Red Hot Cyber
Cybersecurity, Cybercrime News and Vulnerability Analysis
Original article in Italian authored by Chiara Nardini, English translation by Tara Lie.
Experts from Securelist have discovered a new espionage campaign, Operation FlashHole, by North Korean hacker group Lazarus.
In their campaign, the cyber criminals use personalised phishing, legitimate protection software, and an updated set of malware. Additionally, the Securelist researchers revealed signs of artificial intelligence use and post-quantum cryptography use by the hackers.
The first attacks linked to the Operation FlashHole campaign started in July 2025. The researchers write that they are aware of at least three South Korean organisations hit: one software developer, one construction company, and one wired network equipment manufacturer. This campaign continues the previous Lazarus operation, SyncHole, and the principal objective of the group remains cyberespionage.
Often, the attacks start with targeted phishing emails containing links to fake resumes and portfolios, tailored to each recipient. One of these resources was hosted on GitHub Pages, associated with a GitHub account that the hackers used as a control channel. The account was created in September 2025.
Initially, the site was used to host the resume of a supposed expert network equipment developer, and the candidate’s photograph had been generated with artificial intelligence. Later, the site’s content was replaced with a portfolio of an interior designer, likely as an attack against the construction company.
The researchers believe that the state hackers use AI not just to generate photos, but also to create the bait itself, which they then adapt to the selected target organisations. It is worth noting that members of Lazarus have long been using this type of strategy in the Dream Job campaign.
After visiting the malicious site, CrossWeb EX allegedly comes into play – legitimate software for protecting financial transactions, needed to access common online banking sites and government services in South Korea. Experts speculate that hackers exploit a vulnerability in CrossWeb EX for the initial access, and then the attack chain eventually leads to the malware running in memory.
Subsequently, a multi-step attack chain is launched, most of which runs entirely in memory. It involves updated malware such as TechHub, Cubridge, TouchShift and LPEClient, as well as two new components: TouchHub and ClientHub. These allow the hackers to settle into the system, gather data, execute commands, and upload additional payloads, utilising platforms like Github and Dropbox as control channels.
According to experst, the updated LPEClient tool is particularly interesting. This malware gathers detailed information about the system, including the installed protection products and the status of Windows security mechanisms. It then sends this data via ClientHub. For secure key exchange, ML-KEM-1024 is used – a NIST-standardised post quantum key encapsulation mechanism based on CRYSTALS-Kyber.
After having stabilised the secure channel, LPEClient works directly in memory while simultaneously seeking to evade monitoring by system calls. According to the researchers’ data, Lazarus has been using post-quantum cryptography since at least September 2024.
Senior Kaspersky GReAT researcher Sodžun Rju (Sojun Ryu) notes that Lazarus continues to improve old tools and to implement new technologies into tried-and-true attack schemes. According to Rju, it is especially noteworthy that the group has started to protect their communications from potential quantum attacks more than a year than the study was published.
