North Korean hackers use next-generation encryption to hide their malware

Hackers tied to North Korea have started using a very modern kind of encryption to hide the malware they send to victims. Security company Kaspersky calls the campaign FlashHole and links it to the Lazarus Group. The attacks hit South Korean companies, and the technique shows that good security tools can also help attackers.

What happened

Kaspersky says the attacks began in July 2025. It found at least three affected companies in South Korea, in software, construction, and wired communication equipment manufacturing. It suspects many more organizations were hit. The company places FlashHole within a wider activity it calls Cascade Hole and links it to an earlier operation, SyncHole, with medium-to-high confidence.

How the attack worked

The chain was described as rather complex. It started with phishing pages that sent targets to specially crafted GitHub pages. Those pages loaded code from outside websites and kicked off an attack that ran mostly in the computer's memory, which leaves fewer files behind for security software to find.

• The chain abused INISAFE CrossWeb EX, a security tool popular in South Korea.
• A genuine Windows file, fsquirt.exe, was used to run the attackers' code.
• A downloader called TechHub pulled more malware from private GitHub repositories.
• The final piece, Cubridge, can manage files, run commands, take screenshots and load more tools.

Why the encryption matters

The malware used ML-KEM, an encryption method approved by the US standards agency NIST. It is built to hold up against future quantum computers, and it is meant to stop attackers from stealing data now and unlocking it later. Here, the hackers used it to protect the harmful files they delivered. Kaspersky says this shows the group intends to hide its later payloads.

In plain terms, the malware received keys from the attackers' server, used them to build shared secret keys, and then unlocked the files sent back. Kaspersky believes this, together with running in memory, keeps the risk of detection as low as possible.

What to do

Nothing here asks ordinary users to change how they use encryption. The lesson is about habits. Keep software updated, and be careful with links that lead to unfamiliar pages, even when the page sits on a trusted site like GitHub. A familiar web address does not guarantee that the content is safe.