At the Security Analyst Summit in Bali, Indonesia, [Kaspersky GReAT](https://www.kaspersky.com/about/technology/research) disclosed that the [Lazarus Group](https://en.wikipedia.org/wiki/Lazarus_Group) has been running a cyber‑espionage campaign called Operation FlashHole since at least July 2025. The operation has affected three organisations in South Korea’s construction, software and wire‑communication equipment sectors, using spear‑phishing emails and a compromised version of the CrossWeb EX security plugin.
**What is Operation FlashHole?**
The campaign builds on an earlier Lazarus effort known as Operation SyncHole, first identified in 2023. Researchers say the attackers have refined their tools, making the current wave more persistent and sophisticated. A GitHub Pages site, created in September 2025, served as a command‑and‑control (C2) channel. The site mimicked a senior network‑appliance developer’s résumé, complete with an AI‑generated portrait, echoing the group’s “DreamJob” lure technique.
**How did the attackers gain access?**
The initial infection vector appears to be spear‑phishing messages that direct recipients to counterfeit portfolio or CV webpages tailored to individual targets. Visiting these pages likely triggers a malicious payload that exploits a potential vulnerability in CrossWeb EX, a widely deployed security and web‑authentication software in South Korea. A prior security advisory confirmed the existence of such a flaw in the financial‑security version of the product.
**Which new tools were identified?**
Analysis uncovered two previously undocumented utilities named TouchHub and ClientHub. Both install additional payloads, execute remote commands and communicate with the attackers. One variant of TouchHub uses Dropbox as a covert C2 conduit. The campaign also employs an updated version of LPEClient, a long‑standing Lazarus tool that now gathers detailed information about installed security products, Windows protections and system characteristics, encrypts the data, and forwards it to the threat actors.
**What cryptographic techniques are being used?**
The refreshed LPEClient incorporates ML‑KEM‑1024, a post‑quantum cryptographic algorithm designed to safeguard communications against future quantum‑computer attacks. This mechanism establishes an encrypted channel before downloading further malware directly into memory, while also attempting to bypass security monitoring by altering memory protections and disabling detection hooks.
“Lazarus continues to expand its operations, launches new campaigns while introducing new tools and reworking familiar ones to meet its needs. Our analysis of Operation FlashHole, along with evidence from previous investigations, suggests that the group is also bringing AI into its long‑established playbook, a shift we have observed among other threat actors aligned with Lazarus. What deserves closer attention is Lazarus’s adoption of cryptography designed to withstand future quantum threats,” said Sojun Ryu, senior security researcher at Kaspersky GReAT.
**What defensive measures are recommended?**
- Educate staff to spot targeted phishing attempts and verify unexpected links, even when they appear professional.
- Apply security patches promptly and regularly audit critical applications for vulnerabilities, disabling unnecessary components.
- Limit user privileges and monitor cloud‑service connections that could be abused for C2 traffic.
- Deploy comprehensive endpoint protection such as Kaspersky’s Next suite, which offers real‑time detection, threat visibility and EDR/XDR capabilities.
- Consider managed security services—including compromise assessment, managed detection and response, and incident response—to cover the full incident‑management lifecycle.
- Provide security teams with threat‑intelligence platforms that deliver contextual insight across the detection‑to‑remediation process.
The full technical report can be accessed on Securelist.