Researchers at the cybersecurity firm Kaspersky have detected a sophisticated and unprecedented technical method in a cyberattack campaign they have dubbed FlashHole, attributed to the North Korean hacking group known as Lazarus Group. This campaign targets organizations in South Korea, where the attackers use the ML-KEM standard encryption algorithm (formerly known as Kyber) to secure communication with their Command and Control (C2) servers.
Complex attack mechanism
The campaign relies on a complex infection chain that begins with phishing pages directing victims to specially prepared GitHub repositories. These pages load JavaScript code that triggers a series of commands in the device's memory, exploiting a common security tool in South Korea called INISAFE CrossWeb EX. Through this tool, a legitimate Windows system file (fsquirt.exe) is executed to run code that installs a downloader called TechHub, which is responsible for fetching additional malware from private GitHub repositories.
Why this news matters
The use of Post-Quantum Cryptography in malware attacks is a notable development. While standards like ML-KEM were designed to protect data from "harvest now, decrypt later" attacks, the attackers have leveraged this technology to hide their malicious payloads from security monitoring systems. The LPEClient malware exchanges public keys with the attackers' server to generate shared keys, allowing for the secure and covert decryption of incoming payloads.
Additional tools in the Lazarus arsenal
In addition to advanced encryption, the campaign uses other tools including:
- ClientHub: A downloader that supports communication via the Dropbox service and direct data exchange with LPEClient.
- Cubridge: A modular backdoor that provides file management, command execution, and reconnaissance capabilities, as well as screen capturing.
- Data theft tools: Software targeting Chromium-based web browsers to steal credentials, cookies, and browsing history.
Analyses indicate that most of the Lazarus code in this operation runs in-memory to minimize the digital footprint, although there are some persistence mechanisms that leave files on the victim's hard drive. Kaspersky links this operation to a broader activity known as Cascade Hole, confirming the group's continued development of its tactics to bypass traditional security defenses.