- Kaspersky links a new spy campaign called Operation FlashHole to North Korea’s Lazarus Group.
- Hackers reportedly abused real banking security software and GitHub-hosted websites, keeping much of the attack in memory.
- The malware uses ML-KEM-1024, a post-quantum tool, to protect the delivery of later malware.
Hackers linked to North Korea’s Lazarus Group have started a new spy campaign in South Korea. Researchers named it Operation FlashHole. The attackers use targeted phishing emails, GitHub-hosted websites, and post-quantum cryptography to stay hidden. This is a new kind of code lock built to resist future quantum computers.
According to the security firm Kaspersky, the activity dates back to at least July 2025. It has hit at least three organizations in South Korea. They work in software, construction, and wired communication equipment manufacturing. Kaspersky published its findings on October 21, 2026.
The report says FlashHole builds on Operation SyncHole, another Lazarus-linked campaign that targeted South Korean industries. Researchers also found new malware and big changes to the group’s older tools. However, they have not proven how the attackers got in during every FlashHole case.
South Korea is also pursuing domestic AI cybersecurity capabilities following US export restrictions, reflecting its broader focus on strengthening its cybersecurity defenses.
Lazarus Abuses Banking Security Software to Reach Targets
Operation SyncHole abused a program called iniLINE Cross EX. Operation FlashHole involves the suspected abuse of INISAFE CrossWeb EX, made by INITECH. People in South Korea use this financial security tool to reach banking and government websites.
Kaspersky found signs that the attackers sent chosen victims to fake websites. They used spear-phishing emails, which are messages written for specific targets. Some sites copied résumé pages or interior design portfolios. These themes matched the people the hackers wanted to reach. One résumé page also had a photo that researchers suspected was made by AI.
Researchers believe that visiting these sites could start an infection linked to CrossWeb EX. Still, they could not prove exactly how the infection began.
The suspected attack chain starts a real Windows program named fsquirt.exe. The attackers abuse it through DLL sideloading, a trick that makes a trusted program run bad code. That bad code is a downloader called TechHub. TechHub then pulls more malware through GitHub. This helps the attackers hide inside normal online services.
Much of the early attack runs only in the computer’s memory. That leaves fewer traces on the disk and makes investigations harder.
Kaspersky’s findings also match a wider pattern of Lazarus attacks on South Korean financial security software. A separate joint advisory from July 2026 described related activity. It involved weak financial security programs and backdoors named SIGNBT 3.0 and COPPERHEDGE. Experts tracked that activity as Operation Double Barrel. It is not the same as FlashHole.
New Malware Tools Give the Attackers More Spying Power
The investigation found several malware parts that work together. They keep the attackers inside the system, study infected devices, and deliver more malware.
TechHub works as the first downloader. It uses GitHub repositories to fetch more malware and collect details about infected devices. TouchHub and TouchShift help the malware stay on the system. ClientHub gives the attackers another way to send and receive commands. Kaspersky found two versions of it. One talks over HTTPS, and the other uses the Dropbox API.
Another part, called Cubridge, acts as the central controller of the framework. It can download plugins and modules, run commands, and collect files. It also takes screenshots and steals browser data, including saved logins and cookies. The attackers also use LPEClient, a long-used Lazarus tool. It profiles victims and delivers extra malware.
Together, these parts form an attack chain with many stages. After getting into a target, the attackers can add new abilities.
Post-Quantum Code Now Protects the Malware Deliveries
One of the biggest findings is the use of ML-KEM-1024. It is a post-quantum tool that helps two sides create shared secrets. The US National Institute of Standards and Technology (NIST) approved it as a standard.
Kaspersky found that the updated LPEClient gets ML-KEM-1024 public keys from the attackers’ servers. It uses them to make shared secret keys. These keys help protect the exchange and delivery of later malware.
Experts designed ML-KEM to resist attacks from both normal computers and strong enough quantum computers. Its use in Lazarus-linked malware shows the group is adopting methods meant to survive future quantum threats.
According to Kaspersky’s announcement, the group used this technology in its malware communications as early as September 2024. So the ability existed before the public report on FlashHole. The malware itself is not powered by quantum computers. The attackers only use post-quantum cryptography to protect their messages and malware delivery.
Kaspersky assesses with medium-to-high confidence that FlashHole belongs to the wider Cascade Hole campaign. It also shares responsibility with the actor behind Operation SyncHole. Researchers expect attacks on South Korean security software to continue while people still use these programs.
Kaspersky advises defenders to patch financial security software. They should also watch for odd activity from legitimate Windows programs. Suspicious links to GitHub Pages and other trusted platforms need a close look. Organizations should investigate unexpected outbound connections and suspicious in-memory activity.
Share this article
About the Author
Farwa is an experienced InfoSec writer and cybersecurity journalist skilled in writing articles related to cybersecurity, AI, DevOps, Big Data, Cloud security, VPNs, IAM, and Cloud Computing. Also a contributor on Tripwire.com, Infosecurity Magazine, Security Boulevard, DevOps.com, and CPO Magazine.
More from Farwa SajjadRelated Posts
Signal, Windscribe Threaten Exit Over Canada’s Six-Month Metadata Rules
Bill C-22 of Canada demands that telecoms and messaging applications retain the metadata of all of t...
Hacker Claims Nearly 208,000 OpenRouter API Keys Are for Sale
A malicious individual has announced he is selling an OpenRouter database containing nearly 250,000 ...
Thousands of Websites Used to Deliver Coruna and DarkSword iPhone Spyware
Researchers found a campaign called DeadTag that abuses abandoned ad and analytics domains to send v...
PHP Warns of New Potential RCE Flaw, Recommends Disabling Upload Progress
PHP has disclosed CVE-2026-115560, a possible remote code execution flaw that affects apps with an u...
Google and Other Tech Giants Block eMudhra Certificates After Weak Keys Exposed
Researchers cracked eight very weak secret keys tied to Indian certificate company eMudhra within se...
Microsoft Admits Windows 11 October Updates Failed to Fix Always On VPN Bug
Microsoft says its October 2026 Windows 11 updates did not fix the Always On VPN connection bug. The...
