Lazarus Operation FlashHole combines AI phishing and post-quantum crypto
Kaspersky reports that Lazarus Group’s Operation FlashHole, active since at least July 2025, targeted at least three South Korean organizations in software, construction, and wired communications equipment. The updated LPEClient payload tool uses four ML-KEM-1024 key exchanges to secure payload delivery, while phishing through GitHub Pages sites with likely AI-generated résumés was the probable initial-access route. Kaspersky’s attribution of the résumé and website to AI, and the exact infection trigger, remain uncertain.
The campaign shows Lazarus combining suspected AI-assisted social engineering with post-quantum protection for malware delivery, although the cryptography safeguards traffic in transit rather than detecting malware at endpoints.
- Kaspersky says Lazarus's Operation FlashHole, active since at least July 2025, hit at least three South Korean software, construction, and telecom equipment firms
- An updated LPEClient tool uses four ML-KEM-1024 key exchanges to protect payload delivery, a design Check Point also documented
- The post-quantum layer guards traffic against future decryption, not endpoint detection, and the most likely way in for the hackers was still phishing
North Korea's most notorious hacking group has been caught protecting its malware with the same post-quantum cryptography that governments and tech firms are still rolling out to safeguard their own data.
In its analysis of a campaign dubbed Operation FlashHole, Kaspersky's Global Research and Analysis Team (GReAT) says an updated version of LPEClient, a Lazarus Group tool, now uses ML-KEM-1024, a key exchange mechanism designed to resist attacks from future quantum computers, to secure the channel it uses to download more malware.
The findings describe a campaign active since at least July 2025 that has hit at least three South Korean organizations in the software, construction, and wired communication equipment manufacturing sectors.
#Lazarus Group#LPEClient#ML-KEM-1024#INISAFE CrossWeb EX#ClientHub#GitHub Pages#Kaspersky Global Research and Analysis Team#Check Point Research