Kaspersky researchers analyze Operation FlashHole – a recent complex attack by Lazarus, involving a sophisticated malware set, watering-hole technique and abuse of CrossWeb EX financial security…

Lazarus hijacks South Korean websites to run malware command networks Kaspersky links FlashHole cyber-espionage to Lazarus abuse of Korean society and company websites as covert C2 relays

カスペルスキーの「Operation FlashHole」報告書は、韓国企業を狙ったサイバー諜報活動を北朝鮮のラザルスグループによるものと特定した。同グループは韓国内の…

The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors. According to Russian cybersecurity company Kaspersky, the campaign has been active since at least July 2025. It's assessed to pick up

North Korea-linked Lazarus hackers are targeting South Korean organizations through Operation FlashHole, a cyber espionage campaign that abuses financial security software and deploys advanced malware using stealthy infection techniques.

Introduction: A Renewed Cyber-Espionage Threat A cyber-espionage campaign attributed to North Korea-linked threat group Lazarus is reportedly targeting organizations in South Korea, exploiting trusted software components to deliver multi-stage malware. Security researchers at Kaspersky have linked the operation, known as Operation FlashHole, to attacks against at least three South Korean organizations. The campaign highlights a persistent challenge for enterprise defenders: attackers can abuse legitimate software and trusted execution paths to establish a foothold while concealing malicious activity within otherwise familiar environments.

Kaspersky attributes Operation FlashHole to Lazarus, targeting at least three South Korean organizations. The campaign abuses INISAFE CrossWeb EX to deliver…

Curate Feeds | Make Collections | Customize Email Briefs

The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors. According to Russian cybersecurity company Kaspersky, the campaign has been active since at least July 2025. It's assessed to pick up

The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors. According to Russian cybersecurity company Kaspersky, the campaign has been active since at least July 2025. It's assessed to pick up

Kaspersky researchers analyze Operation FlashHole – a recent complex attack by Lazarus, involving a sophisticated malware set, watering-hole technique and abuse of CrossWeb EX financial security softw...

Perfiles falsos con IA sostienen el nuevo ciberespionaje de Lazarus: una hoja de vida impecable, con foto perfecta, puede ser la puerta de entrada a una empresa. El Equipo Global de Investigación y Análisis de Kaspersky, conocido como GReAT, destapó la Operación FlashHole, activa desde julio de 2025, con al menos tres organizaciones afectadas en Corea del Sur. Las víctimas confirmadas trabajan en construcción, programas informáticos y fabricación de equipos de comunicaciones por cable. Kaspersky presentó los hallazgos en el Security Analyst Summit, celebrado en Bali, Indonesia, y atribuyó la campaña a Lazarus, grupo de amenaza persistente avanzada vinculado a Corea del Norte, con confianza media a alta.

Kaspersky researchers analyze Operation FlashHole – a recent complex attack by Lazarus, involving a sophisticated malware set, watering-hole technique and abuse of CrossWeb EX financial security softw...

Kaspersky atribuyó al grupo norcoreano una campaña contra organizaciones de Corea del Sur que usa el mecanismo ML-KEM, estandarizado para resistir ataques de computadoras cuánticas. Eso no significa que los atacantes tengan una computadora cuántica. (Fuente: BleepingComputer / Kaspersky) Investigadores de Kaspersky descubrieron que el grupo norcoreano Lazarus usa criptografía poscuántica en la entrega de sus cargas maliciosas, según BleepingComputer.

Experts have discovered a new Lazarus malware that secures its communication using post-quantum cryptography. However, the group is not only employing these new techniques. It is also generating applicant profiles using AI and thus conducting spear-phishing attacks. Furthermore, two previously unknown malware tools, TouchHub and ClientHub, have been discovered. As part of its cyber espionage campaign, "Operation FlashHole," the APT group Lazarus is using two previously undocumented malware tools as well as an advanced version of LPEClient. The latter uses post-quantum cryptography to secure communication with attackers. In addition, AI-generated applicant profiles and targeted spear-phishing attacks are employed to deceive potential victims. Read more

Experten haben eine neue Lazarus-Malware entdeckt die ihre Kommunikation per Post-Quanten-Kryptografie absichert. Die Gruppe setzt aber nicht nur diese neuen Techniken ein. Sie generiert auch Bewerberprofile mit Hilfe von KI und führt somit Spear-Phishing-Angriffe aus. Zudem wurden zwei bislang unbekannte Malware-Tools TouchHub und ClientHub entdeckt. Die APT-Gruppe Lazarus setzt im Rahmen ihrer Cyberspionage-Kampagne ‚Operation FlashHole‘ auf zwei bislang undokumentierte Malware-Tools sowie eine weiterentwickelte Version von LPEClient. Letztere nutzt Post-Quanten-Kryptografie, um die Kommunikation mit den Angreifern abzusichern. Zudem kommen KI-generierte Bewerberprofile und zielgerichtete Spear-Phishing-Angriffe zum Einsatz, um potenzielle Opfer zu täuschen... Der Beitrag Neue Lazarus-Malware kommuniziert gesichert per Post-Quanten-Kryptografie erschien zuerst auf B2B Cyber Security.