Lazarus FlashHole Uses Post-Quantum ML-KEM to Hide Windows Malware Payloads

What Kaspersky found​

Kaspersky's Global Research and Analysis Team presented the work at the Security Analyst Summit in Bali. The company says the campaign has been active since at least July 2025. It has identified at least three affected South Korean organizations, in software, construction and wired-communication equipment manufacturing. It suspects many more were hit but gives no total. Attribution and victim counts are Kaspersky's own assessments, not independently confirmed.

Kaspersky links FlashHole to the earlier Operation SyncHole with medium-to-high confidence. It places both within the broader Cascade Hole activity. Its reasoning rests on the initial vector, the targets, the multi-stage chain and the reuse of the LPEClient tool.

How the infection chain works​

The chain is long, and Kaspersky itself calls it rather complex. In rough order:

1. Lure. Targets are believed to receive spear-phishing emails linking to fake sites on GitHub Pages. One site was a résumé for a purported senior network-appliance developer. Another was an interior-design portfolio. Kaspersky says it could not pin down exactly what triggered each infection.
2. Abuse of local security software. Visiting the site likely started activity involving INISAFE CrossWeb EX, a financial-security and web-authentication product that South Korean users need for banking and government sites. Kaspersky says the exact abuse method remains unclear. The observed parent process was INISAFECrossWebEXSvc.exe from CrossWeb EX V3 version 3.4.1.2, released in 2023.
3. In-memory start. Under that process, the legitimate Windows binary fsquirt.exe was injected with shellcode containing TechHub, a downloader. Initially this stage exists only in memory.
4. Persistence. TechHub deploys TouchHub and TouchShift. TouchShift is loaded through DLL side-loading under the name mscoree.dll. A second TechHub instance then drops ClientHub and LPEClient. Kaspersky found only minimal traces on disk.
5. Final payload. LPEClient reflectively loads Cubridge, a modular backdoor, into memory.

The post-quantum part​

Kaspersky's technical report describes how the updated LPEClient prepares to receive payloads:

• It profiles the host and sends the data, encrypted with GOST (Magma), to the server through ClientHub.
• LPEClient obtains a byte array comprising four 1,568-byte blocks from the C2 response.
• Each block contains an ML-KEM-1024 public key, a NIST-standardized post-quantum key encapsulation mechanism derived from CRYSTALS-Kyber.
• From those blocks, LPEClient generates four shared-key and ciphertext pairs. It encrypts the ciphertexts with GOST and returns them under message ID 0xEF8C0D51.
• The four shared keys form a 256-byte key. The server's reply is decrypted with Threefish.
• The decrypted data must hold a length field, parameters and an executable. The executable must be larger than 4 KB and begin with MZ. It is then loaded reflectively into memory.

This is a custom key-establishment step inside a malware protocol. It is not a shield over victims' files, and it doesn't break any existing encryption. The practical effect is that anyone capturing the C2 traffic later will struggle to recover the payloads. That includes anyone who might, in future, hope to decrypt recorded traffic with a quantum computer. The "harvest now, decrypt later" threat that post-quantum standards address works against the attackers as well. For incident responders, a captured network trace may not be enough to reconstruct the second stage. Memory forensics matters more.

Kaspersky's wording is pointed. The group seems to have adopted more secure post-quantum cryptography faster than many legitimate security products. That is a vendor's observation, and a sharp one. Still, adopting a published standard through available libraries is a modest engineering task. It is not evidence of exotic capability. Kaspersky's press release says its findings trace the group's use of quantum-resistant cryptography back to at least September 2024.

The other tools​

• TechHub is a downloader. It talks to private GitHub repositories through the GitHub API using Personal Access Tokens. Earlier versions, tracked by Mandiant as CLOUDBURST and by ESET as NickelLoader, used HTTP(S) command-and-control instead. Kaspersky found three variants: in-memory, DLL side-loading, and side-loading with a registered Windows service.
• ClientHub is new. It is a loader that supports Dropbox communications as well as direct data exchange with LPEClient. Kaspersky assesses with medium-high confidence that it is an advanced version of CookiePlus. It also reports that ClientHub uses the SNOW stream cipher, which Kaspersky says is a first for Lazarus malware.
• LPEClient no longer embeds a C2 address and relays through ClientHub instead. It reads the Windows build revision (the UBR registry value, or a kernel structure on some builds). It also checks Kernel VA Shadow and Shadow Stack (CET) mitigation status. It reads the WMI repository file to identify antivirus products. Kaspersky also says it changes memory protections and disables a user-mode syscall instrumentation hook before loading its payload.
• TouchHub is a new installer for TouchShift. Kaspersky says it copies printfilterpipelinesvc.exe to C:\Windows\System32\RasConv\ImeBroker.exe. It registers a SYSTEM service with a name borrowed from a netsvcs service plus two random letters, and the description "Microsoft Service." It also copies timestamps to hinder forensics.
• Cubridge is the orchestrator. It is a modular backdoor with file management, command execution and reconnaissance capabilities. It also captures screenshots and loads more payloads. Kaspersky says other tools in the campaign steal credentials, cookies and history from Chromium-based browsers.

What Windows admins can do​

Kaspersky published no confirmed list of affected CrossWeb EX versions. Nor, in the sections reviewed, did it publish a ready-made indicator list. Treat the following as reasonable hardening drawn from the report, not a guaranteed detection recipe.

• Inventory regional security plugins. If your organization has South Korean users or staff, find CrossWeb EX and similar mandatory banking and authentication software. Keep it patched. Kaspersky notes that the exact abuse method is unclear, so patching alone doesn't prove you are safe.
• Watch for odd process lineage. fsquirt.exe, the Windows Bluetooth file-transfer binary, spawned by a CrossWeb EX service process is unusual. So are services named like svchost group entries but running ImeBroker.exe -TimeBroker from System32\RasConv.
• Hunt for side-loading. Look for mscoree.dll in unexpected directories.
• Scrutinize cloud services. Review outbound traffic to GitHub APIs and Dropbox from endpoints with no business reason for it. Be careful with GitHub: blocking it outright is rarely practical, so profile by process and host.
• Favor memory-aware EDR. Kaspersky lists detections for its own products as MEM:Trojan.Win64.Shellcode.gen, Trojan.Win64.DLLhijack.* and Trojan.Win64.Lazarus.*. Other vendors name these differently.
• Basics still apply. Kaspersky's advice is to train staff on targeted phishing, patch promptly, restrict privileges and monitor cloud services that could be abused for C2.

Caveats​

Kaspersky sells security products and its press release promotes them. The research itself is detailed, but the attribution is an assessment at medium-to-high confidence, not proof. The report also notes that vendors name these tools differently. Cubridge, for instance, overlaps with SIDESHOW and LightlessCan in other researchers' work.

The takeaway: the cryptography is the headline, but the Windows tradecraft is what you can defend against. The chain relies on a trusted local plugin, a legitimate Windows binary, side-loaded DLLs, SYSTEM services and cloud services used for C2. Those leave behavioral traces even when the payload traffic is unreadable.