The Lazarus Group is conducting a cyberespionage campaign dubbed Operation FlashHole, which has been active since at least July 2025. Kaspersky researchers identified attacks against three organizations in South Korea, spanning the construction, software development, and telecommunications equipment sectors.
The attackers utilize AI-generated imagery for fake job applicant profiles hosted on platforms like GitHub Pages. They also leverage CrossWeb EX, a legitimate financial authentication software, to gain unauthorized access to target systems. Two new malicious tools, TouchHub and ClientHub, were discovered to facilitate command execution and malware deployment.
A significant development is the use of the ML-KEM-1024 post-quantum key exchange mechanism within the updated LPEClient tool. This allows the malware to establish encrypted communication channels resistant to future quantum computing threats. Kaspersky notes that the group has been employing post-quantum cryptography since at least September 2024.
