A technology built to protect the world's data from future quantum-computing threats is now being used to shield malicious code from detection. Kaspersky researchers have found that the North Korea-linked Lazarus group has woven a NIST-standardized post-quantum encryption algorithm into an active espionage campaign against South Korean companies, marking what appears to be the first documented case of a state-backed hacking operation deploying this class of cryptography for offensive purposes.
A campaign built on trusted software
The operation, which Kaspersky calls FlashHole, has been running since July 2025 and has already compromised at least three South Korean organizations in the software, construction, and wired communications equipment sectors. Researchers believe the real number of victims is considerably higher. The intrusion begins with phishing messages that lead targets to convincingly staged GitHub pages, which quietly load JavaScript from external servers and trigger a chain of execution that unfolds almost entirely in a computer's memory, leaving little trace on disk.
Notably, the attackers abuse INISAFE CrossWeb EX, a security plug-in widely deployed across South Korean government and corporate networks. By hijacking a process belonging to this trusted tool, the malware launches a legitimate Windows utility, fsquirt.exe, and uses it to run shellcode. That shellcode installs a downloader named TechHub, which then pulls additional malicious components from private GitHub repositories, keeping the most damaging payloads off public infrastructure and out of easy reach of defenders.
Why post-quantum cryptography matters here
The centerpiece of the campaign is LPEClient, a malware strain long associated with Lazarus operations. In this iteration, LPEClient receives public keys generated with ML-KEM-1024, an algorithm that NIST formally standardized as part of its post-quantum cryptography initiative. ML-KEM was designed to protect ordinary internet traffic, financial transactions, and government communications against "harvest now, decrypt later" attacks, in which adversaries collect encrypted data today in anticipation of breaking it once quantum computers become powerful enough.
Lazarus has repurposed that same mechanism for concealment rather than protection. The malware uses the received public keys to generate shared secrets and ciphertexts, encrypts the ciphertexts with the GOST algorithm, and transmits them back to the attackers through a newly identified loader called ClientHub, which communicates over Dropbox rather than a conventional command-and-control server. The resulting shared secrets then feed into Threefish, a symmetric cipher, to decrypt the final payload. This layered combination of a post-quantum key exchange, a Russian-origin block cipher, and a lesser-known symmetric algorithm makes the traffic extremely difficult for conventional security tools to inspect or flag as suspicious.
What the final payload does
Once decrypted, the payload installs Cubridge, a modular backdoor capable of managing files, executing commands, performing reconnaissance, capturing screenshots, and retrieving further malicious modules. LPEClient loads Cubridge directly into memory using reflective loading, a technique that avoids writing the executable to disk and thereby sidesteps many antivirus and endpoint detection products. Kaspersky also observed companion tools designed to harvest saved passwords, cookies, and browsing history from Chromium-based browsers, suggesting the campaign's goals extend beyond initial access toward sustained credential theft and lateral movement within compromised networks.
A warning sign for defenders
The episode illustrates a familiar pattern in cybersecurity: defensive technologies rarely stay confined to defensive uses for long. Post-quantum algorithms are still in early deployment across browsers, messaging apps, and virtual private networks, where they are meant to future-proof encrypted communications. Seeing them appear inside a live espionage toolkit this early signals that advanced threat actors are already experimenting with emerging cryptographic standards, not to protect users, but to outpace the detection methods built around older, more familiar encryption schemes. For organizations relying on widely used but narrowly distributed security software, the FlashHole campaign is also a reminder that trusted local tools can become the weakest link if attackers find a way to abuse their processes.
