaries like fsquirt.exe.
• Review GitHub Pages hosting for embedded JavaScript that loads resources from external domains.
• Validate that endpoint detection tools can identify modular backdoors that operate primarily in memory.

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What encryption standard did Lazarus use in this campaign?

The group used the ML-KEM post-quantum cryptographic mechanism to secure command-and-control communications.

Which software did the attackers abuse to gain access?

They abused INISAFE CrossWeb EX, a financial security tool used for accessing banking and government services.

When did this campaign start?

Kaspersky researchers traced the earliest evidence of the operation to July 2025.