“The use of post-quantum cryptography shows that the group intends to hide subsequent payloads,” Kaspersky says.
ML‑KEM post‑quantum cryptography in active malware delivery
Kaspersky's technical analysis of the campaign reveals an uncommon use of standardized post‑quantum cryptography inside a live malware delivery chain. The attackers embedded ML‑KEM—specifically ML‑KEM‑1024, a NIST‑approved mechanism—into LPEClient's communications with its command‑and‑control (C2) infrastructure. Kaspersky reports that LPEClient obtained from the C2 "a byte array comprising four 1,568‑byte blocks," each block containing an ML‑KEM‑1024 public key.
From those blocks LPEClient generated four distinct shared key/ciphertext pairs, then encrypted the ciphertexts with the GOST algorithm and sent them back to the C2 via ClientHub. The derived shared secrets provided key material for Threefish, which decrypted the C2 response containing parameters and an executable payload. The final, reflectively loaded payload identified by Kaspersky was Cubridge.
Kaspersky emphasizes the broader meaning of that design choice: ML‑KEM is a NIST‑approved standard already present in multiple software projects as a defense against “hack now decrypt later” attacks, and here it is being repurposed to protect malicious payloads during transmission.
From phishing to in‑memory execution: the FlashHole infection chain
Kaspersky has dubbed the operation FlashHole and traced the activity back to July 2025. The adversaries began with phishing pages that directed targets to specially crafted GitHub pages. Those GitHub pages loaded JavaScript from external domains and kicked off an entirely in‑memory execution chain.
That chain involved INISAFE CrossWeb EX, a security tool widely used in South Korea. The security tool’s process executed the legitimate Windows binary fsquirt.exe, which was used to run shellcode that installed TechHub, a downloader that retrieved additional malware from private GitHub repositories. Kaspersky notes that most of the malicious code runs in memory, although persistence mechanisms left some files on disk.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleWho does what: LPEClient, ClientHub, TechHub and Cubridge
Kaspersky mapped the roles of multiple tools used in the campaign. LPEClient—previously associated with the Lazarus Group—acts as the key handling and profiling component: it profiles victims, receives encrypted payloads through ClientHub, and is designed to evade security monitoring. ClientHub is a loader that supports Dropbox communications as well as direct data exchange with LPEClient, and Kaspersky observed it transmitting the GOST‑encrypted ciphertexts back to the C2.
TechHub functions as a downloader, fetching additional modules from private GitHub repositories. The eventual backdoor, Cubridge, is modular: Kaspersky observed file management, command execution, reconnaissance, screenshot capture, and the ability to load additional payloads. Separately, researchers saw additional tools targeting Chromium‑based browsers for account credentials, cookies, and browsing history.
Targets in South Korea and ties to Cascade Hole activity
Kaspersky identified at least three victims in South Korea across the software, construction, and wired communication equipment manufacturing sectors, and the company suspects many more organizations were affected. Kaspersky places FlashHole within a broader Cascade Hole activity cluster and links it to an earlier Operation SyncHole with medium‑to‑high confidence.
That linkage frames FlashHole as one strand of a larger operational pattern: the use of memory‑centric execution, modular backdoors, credential theft, and now post‑quantum mechanisms to protect payloads in transit.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: Kaspersky’s findings underscore two detection challenges—an in‑memory execution chain using legitimate processes (INISAFE CrossWeb EX and fsquirt.exe) and encrypted payload exchanges leveraging ML‑KEM and layered algorithms (GOST and Threefish). These combined techniques are engineered to reduce visibility and raise the cost of forensic recovery.
- Policymakers and standards observers: ML‑KEM is a NIST‑approved mechanism present in multiple software projects as a defense against long‑term decryption risks. Its appearance inside a malware delivery pipeline raises questions about how defensive standards and cryptographic primitives might be abused by threat actors to protect illicit traffic.
- Affected enterprises and procurement leaders: Kaspersky found at least three South Korean firms affected and warned that many more could be compromised. The Blue Report 2026, cited by Kaspersky, further illustrates a practical concern: "Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply." The Blue Report 2026 measures defenses technique‑by‑technique across 338 million simulations in customer environments.
Kaspersky’s analysis of FlashHole presents a clear, if unsettling, technical lesson: adversaries are adopting sophisticated, standards‑grade cryptography inside memory‑first malware chains to minimize detection and protect malicious payloads in transit. Kaspersky’s linkage to Cascade Hole and SyncHole, the July 2025 start date, the specific ML‑KEM‑1024 implementation details, and the modular toolset (LPEClient, ClientHub, TechHub, Cubridge) together map a methodical campaign that extends beyond a single exploit to an operational model—one that will leave defenders asking how many more victims remain undiscovered.
