The Lazarus hacker group uses post-quantum cryptography to hide malware payloads. Kaspersky discovered this in Operation FlashHole, a campaign targeting South Korean companies that has been ongoing since July 2025. The attackers use the NIST standard ML-KEM-1024 to encrypt communications with their C2 servers.
The malware in question is LPEClient, long linked to Lazarus. It receives ML-KEM-1024 public keys from the command-and-control infrastructure and uses them to generate shared keys. The malware then uses these keys to decrypt subsequent payloads. Kaspersky has identified at least three affected companies in South Korea, operating in the software, construction, and wired communications equipment manufacturing sectors. However, the researchers say there are likely many more victims.
The choice of ML-KEM is striking. The mechanism is a NIST-approved standard used in various software projects to protect data against “hack now, decrypt later” attacks. Now, an attacker is using it to cover their own tracks.
From phishing to memory
The attack begins with phishing pages that direct victims to specially crafted GitHub pages. These pages load JavaScript from external domains, after which an execution chain begins in memory. INISAFE CrossWeb EX, a security tool widely used in South Korea, plays a role in this process. This tool’s process launches the legitimate Windows file fsquirt.exe, which executes shellcode. That shellcode installs TechHub, a downloader that fetches additional malware from private GitHub repositories.
Kaspersky also identified ClientHub, a new loader that communicates via Dropbox and exchanges data directly with LPEClient. LPEClient profiles victims, receives encrypted payloads via ClientHub, and evades security monitoring.
Technically, it is a layered system. LPEClient receives a byte array from the C2 server consisting of four blocks of 1,568 bytes, each containing an ML-KEM-1024 public key. From these, the malware generates four shared key pairs and ciphertexts. The ciphertexts are encrypted using the GOST algorithm and sent back via ClientHub. The shared secrets then provide key material for Threefish, which decrypts the response containing parameters and an executable payload.
That payload is Cubridge, a modular backdoor for file management, command execution, reconnaissance, screenshot capture, and loading additional payloads. LPEClient loads Cubridge reflectively into memory. Kaspersky also observed tools that steal login credentials, cookies, and browsing history from Chromium-based browsers. “The use of post-quantum cryptography shows that the group intends to hide subsequent payloads,” according to Kaspersky.
Tip: Data security is an illusion without a rock-solid IT foundation