Kaspersky’s Global Research and Analysis Team (GReAT) has revealed its findings on a new cyberespionage campaign attributed to the Lazarus APT group – Operation FlashHole.
The campaign has already affected at least three organisations in South Korea across the construction, software and wire-communication equipment manufacturing sectors. The attackers used spear-phishing, abuse of legitimate CrossWeb EX software and deployed updated malware, including previously undocumented tools.
Kaspersky GReAT has uncovered a new wave of attacks linked to Lazarus’s Operation SyncHole, first discovered last year. The attackers have since evolved their tools and techniques, making the campaign more persistent and sophisticated.
As part of the campaign, the researchers uncovered a GitHub Pages website linked to a GitHub account used as a command-and-control (C2) channel. Created in September 2025, the account initially hosted a website featuring the CV of a purported senior network-appliance developer – a lure consistent with Operation DreamJob, Lazarus’s signature job-themed campaign. The page included an AI-generated photograph of a purported job seeker. Kaspersky researchers believe the attackers also used AI to tailor the fraudulent websites to their targets. The campaign began with spear-phishing emails containing links to fabricated portfolio and CV websites tailored to individual targets.
The research results showed a high possibility that visiting the malicious site initiated an infection process involving CrossWeb EX software, a security plugin and Web authentication software widely used in South Korea. The malicious activity may have been enabled by a potential vulnerability in CrossWeb EX software, which could have provided an initial entry point for the attackers.
Notably, a security advisory was published previously confirming the existence of a vulnerability in the financial security software. Through extensive analysis, researchers identified multiple malicious payloads and reconstructed the infection chain, revealing a sophisticated malware delivery framework and advanced techniques for concealing malicious activity on targeted systems.
The attackers combined updated versions of their existing malware with two previously undocumented tools – TouchHub and ClientHub. These components install additional malware, execute commands on infected computers, and communicate with the attackers with the ultimate goal of cyberespionage. One of the new tools has a variant that uses Dropbox to communicate with its operators.
The campaign also uses an updated version of LPEClient, a longstanding Lazarus tool that collects information about infected computers and delivers additional malware. The new version gathers details about installed security software, Windows security protections and other system characteristics, then compresses and encrypts the information before sending it to the attackers.
The updated LPEClient also uses ML-KEM-1024, a post-quantum cryptographic mechanism designed to protect communications against potential attacks by future quantum computers. It uses this mechanism to establish an encrypted connection with the attackers’ server before downloading and running additional malware directly in memory. To evade detection, it also attempts to bypass security monitoring by changing memory protections and disabling a monitoring hook that security tools use to detect suspicious system activity.
“Lazarus continues to expand its operations, launches new campaigns while introducing new tools and reworking familiar ones to meet its needs,” says Sojun Ryu, senior security researcher at Kaspersky GReAT. “Our analysis of Operation FlashHole, along with evidence from previous investigations, suggests that the group is also bringing AI into its long-established playbook – a shift we have observed among other threat actors aligned with Lazarus.
“What deserves closer attention is Lazarus’s adoption of cryptography designed to withstand future quantum threats,” Ryu adds. “Our findings trace its use back to at least September 2024, showing that these capabilities were already protecting the group’s malware communications more than a year before this disclosure.”