Kaspersky's Operation FlashHole Report, 21 October 2026: Lazarus Wraps LPEClient Payload Delivery in Four ML-KEM-1024 Key Exchanges Against South Korean Firms, TRL 9
Quentir Defense Monitor
Evidence-based insights for quantum defense and security. Published by Quentir Systems LLC · October 31, 2026.
On 21 October 2026, at its Security Analyst Summit in Bali, Kaspersky's Global Research and Analysis Team published Sojun Ryu's analysis of Operation FlashHole, a Lazarus Group espionage campaign that has hit at least three South Korean firms since July 2025. The claim a defense reader can check sits deep in the malware chain: the group's LPEClient profiling tool now receives four ML-KEM-1024 public keys from its operators, derives four shared secrets from them and assembles a 128-byte Threefish key that decrypts every payload it later loads into memory. Kaspersky's press release adds a date: the company traces the group's use of this post-quantum mechanism to at least September 2024, five weeks after NIST finalized the standard it is built on.
The sentence that will travel from the report is Kaspersky's own. "Ironically, the group seems to have adopted more secure post-quantum cryptography faster than many legitimate security products." For a security buyer the irony has a hard edge. It is a documented case of an adversary spending engineering effort on the shelf life of its own traffic, which is the harvest-now-decrypt-later problem read from the attacker's chair. This post sets out what the report establishes, how the mechanism works, why Quentir reads the posture as offensive, and what a defender can take from it.
What the Securelist report establishes: three South Korean victims since July 2025, INISAFE CrossWeb EX 3.4.1.2 as the launch point and a rebuilt LPEClient
Kaspersky dates the earliest evidence of FlashHole to July 2025, shortly after Operation SyncHole, the watering-hole campaign it disclosed in April 2025, had ended. The victims are at least three organizations in South Korea's software, construction and wired communication equipment manufacturing sectors, which differ from the ones SyncHole hit, and Kaspersky remains confident that a considerably larger number of organizations were affected.
The way in ran through a GitHub Pages site tied to a GitHub account created in September 2025. Its first version showed the résumé of a supposed senior network appliance developer, with a photograph Kaspersky believes was AI-generated, citing missing EXIF data and an unnatural texture. In January 2026 the site was swapped for an interior design showcase, probably aimed at the construction victim. Kaspersky assesses with medium-to-high confidence that targets received spear-phishing emails linking to these pages. What triggered the infection itself, the report could not determine.
What it could determine is where the malware ran. The spawned process ran at high integrity under INISAFECrossWebEXSvc.exe, part of INISAFE CrossWeb EX V3 version 3.4.1.2, a build released in 2023 after KrCERT's public advisory. CrossWeb EX is financial security software that South Korean users need for many banking and government sites, and Lazarus has abused it or its sibling Cross EX repeatedly since 2021. From there the chain runs through TechHub, a downloader that talks to GitHub with a personal access token; Cubridge, the orchestrator; TouchHub and TouchShift for persistence; and ClientHub, a new loader with an HTTP(S) variant and a Dropbox API variant, the first Lazarus Group tooling Kaspersky has seen use the SNOW 1.0 stream cipher.
LPEClient sits at the end of the chain. First seen in 2019, it no longer carries a hardcoded command server; it talks to its operators through a shared buffer with ClientHub. It profiles installed security products and Windows mitigations, now including the Shadow Stack status, and encrypts the report with GOST, the Russian national block cipher.
How the four ML-KEM-1024 exchanges and the 128-byte Threefish key work, and what Check Point saw in the same tool in August 2026
The key exchange follows the profiling step. The command server answers LPEClient with four 1,568-byte blocks, each an ML-KEM-1024 public key. ML-KEM is the module-lattice key encapsulation mechanism NIST standardized as FIPS 203 on 13 August 2024, derived from CRYSTALS-Kyber, and 1024 is the largest of its three parameter sets. LPEClient encapsulates against each key, producing four shared secrets and four ciphertexts, encrypts the ciphertexts with GOST and sends them back. The four shared secrets are joined into a 128-byte key for Threefish, the tweakable block cipher from the Skein hash function, with the tweak derived by XORing the session's unique identifier with the value 0xA5. The next payload arrives under that key, must exceed 4 kilobytes, must begin with the MZ header of a Windows executable, and is loaded straight into memory. Kaspersky's reading is plain: "The use of post-quantum cryptography shows that the group intends to hide subsequent payloads."
Check Point Research described the same construction on 11 August 2026, in a Dream Job wave against aerospace and defense firms in Europe and India, where a loader fetched four public keys from its server, ran a Kyber/ML-KEM exchange and used the result to deliver FudModule, the kernel rootkit that exploited CVE-2026-68820 in the Windows AFD.sys driver. Kaspersky now identifies that loader as LPEClient. Quentir read the Check Point report in August as a key exchange fitted to a zero-day. FlashHole shows the same cryptographic module in a campaign without a zero-day, delivered through a mandatory Korean security plugin, so the post-quantum layer belongs to the tool and travels with it from one operation to the next.
Why the developer chose the 1024 parameter set, the report does not say. The choice matches CNSA 2.0, the National Security Agency's algorithm suite for national security systems, whose TLS 1.3 profile requires ML-KEM-1024 for key establishment. An espionage tool from Pyongyang now negotiates its keys at the strength the United States mandates for its own national security networks.
Quantum pillar: post-quantum cryptography (harvest-now-decrypt-later exposure). Use posture: offensive. Technology readiness: TRL 9 of 9. The mechanism runs inside malware recovered from victim machines in South Korea and, per Check Point, in Europe and India, with use traced to September 2024, which is the ladder's top rung, documented use in the field by the adversary who built it, and the exposure it closes is the shelf life of the group's own captured traffic.
Why Quentir reads the posture as offensive and the pillar as harvest-now-decrypt-later exposure
The capability map behind this Monitor places post-quantum cryptography in the defensive column by default, because a migration protects one's own data. Here the direction reverses. The data protected is an intrusion tool's payload stream, and the party protected against is the defender. A national CERT, an internet provider or a security vendor that captures ClientHub traffic today holds ciphertext whose key was agreed under ML-KEM-1024 and wrapped in Threefish. With a classical key exchange, that archive would become readable the day a cryptographically relevant quantum computer runs Shor's algorithm against the stored handshake. With ML-KEM the archive stays closed. The group has spent engineering effort to deny forensic teams a future they have yet to reach, and that is offensive in the sense this lane uses: the value lies in acting against the adversary's systems, in this case the defender's capacity to recover payloads later.
What it lets a force do is narrow and real. A state intrusion unit that wraps its payload delivery this way can run a tool against a target for years and know that whatever the defenders capture on the wire will stay opaque even after a quantum computer arrives, which keeps the next-stage implants, and the vulnerabilities they exploit, out of reach of retrospective analysis. What a defender can stop is unchanged: payloads can still be recovered from memory on a compromised host, which is how Kaspersky recovered enough to publish. What changes is the long tail. Full-packet capture of command-and-control traffic has been a durable investment because keys leak, servers get seized and ciphers get broken. FlashHole's design removes the last of those three for the payload stream.
The irony Kaspersky draws also has a procurement reading. Many security products and government networks still negotiate keys with elliptic-curve Diffie-Hellman. NIST's Internal Report 8547, finalized on 27 October 2026, deprecates those curves after 2030 and disallows them after 2035. An adversary that moved in September 2024 holds a lead of six to eleven years on the organizations it attacks, measured by the calendar the defenders wrote for themselves.
What a defender and a program office take from the report, and what it does not show
Three limits belong next to the finding. The September 2024 date comes from Kaspersky's press release; the technical report's own timeline begins at July 2025 for FlashHole and 2019 for LPEClient, and the samples behind the earlier date are not public. The initial access step is unproven: how CrossWeb EX 3.4.1.2 came to spawn the malware, whether through a flaw in that build or abuse of a legitimate function, the report cannot say. And ML-KEM-1024 protects the confidentiality of the payload channel only. It does nothing against endpoint detection, and the chain was found. Kaspersky's attribution stands at medium-to-high confidence, and it places FlashHole as the latest wave of the Cascade Hole campaign that has used South Korean software as the entry point since 2021.
For a program office the practical items are these. Any requirement that assumes captured adversary traffic can be decrypted later, whether for attribution, damage assessment or legal process, should be reread against a threat actor that already uses FIPS 203 at its strongest setting. Network defense products that fingerprint command channels by their key-exchange parameters should expect post-quantum handshakes in malware traffic as a normal feature by 2027, since the module has now appeared in two campaigns on two continents within ten weeks. And the migration deadlines in IR 8547 and CNSA 2.0 gain a comparison point: South Korea is running its own post-quantum pilot across telecommunications, finance and defense this year, while the adversary's clock on the same algorithm family has been running since September 2024.
The Register entry for this development reads harvest now, decrypt later from the attacker's side: post-quantum cryptography, offensive posture, TRL 9, documented in the field. Three things would move it. Public samples confirming the September 2024 date would turn a vendor statement into checkable evidence. Disclosure of the CrossWeb EX vector would tell South Korean operators whether a patch or a configuration change closes the door. And a sighting of the same four-key construction in another actor's tooling would show whether this is one disciplined developer or a norm forming among state intrusion teams.
Sources
Primary source: Sojun Ryu (Kaspersky Global Research and Analysis Team), "Operation FlashHole: Lazarus breaks security, defies control," Securelist, 21 October 2026. Other material: Kaspersky press release of 21 October 2026; Check Point Research, "Shattering the Dream: When a Job Offer Becomes a Zero-Day Attack," 11 August 2026; NIST, FIPS 203, 13 August 2024; Becker and Jenkins, CNSA Suite 2.0 Profile for TLS 1.3, IETF Internet-Draft. The capability reading, the posture argument and the buyer items are Quentir analysis.