A North Korean state-linked hacking group has folded two of the most consequential technologies of the decade - artificial intelligence and post-quantum cryptography - into a single espionage campaign. Researchers at Kaspersky Lab's Global Research and Analysis Team (GReAT) say the operation, which they have named Operation FlashHole, has been active since at least July 2025 and has already struck at least three South Korean organizations in construction, software development, and wired communication equipment manufacturing.
A Familiar Lure, Sharpened by AI
The campaign opens with a tactic Lazarus has used for years: phishing emails that direct targets to fake job-application websites built around fabricated resumes and portfolios. What sets this iteration apart is the apparent use of generative AI. One decoy site, hosted on GitHub Pages, featured a profile photo that researchers believe was AI-generated, and the surrounding content appears tailored to specific individuals - suggesting the group may be using neural networks to personalize lures at a level that would have required far more manual effort in the past. That shift matters because personalization is the single biggest factor in phishing success; a generic email is easy to dismiss, but a convincing, individually crafted profile is much harder to question.
Once a target engages, the attackers reportedly exploit legitimate South Korean financial-authentication software called CrossWeb EX. Kaspersky's researchers believe a vulnerability in this program may have given the group a foothold inside victims' systems - a reminder that software trusted for routine, sanctioned purposes can become a silent entry point when left unpatched.
New Tools for Remote Control
Inside compromised networks, GReAT identified two previously undocumented malicious tools, TouchHub and ClientHub. Both allow operators to execute commands on infected machines, deploy further malware, and maintain ongoing communication with compromised devices. In at least one variant, the attackers used Dropbox as a covert communication channel - a technique that lets malicious traffic blend into ordinary cloud-storage activity and slip past network defenses that focus on obviously suspicious destinations.
Why Post-Quantum Cryptography Changes the Threat Picture
The most striking finding concerns an updated version of LPEClient, a tool Lazarus has used before. The new variant implements ML-KEM-1024, a post-quantum key-encapsulation mechanism designed to resist decryption by future quantum computers. Classical encryption standards rely on mathematical problems - such as factoring large numbers - that quantum machines are expected to eventually solve far faster than conventional computers. Post-quantum algorithms like ML-KEM are built on different mathematical foundations believed to withstand that future capability.
In Operation FlashHole, this mechanism is used to establish an encrypted channel between infected machines and the attackers' servers, through which additional malicious modules can be downloaded and run directly in memory, leaving less trace on disk. According to Kaspersky, Lazarus has been experimenting with post-quantum cryptography since at least September 2024, which indicates a sustained, deliberate investment rather than a one-off test.
The implication is notable on two levels. First, defenders now face adversaries who encrypt command-and-control traffic with the same forward-looking standards that governments and companies are only beginning to adopt for legitimate systems. Second, it signals that state-linked hacking groups are treating "harvest now, decrypt later" concerns - and their own operational security - as seriously as the cybersecurity industry does. A separate assessment from Mysten Labs has argued that AI, not quantum computing, currently poses the more immediate danger to cryptocurrency security, a view that fits the pattern seen here: Lazarus is combining both technologies rather than betting on one.
What It Means Going Forward
For organizations handling financial authentication, intellectual property, or critical infrastructure, FlashHole underscores two lessons. Patching third-party software used for routine verification is not optional, and phishing defenses must account for AI-enhanced social engineering that no longer looks obviously fake. The adoption of quantum-resistant encryption by an offensive actor also suggests that migration to post-quantum standards is no longer a distant, theoretical exercise - it is already shaping the tools used against networks today.