Lazarus Abuses South Korean Security Software to Deploy Malware With Post-Quantum Encryption

The North Korea-linked Lazarus Group has been linked to Operation FlashHole, a cyber espionage campaign targeting at least three organizations in South Korea across construction, software, and wire-communication equipment manufacturing. Kaspersky says the campaign has been active since at least July 2025 and abuses South Korean security software to deliver malware using post-quantum encryption.

• Operation FlashHole active since at least July 2025
• At least three South Korean organizations targeted
• Sectors: construction, software, telecom equipment
• Campaign attributed to North Korea's Lazarus Group