The Lazarus hacking group used AI-generated content to lure victims and post-quantum encryption to protect malware communications in a cyberespionage campaign, according to cybersecurity company Kaspersky’s Global Research and Analysis Team (GReAT).
Called Operation FlashHole, the campaign has affected at least three organizations in South Korea since at least July 2025. The victims operate in construction, software, and wire-communication equipment manufacturing. Researchers linked the attacks to Operation SyncHole, an earlier Lazarus campaign, and found new tools built to steal information and install more malware.
“Lazarus continues to expand its operations, launching new campaigns while introducing new tools and reworking familiar ones to meet its needs,” said Sojun Ryu, senior security researcher at Kaspersky GReAT. “Our analysis of Operation FlashHole, along with evidence from previous investigations, suggests that the group is also bringing AI into its long-established playbook, a shift we have observed among other threat actors aligned with Lazarus.”
The attacks began with targeted phishing emails containing links to fake portfolio and CV websites. One page featured an AI-generated photograph of a supposed senior network-appliance developer. Researchers believe the attackers also used AI to customize fraudulent websites for individual targets.
A GitHub account created in September 2025 hosted the fake developer profile through GitHub Pages. Researchers also linked the account to a channel used to communicate with the attackers.
Kaspersky said visiting a malicious website likely started an infection involving CrossWeb EX, a security plugin and web authentication software widely used in South Korea. A possible software vulnerability may have allowed entry. The researchers did not confirm that this was the entry point.
The malware included two previously undocumented tools, TouchHub and ClientHub. They can install additional malware, run commands, and communicate with the attackers. A variant of one tool uses Dropbox for those communications.
An updated Lazarus tool, LPEClient, collects details about infected computers, including their security software and Windows protections. It compresses and encrypts that information before sending it to the attackers.
LPEClient also uses ML-KEM-1024, a post-quantum cryptographic mechanism designed to resist potential attacks by future quantum computers. It establishes an encrypted connection before downloading and running more malware directly in memory.
Kaspersky traced Lazarus’ use of post-quantum cryptography to at least September 2024. The updated malware also attempts to interfere with security monitoring to avoid detection.
The company advised organizations to verify unexpected emails and links, patch software promptly, limit user permissions, and monitor cloud-service connections that attackers could abuse.