Key points
- Lazarus Group attackers used post-quantum cryptography to secure malware delivery in new operations targeting South Korean organizations.
- The campaign, named FlashHole by Kaspersky, began in July 2025 and utilized phishing pages that linked to malicious GitHub repositories.
- At least three South Korean companies in software, construction, and communications sectors were identified as victims of this infection chain.
The short version
- North Korean state-sponsored hackers are deploying a new operation that combines legacy malware with post-quantum cryptographic techniques for payload encryption.
- The attack chain abuses a popular South Korean security tool, INISAFE CrossWeb EX, to execute shellcode that installs additional malicious software components.
- Researchers attribute the campaign to the Lazarus Group and note the use of NIST-approved ML-KEM standards to protect command-and-control communications.
The details
Kaspersky researchers identified a campaign dubbed FlashHole, attributing it to the Lazarus Group. According to BleepingComputer, the operation targets South Korean entities using a complex infection vector. The attackers started these efforts in July 2025. They directed victims to phishing pages that loaded JavaScript from external domains. This code triggered an in-memory execution chain involving INISAFE CrossWeb EX, a security application widely used in South Korea.
That legitimate process executed fsquirt.exe, a Windows binary, which ran shellcode to install TechHub. TechHub acted as a downloader, retrieving further malware from private GitHub repositories. Kaspersky confirmed at least three affected companies across software, construction, and wired communication equipment manufacturing sectors, though more organizations may be compromised.
The context
The operation introduces several new tools alongside known Lazarus malware. ClientHub serves as a loader supporting Dropbox communications and direct data exchange with LPEClient. LPEClient, previously linked to Lazarus, profiles victims and receives encrypted payloads via ClientHub. This malware also evades security monitoring.
Another component, Cubridge, is a modular backdoor offering file management, command execution, and reconnaissance features. It can capture screenshots and load additional payloads. Most of the code runs in memory, though some persistence mechanisms leave files on disk. Notably, the group uses ML-KEM-1024 public keys to generate shared keys for decrypting incoming payloads.
What should you do?
- Monitor network traffic for unusual connections to GitHub or Dropbox domains that do not align with business operations.
- Verify the integrity of security tools like INISAFE CrossWeb EX to ensure they are not being abused for execution.
- Review logs for the presence of fsquirt.exe or unexpected shellcode activity on endpoints within your infrastructure.
For customers and users
Organizations should verify that all software updates are applied to their security and development tools. Teams usually recommend reviewing access logs for any unauthorized changes to repositories or configuration files. Check whether employees have recently visited suspicious links or downloaded files from unexpected sources. Look for signs of unusual system behavior, such as high CPU usage or unexpected network connections. Be wary of follow-up emails claiming to resolve the issue, as attackers often exploit confusion to steal credentials. Report any anomalies to your security team immediately.
Background: Malware
No, they are not the same. A virus is a specific subset of malware that attaches to host files and requires execution to spread. Malware is the umbrella term for all malicious software, including worms, trojans, and spyware. Understanding this distinction dictates whether you focus on file integrity or network isolation.
Read the full guide: Is Malware and Virus the Same? A Technical Breakdown
What to do and how to stay safe: Lazarus Group
- Audit GitHub repository access to ensure no private repositories have been compromised or used for hosting malicious payloads.
- Inspect endpoints for the presence of LPEClient, ClientHub, TechHub, or Cubridge binaries and associated memory-resident processes.
- Validate the integrity of the INISAFE CrossWeb EX installation and related Windows binaries like fsquirt.exe on affected systems.
- Implement strict monitoring for outbound traffic to Dropbox and GitHub, especially when initiated by non-standard applications.
General security guidance from the DataSafe Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which threat actor is behind the FlashHole campaign?
Kaspersky attributes the operation to the Lazarus Group, a North Korean state-sponsored hacking organization.
What cryptographic mechanism is Lazarus using in this attack?
The attackers use the ML-KEM-1024 post-quantum cryptographic mechanism to secure payload delivery and command-and-control communications.
Which sectors in South Korea were affected?
Kaspersky identified victims in the software, construction, and wired communication equipment manufacturing sectors.
