Kaspersky has published details of Operation FlashHole, a North Korean Lazarus campaign against South Korean organizations that it says dates back to at least July 2025. The notable twist is the encryption: the group’s LPEClient malware received ML-KEM-1024 public keys from its command-and-control server (ML-KEM is a NIST-standardized post-quantum key-exchange scheme) and used them to derive the keys that decrypt each following payload. Kaspersky says this shows the group intends to hide its later-stage payloads, and remarks that the group seems to have adopted post-quantum cryptography faster than many legitimate security products.
According to Kaspersky, targets received spear-phishing emails linking to fabricated but plausible sites such as portfolio and résumé pages. The chain then ran in memory through INISAFE CrossWeb EX, a financial-security program required for many South Korean banking and government sites, which launched the legitimate Windows binary fsquirt.exe to run shellcode. That installed a downloader called TechHub, which fetches more malware from private GitHub repositories. Later stages include ClientHub (a loader that talks to Dropbox), LPEClient, which profiles the victim, and Cubridge, a modular backdoor with file management, command execution, reconnaissance and screenshot capture. Kaspersky also saw tools that steal credentials, cookies and history from Chromium-based browsers. It identified at least three victim companies in software, construction and wired-communication-equipment manufacturing, and suspects there are more. It says the exact way CrossWeb EX is abused is still unclear, and that a separate cluster, COPPERHEDGE, appears to be involved in monetizing attacks while FlashHole is aimed at espionage.
How to check if you’re affected
Affected products are Windows computers running INISAFE CrossWeb EX; Kaspersky saw the chain start from the process INISAFECrossWebEXSvc.exe in the V3 version 3.4.1.2 installation bundle, released in 2023 after a KrCERT advisory. If your organization runs it, ask your security team to:
- Look for the legitimate Windows binary fsquirt.exe being launched by INISAFECrossWebEXSvc.exe, the execution chain Kaspersky found. It saw the spawned process running at high integrity.
- Compare endpoint and network logs with the file hashes, file paths and command-and-control servers in the indicators section of Kaspersky’s Securelist report. Most of the code runs in memory, but the persistence mechanisms leave some files on disk.
- Check mail logs for emails linking to unfamiliar résumé or portfolio pages, the lure Kaspersky describes.
Kaspersky says its products detect the exploits and malware with the verdicts MEM:Trojan.Win64.Shellcode.gen, Trojan.Win64.DLLhijack.* and Trojan.Win64.Lazarus.*.