Kaspersky has uncovered Operation FlashHole, a cyber espionage campaign attributed to the Lazarus advanced persistent threat group that combines artificial intelligence, updated malware and post-quantum cryptography. Announced on October 21, 2026, the findings were presented by its Global Research and Analysis Team at the Security Analyst Summit in Bali, Indonesia. Active since at least July 2025, the operation has affected at least three South Korean organisations across construction, software and wired communications equipment manufacturing. Researchers linked the activity to Lazarus’s previously identified Operation SyncHole campaign.
The attacks began with targeted phishing emails directing recipients to fabricated portfolio and CV websites. Researchers discovered a GitHub Pages website connected to an account created in September 2025, which also served as a command-and-control channel. The site presented a supposed senior network appliance developer and included an AI-generated photograph of a purported job seeker. Kaspersky believes artificial intelligence also helped tailor fraudulent websites to individual targets. The recruitment-themed approach resembles Operation DreamJob, an established Lazarus campaign that uses employment-related material to attract victims.
Investigators assessed that visiting a malicious website likely triggered an infection process involving CrossWeb EX, a security plugin and web authentication application widely used in South Korea. A potential vulnerability may have provided the initial entry point, although the release does not establish that mechanism conclusively. The attackers deployed updated malware alongside two previously undocumented tools, TouchHub and ClientHub. These components support additional malware installation, command execution and communication with operators. One newly identified tool also has a variant that communicates through Dropbox infrastructure.
Another component, an updated version of LPEClient, collects information about installed security products, Windows protections and other system characteristics before compressing, encrypting and transmitting it. The malware uses ML-KEM-1024, a post-quantum cryptographic mechanism designed to resist potential attacks from future quantum computers, to establish protected communications with attacker infrastructure. It then downloads and executes additional malware directly in memory. To reduce detection, the tool also attempts to alter memory protections and disable a monitoring hook used by security software to identify suspicious system activity.
Kaspersky researcher Sojun Ryu said the group’s use of quantum-resistant cryptography dates back to at least September 2024, showing these capabilities preceded the latest disclosure. The findings highlight how Lazarus is adding newer technologies to established espionage techniques rather than abandoning familiar methods. Kaspersky recommends training employees to recognise targeted phishing, verifying unexpected links, promptly applying software patches and assessing critical applications for vulnerabilities. Organisations should also restrict user privileges, disable unnecessary software components and monitor cloud service connections that attackers could misuse for communications.