MediumII Cyber Warfare & Critical Infrastructure21 October 2026, Wednesday
Lazarus adopts post-quantum encryption in South Korean attacks
Kaspersky's FlashHole report, published on 21 October, says the North Korea-linked Lazarus group hit at least 3 South Korean companies through mandatory banking security software. The payloads were protected with ML-KEM-1024.
According to the report on Kaspersky's Securelist site, the FlashHole campaign began in July 2025. It hit at least 3 South Korean companies making software, construction products and wired communications equipment. Kaspersky says it is confident that many more organisations were affected but cannot give a number. It attributes the campaign to Lazarus with medium-high confidence, as the same actor behind the earlier SyncHole operation.
The entry point is not a supplier breach but INISAFE CrossWeb EX, software that South Korea requires for online banking. Phishing pages steer victims to fake pages on GitHub. An in-memory chain then uses that software's process to trigger fsquirt.exe, a legitimate Windows file. The final payload is Cubridge, a modular backdoor that can manage files, run commands and take screenshots.
The report's new finding concerns encryption. BleepingComputer reported on 21 October that a tool called LPEClient fetches 4 ML-KEM-1024 public keys of 1,568 bytes each from its command server. ML-KEM is the key-exchange standard that the US National Institute of Standards and Technology (NIST) regards as resistant to quantum computers. Kaspersky notes that the group adopted the standard faster than many legitimate security products.
The timing is also striking. Kaspersky says the South Korean government and security firms issued a joint advisory on Lazarus techniques in July 2026. A plan to phase out mandatory security software begins in 2026. The attackers are therefore exploiting a layer that is due for removal but still runs in the background on users' computers in 2026.
Talay assessment
Bottom line
FlashHole shows two things at once. Lazarus is turning security software that South Korea makes mandatory into an attack surface, and it is hiding payload delivery behind a post-quantum standard. That erodes the value of defences built on network traffic inspection and shifts the detection burden to endpoint and memory analysis. The most likely path is the campaign running until the mandatory software is removed in 2026.
Likely effects
- Korean defence and supply chainNegative1–6 months
Victims include a maker of wired communications equipment; a Lazarus foothold in communications and software suppliers raises the risk of spillover to larger customers.
- Traffic-based detectionNegative1–6 months
Payloads protected by 4 ML-KEM-1024 keys effectively blind network security products that decrypt and inspect encrypted traffic.
- Mandatory software policyPositive6 months+
An attack running through INISAFE CrossWeb EX strengthens the case for accelerating the removal plan that starts in 2026.
Possibilities, ranked
- 1Campaign widens55%
New victims are found in sectors beyond software and communications, and Korean authorities issue further advisories.
Watch: A new advisory from the Korea Internet and Security Agency (KISA) on FlashHole or CrossWeb EX
- 2Removal plan accelerates30%
The government brings forward removal of mandatory security software and the attacker loses this entry point.
Watch: A Financial Services Commission notice to banks changing the timetable
- 3Group changes tactics15%
The infrastructure is abandoned after the report and the same actor launches a new campaign through different local software.
Watch: A new Lazarus campaign report from Kaspersky or Korean security firms
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Confirmed victim companies▲ At least 3
- ML-KEM public key block▲ 4 × 1,568 bytes