- Messages
- 4,009
- Likes
- 1,873
- Points
- 2,130
Kaspersky Lab researchers have discovered a new espionage campaign by the North Korean hacker group Lazarus, dubbed Operation FlashHole . In their attacks, the attackers employ customized phishing, legitimate security software, and an updated malware suite. Furthermore, researchers have identified signs of the hackers' use of generative AI and post-quantum cryptography.
The first attacks associated with Operation FlashHole were dated July 2025. The researchers write that they are aware of at least three affected organizations in South Korea: a software developer, a construction company, and a manufacturer of wired communications equipment. This campaign is a continuation of Lazarus' previous operation, SyncHole , and the group's primary goal remains cyberespionage.
Attacks typically begin with spearphishing emails containing links to fake resumes and portfolios tailored to specific recipients. One such resource was hosted on GitHub Pages, linked to a GitHub account used by the attackers as a command and control channel. The account was created in September 2025.
Initially, the site featured a resume supposedly for an experienced network equipment developer, with a photo generated by artificial intelligence. The site's content was later replaced with the portfolio of an interior designer, likely intended to target a construction company. Researchers believe the hackers use AI not only to generate the photo but also to create the decoys themselves, which they then manually tailor to the targeted organizations. It is noted that Lazarus actors have long used similar fake job postings and resumes as part of the Dream Job campaign. After visiting the malicious site, CrossWeb EX—legitimate financial security software required to access popular online banking and government services in South Korea—is presumably activated. Experts suspect that hackers are exploiting a vulnerability in CrossWeb EX for initial penetration, and the attack chain ultimately leads to in-memory execution of the malware. After this, a multi-stage chain is launched, much of which is executed entirely in memory. It involves updated malware from TechHub, Cubridge, TouchShift, and LPEClient, as well as two new components—TouchHub and ClientHub. These components allow the attackers to gain a foothold in the system, collect data, execute commands, and download additional payloads, using GitHub and Dropbox as command and control channels, among others.
According to experts, the updated LPEClient tool is of particular interest. This malware collects detailed system information, including installed security products and the state of Windows security mechanisms, and then transmits the data via ClientHub. ML-KEM-1024, a NIST-standardized post-quantum mechanism based on CRYSTALS-Kyber, is used for secure key exchange.
After establishing a secure channel, LPEClient receives additional payload and reflexively loads it directly into memory, while simultaneously attempting to bypass system call monitoring. According to researchers, Lazarus has been using this type of post-quantum cryptography since at least September 2024.
Kaspersky GReAT Senior Researcher Sojun Ryu notes that Lazarus continues to refine old tools and incorporate new technologies into established attack schemes. He notes that it is particularly noteworthy that the group began protecting malware communications from potential quantum attacks more than a year before the publication of the study.
The first attacks associated with Operation FlashHole were dated July 2025. The researchers write that they are aware of at least three affected organizations in South Korea: a software developer, a construction company, and a manufacturer of wired communications equipment. This campaign is a continuation of Lazarus' previous operation, SyncHole , and the group's primary goal remains cyberespionage.
Attacks typically begin with spearphishing emails containing links to fake resumes and portfolios tailored to specific recipients. One such resource was hosted on GitHub Pages, linked to a GitHub account used by the attackers as a command and control channel. The account was created in September 2025.
Initially, the site featured a resume supposedly for an experienced network equipment developer, with a photo generated by artificial intelligence. The site's content was later replaced with the portfolio of an interior designer, likely intended to target a construction company. Researchers believe the hackers use AI not only to generate the photo but also to create the decoys themselves, which they then manually tailor to the targeted organizations. It is noted that Lazarus actors have long used similar fake job postings and resumes as part of the Dream Job campaign. After visiting the malicious site, CrossWeb EX—legitimate financial security software required to access popular online banking and government services in South Korea—is presumably activated. Experts suspect that hackers are exploiting a vulnerability in CrossWeb EX for initial penetration, and the attack chain ultimately leads to in-memory execution of the malware. After this, a multi-stage chain is launched, much of which is executed entirely in memory. It involves updated malware from TechHub, Cubridge, TouchShift, and LPEClient, as well as two new components—TouchHub and ClientHub. These components allow the attackers to gain a foothold in the system, collect data, execute commands, and download additional payloads, using GitHub and Dropbox as command and control channels, among others.
According to experts, the updated LPEClient tool is of particular interest. This malware collects detailed system information, including installed security products and the state of Windows security mechanisms, and then transmits the data via ClientHub. ML-KEM-1024, a NIST-standardized post-quantum mechanism based on CRYSTALS-Kyber, is used for secure key exchange.
After establishing a secure channel, LPEClient receives additional payload and reflexively loads it directly into memory, while simultaneously attempting to bypass system call monitoring. According to researchers, Lazarus has been using this type of post-quantum cryptography since at least September 2024.
Kaspersky GReAT Senior Researcher Sojun Ryu notes that Lazarus continues to refine old tools and incorporate new technologies into established attack schemes. He notes that it is particularly noteworthy that the group began protecting malware communications from potential quantum attacks more than a year before the publication of the study.