A state-linked hacking unit is now building its malware with encryption designed to withstand computers that do not yet exist. Kaspersky Lab's Global Research and Analysis Team has detailed a campaign, dubbed Operation FlashHole, in which the North Korea-affiliated Lazarus Group combines artificial intelligence with post-quantum cryptography to breach South Korean organizations. The operation has been active since at least July 2025 and has already affected firms in construction, software development, and telecommunications equipment manufacturing.
A Familiar Lure, Updated With AI
The intrusion method itself is not new. Lazarus has long relied on spear-phishing emails that direct targets to fraudulent job-application pages, exploiting the routine trust people place in recruitment correspondence. What has changed is the craftsmanship behind the bait. One fake site, hosted on GitHub Pages, featured a photo of a supposed job applicant generated by artificial intelligence, alongside a resume and portfolio tailored to the recipient. Researchers suspect neural networks were used to customize these decoy pages for individual targets, a refinement that makes the deception considerably harder to spot than the generic phishing templates of years past.
Once a victim engaged with the fake portal, attackers exploited legitimate software called CrossWeb EX, a program widely used in South Korea for financial authentication. A suspected vulnerability in that tool appears to have given the group a foothold inside victims' systems, illustrating how attackers increasingly piggyback on trusted, locally entrenched software rather than relying solely on custom exploits.
New Tools, New Channels of Control
Kaspersky identified two previously undocumented malicious tools in the campaign, named TouchHub and ClientHub. Both allow operators to execute commands remotely, deploy additional malware, and maintain ongoing communication with compromised machines. One variant notably uses Dropbox as a communication channel, a tactic that helps malicious traffic blend into ordinary cloud-service activity and evade detection systems tuned to flag unfamiliar network destinations.
- TouchHub and ClientHub enable remote command execution and secondary malware deployment.
- A Dropbox-based variant disguises command-and-control traffic as routine cloud use.
- CrossWeb EX, a financial authentication tool, served as a likely entry vector.
Why Post-Quantum Cryptography Matters Here
The most striking element is technical: an updated version of the group's LPEClient tool now uses ML-KEM-1024, a key-exchange mechanism built on lattice-based mathematics that is believed to resist attacks from future quantum computers. Ordinary public-key encryption, including the RSA and elliptic-curve systems that secure most of today's internet traffic, could theoretically be broken by a sufficiently powerful quantum machine running known algorithms. Post-quantum standards like ML-KEM are designed to close that gap before such machines become practical.
For Lazarus, the benefit is more immediate than futuristic. By encrypting its command channel with ML-KEM-1024, the malware establishes a secure link to attacker-controlled servers that is far harder for defenders to intercept or decrypt, even retroactively, allowing additional modules to be downloaded and run directly in memory without leaving obvious traces on disk. Kaspersky notes the group has used post-quantum cryptography since at least September 2024, suggesting this is not experimental tinkering but a deliberate operational upgrade.
A Broader Shift in State-Sponsored Hacking
The convergence of AI-generated social engineering with cutting-edge cryptography signals a maturing threat landscape. Nation-state groups are no longer simply exploiting software flaws; they are adopting the same defensive technologies that security researchers promote for protecting legitimate systems, turning them toward offense instead. Separately, researchers at Mysten Labs have argued that AI currently poses a more immediate risk to cryptocurrency security than quantum computing itself, a reminder that the quantum threat, while real, remains one of several converging pressures reshaping digital defense priorities for governments and private firms alike.