started · updated
Lazarus Group conducts Operation FlashHole against South Korean organizations
The Lazarus Group has launched a sophisticated cyber espionage campaign dubbed ‘Operation FlashHole,’ targeting organizations in South Korea. According to research from Kaspersky, the campaign has impacted at least three entities within the software, construction, and wired communication equipment manufacturing sectors.
Active since July 2025, the operation utilizes a complex infection chain involving spear-phishing emails, fabricated portfolio or résumé websites, and the abuse of legitimate South Korean security software, specifically CrossWeb EX. The attackers also employed AI-generated portrait photos on fake websites to increase the effectiveness of their social engineering efforts.
A notable technical development in this campaign is the integration of post-quantum cryptography. The group utilized the NIST-standardized ML-KEM-1024 mechanism to encrypt communications with command-and-control servers and to decrypt payloads, a move designed to evade detection and prepare for future quantum computing capabilities. The group also introduced two new tools, ‘TouchHub’ and ‘ClientHub,’ alongside updated versions of their existing ‘LPEClient’ malware.
Entities
CrossWeb EX · Kaspersky · Lazarus Group · NIST · South Korea
Claims
What the coverage asserts, and how many sources carry each claim.
- [○ 1 SOURCE] Two new tools named ‘TouchHub’ and ‘ClientHub’ were identified in the campaign. www.sondakika.com
- [● 2 SOURCES] The attackers abused the legitimate South Korean security software CrossWeb EX. www.sondakika.com · securelist.com
- [○ 1 SOURCE] The group used AI-generated portrait photos on fake websites to facilitate phishing. www.sondakika.com
- [● 3 SOURCES] The campaign began in July 2025. brandaktuell.at · www.sondakika.com · securelist.com
- [● 3 SOURCES] The Lazarus Group is conducting a cyber espionage campaign named ‘Operation FlashHole’. brandaktuell.at · www.sondakika.com · securelist.com
- [○ 1 SOURCE] The group used an updated version of the ‘LPEClient’ malware. www.sondakika.com
- [● 2 SOURCES] At least three organizations in South Korea’s software, construction, and wired communication equipment manufacturing sectors were affected. www.sondakika.com · securelist.com
- [● 2 SOURCES] The attackers used ML-KEM-1024 post-quantum cryptography for communication and payload decryption. brandaktuell.at · www.sondakika.com