Kaspersky identified the campaign, named Operation FlashHole, at its Security Analyst Summit in Bali on Wednesday. Its investigation established that at least three organisations in software development, construction and wired communications equipment manufacturing had been affected. The earliest evidence dates to July 2025, although the full extent of the operation remains unknown.
Researchers attributed the activity to the Lazarus Group with medium-to-high confidence, citing similarities with an earlier operation, shared malware and related infection methods. The assessment identifies technical connections rather than independent confirmation of who directed individual attacks.
A distinguishing feature is the use of ML-KEM-1024, a standardised post-quantum key encapsulation mechanism, within an updated version of Lazarus malware called LPEClient. The technology is designed to establish secrets resistant to attacks by sufficiently powerful quantum computers, but the hackers deployed it to protect exchanges with their command servers and obscure subsequent malicious payloads.
Kaspersky found that LPEClient obtained four public keys from an attacker-controlled server and generated corresponding shared secrets. Those secrets supplied encryption material used to decrypt further instructions and an executable payload. The final malware, a modular backdoor known as Cubridge, was loaded directly into computer memory rather than installed as a conventional executable file.
The approach complicates detection because security systems cannot rely exclusively on inspecting files stored on compromised machines. Kaspersky also documented attempts to interfere with monitoring mechanisms and alter memory protections, enabling suspicious processes to operate with less scrutiny.
Initial access involved carefully targeted phishing emails directing recipients to fabricated professional websites. The pages purported to contain résumés or work portfolios relevant to their intended visitors. One impersonated a senior network-appliance developer and displayed an artificial intelligence-generated portrait, while researchers suspect AI also helped tailor other deceptive content.
The infection sequence appeared to exploit INISAFE CrossWeb EX, software used for authentication and financial transactions in South Korea. Researchers identified malicious activity associated with the programme but said the precise exploitation mechanism was not conclusively established. They pointed to a potential vulnerability rather than claiming to have demonstrated every step of the initial compromise.
Once execution began, the attackers combined established Lazarus tools with previously undocumented components called TouchHub and ClientHub. These enabled additional malware deployment, command execution and communication with external infrastructure. The updated LPEClient gathered information about security products, Windows protections and other system characteristics before encrypting and transmitting the collected details.
The campaign also used GitHub infrastructure for communications, disguising attacker-controlled repositories as ordinary software projects. Investigators found an account created in September 2025 that hosted a deceptive professional profile and was associated with command-and-control activity. Some compromised legitimate websites were used for communications, while one ClientHub variant relied on Dropbox.
Kaspersky senior security researcher Sojun Ryu said the findings indicated Lazarus had incorporated cryptography intended to withstand future quantum threats earlier than might be expected. Investigators traced comparable capabilities in the group’s tooling to at least September 2024, predating the public disclosure of FlashHole by more than two years.
The discovery follows Operation SyncHole, another campaign targeting South Korean organisations through combinations of compromised websites and locally deployed security software. Kaspersky places both within a wider cluster it calls Cascade Hole, although it cautions that the connection rests on its technical assessment.
Researchers identified overlapping targeting of the software sector across both operations, raising concerns about access to proprietary code and the possibility of further compromises. They did not publish a confirmed total of stolen information or establish that every organisation exposed to the malicious websites had been infected.
The technical investigation also identified Cubridge functions for executing commands, managing files, collecting system information and capturing screenshots. Other associated components targeted browser credentials, cookies and browsing history. Although much of the malicious code executed in memory, some persistence mechanisms still created files on infected computers.
The investigation distinguished the espionage activity from other financially motivated operations associated with North Korean threat actors. Kaspersky described FlashHole as focused on intelligence collection, while acknowledging that the available evidence could not establish the attackers’ complete objectives. Its published technical indicators include infrastructure and malware characteristics intended to help defenders investigate suspicious activity. The affected organisations were not publicly named in the disclosure.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
