Lazarus Group Operation FlashHole cyber espionage

The Lazarus Group has been conducting a sophisticated cyber espionage campaign known as ‘Operation FlashHole,’ which has been active since at least July 2025. The campaign utilizes artificial intelligence to create convincing fake professional profiles, including AI-generated portrait photos, resumes, and fraudulent portfolio websites to facilitate social engineering through targeted emails.

Technical analysis indicates the group targets organizations in South Korea and across Asia, specifically impacting the software, construction, and wired communication equipment manufacturing sectors. The attackers may be exploiting vulnerabilities in CrossWeb EX, a security software widely used in Asia, to initiate system infections.

Recent developments show the group has integrated post-quantum cryptography, specifically the NIST-standardized ML-KEM-1024 mechanism, to encrypt communications with command-and-control servers and decrypt payloads. This move is intended to evade detection and prepare for future quantum computing capabilities. The group has also introduced new tools, ‘TouchHub’ and ‘ClientHub,’ alongside updated versions of the ‘LPEClient’ malware.