Kaspersky attributes to North Korea's Lazarus Group an espionage campaign called Operation FlashHole, which targeted at least three organisations in South Korea in construction, software and telecoms equipment, The Hacker News reports. The campaign, active since at least July 2025, abuses INISAFE CrossWeb EX, security software that is mandatory in the country for online banking and government services. Victims received targeted messages linking to fake résumé and portfolio pages. The new version of the LPEClient tool uses the ML-KEM-1024 algorithm, designed to withstand future quantum computers, to communicate with the attackers' servers.

What it means: The campaign highlights a risk present in any country where the state or banks require citizens to install specific software: when millions of computers run the same program, a flaw in it becomes a valuable way in. Lazarus has abused such programs for years, and the new campaign shows it keeps finding ways. An attack group using quantum-resistant cryptography is symbolically significant. It does not mean there is an immediate threat from quantum computers, but that attackers are adopting new standards ahead of many defenders, which makes their traffic harder to analyse. The same fake résumé technique, aimed at engineers and developers, is used by North Korean groups in attacks on crypto companies too. For businesses, training technical staff to recognise job offers and collaboration requests that look genuine is now a basic measure. Organisations also need to plan their own move to quantum-resistant cryptography, as the European roadmap for post-quantum cryptography envisages.

Read the original on The Hacker News

Related service: Custom software

Related stories