Kaspersky has uncovered a new cyberespionage campaign attributed to the Lazarus APT group, revealing how the threat actor is evolving its attack methods through artificial intelligence (AI), updated malware and post-quantum cryptography.

The findings, presented by Kaspersky’s Global Research and Analysis Team (GReAT) at the Security Analyst Summit 2026 in Bali, Indonesia, detail Operation FlashHole, a campaign active since at least July 2025 that has affected at least three organizations in South Korea across the construction, software and wire-communication equipment manufacturing sectors.

The attackers reportedly used targeted phishing emails, potentially exploited legitimate CrossWeb EX software and deployed updated malware alongside previously undocumented tools to infiltrate targeted systems and support cyberespionage operations.

AI Helps Tailor Fraudulent Websites to Targets

Kaspersky researchers identified a GitHub Pages website linked to a GitHub account used as a command-and-control (C2) channel. Created in September 2025, the account initially hosted a website featuring the CV of a purported senior network-appliance developer, reflecting a tactic associated with Operation DreamJob, Lazarus’s job-themed campaign.

The page also included a photograph believed to have been generated by AI. Researchers believe the attackers may have used AI to customize fraudulent websites for individual targets, making their lures more convincing.

The campaign began with spear-phishing emails containing links to fabricated CV and portfolio websites tailored to the intended victims.

Investigators also found indications that visiting a malicious website may have initiated an infection process involving CrossWeb EX, a security plugin and web-authentication software widely used in South Korea. A potential vulnerability in the software may have provided the attackers with an initial entry point. A previously published security advisory had confirmed the existence of a vulnerability in the financial security software.

Through extensive analysis, the researchers identified multiple malicious payloads and reconstructed the infection chain, uncovering a sophisticated malware-delivery framework designed to conceal malicious activity on targeted systems.

New Malware Tools Expand Espionage Capabilities

The attackers combined updated versions of existing malware with two previously undocumented tools, TouchHub and ClientHub. These components can install additional malware, execute commands on infected computers and communicate with the attackers to facilitate cyberespionage. One of the tools also has a variant that uses Dropbox to communicate with its operators.

The campaign additionally employs an updated version of LPEClient, a long-established Lazarus tool used to collect information about infected computers and deliver further malware.

The latest version gathers information about installed security software, Windows security protections and other system characteristics. It then compresses and encrypts the collected data before sending it to the attackers.

Post-Quantum Cryptography Strengthens Malware Communications

One of the most notable findings is the use of ML-KEM-1024, a post-quantum cryptographic mechanism designed to protect communications against potential attacks by future quantum computers.

The updated LPEClient uses the mechanism to establish an encrypted connection with the attackers’ server before downloading and executing additional malware directly in system memory. It also attempts to evade detection by changing memory protections and disabling a monitoring hook used by security tools to identify suspicious system activity.

“Lazarus continues to expand its operations, launches new campaigns while introducing new tools and reworking familiar ones to meet its needs,” said Sojun Ryu, senior security researcher at Kaspersky GReAT.

Ryu added that the Operation FlashHole findings, together with evidence from earlier investigations, suggest the group is incorporating AI into its established attack methods. He also highlighted the group’s adoption of cryptography designed to withstand future quantum threats, noting that Kaspersky’s findings trace its use back to at least September 2024.

The full technical report is available on Securelist.

Kaspersky Recommends Strengthening Cybersecurity Defenses

To reduce the risk of attacks associated with Lazarus and campaigns such as Operation FlashHole, Kaspersky recommends training employees to identify targeted phishing attempts, verifying unexpected emails and links, and promptly applying software updates and security patches.

Organizations should also regularly assess vulnerabilities in business-critical applications, disable unnecessary components, restrict user privileges and monitor connections to cloud services that could be abused for command-and-control operations.

The company recommends deploying cybersecurity solutions with endpoint detection and response (EDR) and extended detection and response (XDR) capabilities, alongside managed security services such as Compromise Assessment, Managed Detection and Response (MDR) and Incident Response.

Kaspersky also advises security teams to use threat intelligence to improve visibility into cyberthreats targeting their organizations and identify potential risks in a timely manner.