Kaspersky GReAT researchers identified a new cyberespionage campaign dubbed Operation FlashHole, attributed to the Lazarus group. Active since at least July 2025, the campaign has targeted at least three organizations in South Korea across the construction, software development, and telecommunications equipment manufacturing sectors.
The attackers utilize spear-phishing emails containing links to fraudulent websites hosting fake resumes. These sites are often hosted on GitHub Pages. Evidence suggests the group employs artificial intelligence to generate realistic profile photos and tailor these malicious sites to specific targets.
The infection process likely exploits vulnerabilities in CrossWeb EX, a legitimate security software widely used in South Korea for financial and government web authentication. Once inside, the attackers deploy new malicious components known as TouchHub and ClientHub to execute commands and install further malware.
The campaign features an updated version of the LPEClient tool, which now incorporates the ML-KEM-1024 post-quantum cryptographic mechanism. This allows the malware to establish encrypted connections with command-and-control servers, protecting communications against future quantum computing threats.
According to Kaspersky, Lazarus has been utilizing these post-quantum encryption methods since at least September 2024. The group continues to refine its tactics by integrating AI for social engineering and enhancing its existing toolset to bypass security monitoring systems.
