North Korea-linked Lazarus Group is turning software meant to protect South Korean users into part of an espionage attack chain, while adding AI-generated lures and post-quantum cryptography to its malware toolkit, according to research Kaspersky published Wednesday.
Kaspersky dubbed the campaign Operation FlashHole and said it identified at least three affected organizations in South Korea’s software, construction and wired communications-equipment sectors. The earliest evidence uncovered by researchers dates to July 2025.
The attacks involve INISAFE CrossWeb EX, financial-security software required to access widely used South Korean banking and government websites. Kaspersky said the infection chain originated from the legitimate software and ultimately executed malware in memory, although researchers could not determine precisely how attackers abused CrossWeb EX.
The campaign shows how trusted security software can itself become part of the attack path. This is a familiar scenario. The same broader pattern can be found elsewhere, from ransomware crews weaponizing trusted Windows drivers to disable EDR to attackers poisoning trusted developer updates and package ecosystems.
Lazarus also appears to be giving an old social-engineering playbook an AI upgrade.
Researchers found a malicious résumé site carrying what appeared to be an AI-generated photograph. Kaspersky said the fake candidate’s name, nonsensical portfolio details and other artifacts suggest AI was likely also used to build the lure site before attackers manually tailored it to individual targets.
The approach echoes North Korean campaigns using fake recruiters, coding tests and job interviews to reach developers and a separate campaign that disguised malware as a Zoom SDK update during a supposed job interview.
A Post-Quantum Handshake
Further inside the infection chain, Kaspersky found Lazarus using ML-KEM-1024, a post-quantum cryptographic system standardized by NIST, to protect the delivery of additional malware.
In plain English, ML-KEM-1024 acts as a secure handshake. Instead of sending the secret needed to unlock the next payload across the network, the infected computer and Lazarus server use public information to independently establish shared secret keys.
In this case, LPEClient received four ML-KEM-1024 public keys from the command-and-control server and used them to create four shared secrets. Those secrets became part of the key used to decrypt the next payload before the malware loaded it directly into memory.
The post-quantum part matters because ML-KEM was designed to withstand attacks from future quantum computers that could eventually break widely used public-key systems such as RSA and elliptic-curve cryptography. There is no evidence Lazarus needed that protection to defeat a quantum computer today. Kaspersky said the immediate purpose was to better conceal the malware delivered later in the attack chain.
Nor does the use of ML-KEM make the malware undetectable. Kaspersky was able to reverse-engineer the process and reconstruct the communication flow. What stands out is how quickly Lazarus adopted the technology. Kaspersky said it has traced the group’s use of post-quantum cryptography to at least September 2024, shortly after NIST finalized ML-KEM as a standard.
The timing is striking as enterprises are still working through the complications of migrating legitimate systems to post-quantum cryptography.
Kaspersky put the irony more plainly. Lazarus appears to have adopted more secure post-quantum cryptography faster than many legitimate security products.
