The Lazarus Group, associated with North Korea, has been linked to a cyber espionage operation named Operation FlashHole.
This campaign specifically targeted a minimum of three entities located in South Korea. These organizations operate within the construction, software, and wire-communication equipment manufacturing industries.
Russian cybersecurity firm Kaspersky reported that this operation has been active for a period starting no earlier than July 2025.
The assessment indicates that the campaign is gaining momentum.
This activity demonstrates an evolving threat vector utilizing advanced cryptographic techniques.
The deployment of malware by the Lazarus Group involved the abuse of South Korean security software.
Furthermore, this malware incorporates post-quantum encryption.
The involvement of such sophisticated encryption methods suggests a strategic focus on long-term data exfiltration and operational persistence against established infrastructure.
