New campaign targets South Korean firms
Kaspersky’s Global Research and Analysis Team has tracked Operation FlashHole since July 2025. The Lazarus group has hit at least three organisations in construction, software and wire-communication equipment manufacturing. Attackers began with spear-phishing emails that pointed to AI-generated CV and portfolio sites, then abused the legitimate CrossWeb EX plugin to drop fresh malware.
Updated tools and post-quantum encryption
The operation now includes two previously unseen tools, TouchHub and ClientHub, plus an upgraded LPEClient that uses ML-KEM-1024 to secure its command channel against future quantum computers. One variant routes traffic through Dropbox. Researchers also found a GitHub Pages site created in September 2025 that served as a command-and-control server.
What the findings mean for users
Kaspersky’s earlier report on AI agents showed the same trend of threat actors folding machine-learning tricks into long-running campaigns. The new details underline why keeping software patched and limiting privileges still matters, even when attackers reach for cutting-edge cryptography.
Quote from the researcher
“ Lazarus continues to expand its operations, launches new campaigns while introducing new tools and reworking familiar ones to meet its needs. Our analysis of Operation FlashHole, along with evidence from previous investigations, suggests that the group is also bringing AI into its long-established playbook, a shift we have observed among other threat actors aligned with Lazarus. What deserves closer attention is Lazarus’s adoption of cryptography designed to withstand future quantum threats. Our findings trace its use back to at least September 2024, showing that these capabilities were already protecting the group’s malware communications more than a year before this disclosure, ” says Sojun Ryu, senior security researcher at Kaspersky GReAT.
More context on how these techniques fit into wider cyber-espionage trends is available on our VPN hub.
