Operation FlashHole: Kaspersky Attributes Campaign to Lazarus Group
Kaspersky described the targeted Operation FlashHole campaign against organizations in South Korea. According to the company, the LPEClient malware used the post-quantum ML-KEM-1024 mechanism before delivering additional payloads.
Operation FlashHole is the name of a campaign that Kaspersky attributed to the Lazarus group on October 21, 2026, with a medium to high degree of confidence. Researchers documented at least three affected organizations in South Korea: from the software, construction, and cable-communications equipment manufacturing sectors.
The updated LPEClient malware attracted particular attention. According to Kaspersky’s analysis, it used ML-KEM-1024 to establish an encrypted connection with a command-and-control server before downloading and executing additional malware directly in the device’s memory.
Operation FlashHole and ML-KEM-1024
ML-KEM is a key encapsulation mechanism standardized by the National Institute of Standards and Technology in the NIST FIPS 203 standard. It is among the post-quantum cryptographic mechanisms—designs intended for an environment in which quantum computers could be used. The ML-KEM-1024 parameter represents a variant intended for a higher level of security.
In this case, however, this is not evidence that the attackers possess practical quantum capabilities, nor confirmation that they protect all their communications with this technology. Kaspersky’s finding instead indicates that standardized post-quantum cryptography is also available to malware developers and can be part of communications with command-and-control infrastructure.
Such encryption can complicate network analysis of communications between an infected device and the attacker’s server. The confirmed scope to date includes at least three targeted organizations, so this is not a confirmed widespread campaign against ordinary users.
Phishing, CrossWeb EX, and Executing Additional Code
According to Kaspersky, the attack chain included spear-phishing messages and lures in the form of fake résumés or portfolios. Researchers also observed the abuse of legitimate CrossWeb EX software in the campaign. The exact method of abuse has not yet been clarified: Kaspersky indicates a possible connection to a vulnerability but has not confirmed the exploitation of a specific CVE.
After establishing the encrypted connection, LPEClient allegedly downloaded additional components and executed them in memory. Kaspersky also listed DLL side-loading among the relevant techniques, in which a legitimate program may load a malicious dynamic library.
For administrators and security teams, the key elements are therefore practical indicators of the attack chain: phishing attachments and documents posing as career materials, suspicious processes related to CrossWeb EX, signs of DLL side-loading, and unusual communications with GitHub, Dropbox, or compromised websites. Kaspersky also published detection labels for its own security products.
Attribution and Next Steps
Attributing the campaign to the Lazarus group is not confirmation by a government authority or the attackers themselves. Kaspersky bases the attribution on technical overlaps and its own assessment, so independent confirmation of the attribution and the full scope of the incidents remains relevant.
Further information may concern, in particular, the specific vulnerability or mechanism associated with CrossWeb EX. It is important to monitor whether the product’s vendor, South Korean authorities, or Kaspersky issue a fix or security advisory. Organizations using this software may verify whether its components are actually needed, apply available updates, and monitor the communication channels mentioned above.
Sources
- Kaspersky Securelist – Technical analysis of Operation FlashHole, the scope of affected sectors, the attack chain, attribution with medium to high confidence, and a description of the malware.
- Kaspersky – Confirms the researchers’ claim that LPEClient uses ML-KEM-1024 before downloading and executing additional malware in memory, and provides recommended mitigations.
- NIST FIPS 203 – Explains that ML-KEM is a standardized post-quantum key encapsulation mechanism and that ML-KEM-1024 is its parameter with the highest stated security strength.
- BleepingComputer – Independently relays Kaspersky’s findings on the use of post-quantum cryptography in payload delivery.
Verified and updated: October 21, 2026 22:55
