A new Lazarus APT campaign is using fake CV websites, AI and post-quantum encryption to spy on organisations in South Korea. Kaspersky’s Global Research and Analysis Team (GReAT) shared the findings and named it Operation FlashHole.
The campaign has been active since at least July 2025. So far, it has hit at least three South Korean organisations in construction, software and wire-communication equipment manufacturing. To break in, the attackers used spear-phishing and abused legitimate CrossWeb EX software. They also deployed updated malware, including tools never documented before.
How the Lazarus APT Campaign Began
Operation FlashHole is a new wave of Operation SyncHole, which Kaspersky first discovered last year. Since then, Lazarus has evolved its tools and techniques. As a result, the campaign is now more persistent and sophisticated.
Each attack started with a spear-phishing email. These emails carried links to fake portfolio and CV websites tailored to individual targets. Researchers also found a GitHub Pages website tied to a GitHub account that served as a command-and-control (C2) channel.
The attackers created the account in September 2025. At first, it hosted the CV of a supposed senior network-appliance developer, with an AI-generated photo. This lure matches Operation DreamJob, the signature Lazarus job-themed campaign. Kaspersky also believes the attackers used AI to tailor the fake websites to each target.
Fake CV Websites Opened the Door
According to the research, visiting the malicious site most likely set off an infection process involving CrossWeb EX. This security plugin and web authentication software is widely used in South Korea. A potential vulnerability in it may have given the attackers their first way in. In fact, an earlier security advisory had already confirmed a vulnerability in this financial security software.
After extensive analysis, researchers then rebuilt the full infection chain. It revealed a sophisticated malware delivery framework and advanced ways to hide malicious activity.
New Tools Behind the Lazarus APT Campaign
The attackers combined updated versions of their existing malware with two new tools, TouchHub and ClientHub. Together, these tools install more malware, run commands on infected computers and talk to the attackers. Their ultimate goal is cyberespionage. In addition, one tool has a variant that uses Dropbox to reach its operators.
The campaign also relies on an updated LPEClient, a long-standing Lazarus tool. It now gathers details on installed security software, Windows security protections and other system traits. Then it compresses and encrypts this data before sending it to the attackers.
Post-Quantum Encryption Hides the Traffic
Notably, the updated LPEClient uses ML-KEM-1024. This post-quantum cryptographic mechanism aims to protect communications against attacks by future quantum computers. First, the malware uses it to set up an encrypted link with the attackers’ server. After that, it downloads and runs more malware directly in memory.
To avoid detection, the tool also changes memory protections. In addition, it disables a monitoring hook that security tools use to spot suspicious activity.
“Lazarus continues to expand its operations, launches new campaigns while introducing new tools and reworking familiar ones to meet its needs. Our analysis of Operation FlashHole, along with evidence from previous investigations, suggests that the group is also bringing AI into its long-established playbook,” said Sojun Ryu, senior security researcher at Kaspersky GReAT.
“What deserves closer attention is Lazarus’s adoption of cryptography designed to withstand future quantum threats,” Ryu added. Kaspersky traced its use back to at least September 2024. In other words, it protected the group’s malware traffic for over a year before this disclosure.
The full Operation FlashHole report is available on Securelist.
How to Stay Safe From the Lazarus APT Campaign
Kaspersky advises organisations to take these steps:
- Train employees to spot targeted phishing. Verify unexpected emails and links, even when they lead to convincing websites.
- Keep software up to date and patch promptly. Also, disable components you do not need.
- Restrict user privileges and monitor connections to cloud services that attackers could abuse.
- Use the Kaspersky Next product line for real-time protection, threat visibility, and EDR and XDR capabilities.
- Adopt managed services such as Compromise Assessment, Managed Detection and Response and Incident Response.
- Give InfoSec teams deeper visibility with Kaspersky Threat Intelligence.
Why It Matters for Businesses in Asia
Although this campaign targets South Korea, it shows how fast advanced threat groups are adopting AI and next-generation encryption. It also echoes a recent Kaspersky study showing that cybersecurity risks hit over 4 in 5 people across 14 professions.
Overall, the Lazarus APT campaign highlights the value of staff awareness, fast patching and strong threat visibility for every organisation.
