Operation FlashHole is a sophisticated cyberattack campaign launched by the Lazarus Group targeting South Korea. It exploits mandatory security software CrossWeb EX using watering hole attacks and spear-phishing with fake portfolio and resume websites. The campaign, active since July prior to January, targets sectors including software, construction, and cable equipment manufacturing. It employs a modular malware framework combining multiple malware families such as TechHub, Cubridge, TouchShift, TouchHub, ClientHub, and LPEClient. Techniques used include in-memory execution, DLL side-loading, and command-and-control infrastructure leveraging GitHub and Dropbox. The attackers also incorporate advanced cryptographic methods like post-quantum cryptography (ML-KEM-1024) and GOST encryption. This campaign demonstrates Lazarus Group's evolving tactics specifically tailored for South Korean targets.
A detailed technical analysis confirms that Kyber ransomware implements genuine hybrid post-quantum cryptography rather than mere branding. The Rust-based Windows variant encrypts files using AES-256-CTR with Kyber1024 and X25519 for key protection, appending a fixed 0x744-byte trailer containing encrypted metadata. Instrumented analysis validated the cryptographic implementation through fixture decryption but found no practical recovery path from the sample alone. The encryptor targets multiple file types, deploys standard recovery-inhibition techniques, and marks encrypted files with a .#~~~ extension. A separate ESXi variant was found to use different cryptography despite similar branding. As of April 2026, one victim was publicly listed: a large American defense contractor and IT services provider.
Signal has introduced Sparse Post-Quantum Ratchet (SPQR), a new cryptographic mechanism designed to enhance resistance against quantum computing attacks by integrating post-quantum key encapsulation with its existing double ratchet system. This hybrid 'Triple Ratchet' approach ensures forward secrecy and post-compromise security, with formal verification and continuous validation underpinning its implementation. The rollout will be gradual and backward compatible, requiring users only to keep their clients updated.