A new cyberespionage operation dubbed Operation FlashHolehas been uncovered, attributed to the North Korea-linked Lazarus Group. The campaign, active since at least July 2025, has hit several South Korean firms in the software, construction, and wired communications equipment sectors. What sets FlashHole apart is its use of post-quantum cryptography and refined techniques to hide its malware deliveries.
From SyncHole to FlashHole: Swapping tactics and tools
FlashHole continues where its predecessor, Operation SyncHole (which ran from late 2024 into early 2025), left off. Both operations abuse mandatory South Korean financial security plug-ins—SyncHole exploited Cross EX software, while FlashHole leverages INISAFE CrossWeb EX—to breach systems. These plug-ins are required for users accessing banking or government services.
The entry begins with spear-phishing emails tailored to potential victims. They direct targets to decoy GitHub Pages sites posing as résumé or portfolio pages, sometimes featuring AI-generated photos. These lures load malicious scripts from external domains, which trigger a chain involving CrossWeb EX’s service process. In one stage, Windows’ legitimate fsquirt.exe binary is launched under that service, then injected with shellcode leading to a downloader known as TechHub.
Modular malware with new fibers: ML-KEM-1024 & evolving spyware
After initial compromise, FlashHole’s infection chain spins up several components—TouchHub installs the side-loader called TouchShift, which leverages DLL side-loading via an executable copied to a system directory. Then ClientHub connects to command-and-control channels (some variants even via Dropbox), and finally LPEClientstages the major payload, a backdoor called Cubridge, completely in memory so as to avoid disk detection.
What makes FlashHole particularly notable is the use of the post-quantum ML-KEM-1024 algorithm for encrypting communication between LPEClient and its C2 servers. LPEClient receives four public keys, each 1,568 bytes, encapsulates shared secrets, wrapping parts in GOST encryption, and then uses Threefish to decrypt the final stage containing Cubridge. This is one of the few observed cases of a threat actor using NIST-standardized post-quantum body methods to protect malware delivery.
Other tools in the toolkit have also been upgraded. The malware profiles the victim machine carefully—checking installed security software and system protections—then compresses and encrypts the data. Camera credentials, cookies, browsing history from Chromium-based browsers are also harvested. Many components execute only in memory and leave little trace on disk.
Strategic implications & risks
FlashHole is assessed with “medium-to-high confidence” to be linked to Lazarus and part of what’s being called the Cascade Hole campaign. While only three organizations have been confirmed compromised, the nature of the campaign—lures tailored to individuals, use of widely deployed plug-ins—suggests a broader footprint.
The deployment of ML-KEM-1024 is especially worrying for defenders. It implies that attackers are preparing for “record now, decrypt later” as a strategy—encrypting command channels so that future quantum computers cannot decrypt intercepted traffic. This adds a layer of stealth and forward secrecy beyond traditional malware obfuscation.
What’s still unresolved: exactly how CrossWeb EX is abused to kickstart the chain; whether the plug-in version used in these attacks contains a specific vulnerability; and how many total victims exist. No confirmed patch or advisory is published yet for all affected CrossWeb EX versions.
(Analysis) FlashHole shows Lazarus isn’t just adapting—it’s proactively integrating future-proof encryption and refined delivery techniques to stay ahead. For defenders, the shift underscores that relying solely on signature-based detection or classical threat models won’t suffice. Monitoring memory-only execution, scrutinizing the behavior of trusted plug-ins like CrossWeb EX, and preparing for post-quantum threats in C2 communication should become priorities. As quantum-secure crypto seeps into adversaries’ arsenals, security teams must pivot to see tactics and infrastructure, not just payloads, as where innovation is now happening.
