Kaspersky says a North Korea-linked hacking group has started using artificial intelligence and post-quantum encryption to make its cyberespionage campaigns harder to detect.
The Kaspersky Global Research and Analysis Team (GReAT) uncovered a new wave of attacks tied to Operation SyncHole, a campaign it attributes to the Lazarus APT group. The latest findings, part of what Kaspersky calls Operation FlashHole, show the group has been active since at least July 2025 and has already hit three organisations in South Korea’s construction, software and wire-communication equipment sectors.
AI-generated lures and a GitHub command centre
The attackers set up a GitHub Pages site built around the CV of a fake senior network-appliance developer, complete with an AI-generated photo of the fictitious job seeker. It’s a tactic consistent with Operation DreamJob, Lazarus’s long-running job-themed lure. Researchers believe AI was also used to tailor fraudulent portfolio and CV websites to specific targets, which victims reached through spear-phishing emails.
Visiting the fake sites triggered an infection chain involving CrossWeb EX, a security and web authentication program widely used in South Korea. A vulnerability in the software, flagged in an earlier security advisory, may have given the attackers their way in. Kaspersky’s analysis uncovered two previously undocumented tools, TouchHub and ClientHub, which install malware, run commands and communicate with the attackers — one variant even using Dropbox as a channel.
Quantum-safe encryption since 2024
The campaign also uses an updated version of LPEClient, a long-standing Lazarus tool that gathers details on a victim’s security software and system before sending the data back to the attackers. The new version encrypts that traffic with ML-KEM-1024, a post-quantum cryptographic mechanism designed to resist future attacks from quantum computers. Kaspersky traced its use back to September 2024, more than a year before this disclosure.
“Lazarus continues to expand its operations, launches new campaigns while introducing new tools and reworking familiar ones to meet its needs. Our analysis of Operation FlashHole, along with evidence from previous investigations, suggests that the group is also bringing AI into its long-established playbook, a shift we have observed among other threat actors aligned with Lazarus,” said Sojun Ryu, senior security researcher at Kaspersky GReAT.
Kaspersky is advising organisations to train staff to spot targeted phishing, patch business-critical software promptly, restrict user privileges and monitor cloud connections that could be abused for command-and-control traffic. It also points to its own Kaspersky Next product line and managed services such as Compromise Assessment and Managed Detection and Response as options for organisations without in-house security teams.
