Kaspersky identifies new Lazarus APT campaign utilizing AI and post

At the Security Analyst Summit in Bali, Indonesia, Kaspersky’s Global Research and Analysis Team (GReAT) presented findings on Operation FlashHole, a cyberespionage campaign attributed to the Lazarus APT group. Active since at least July 2025, the campaign has already affected at least three organizations in South Korea across the construction, software and wire-communication equipment manufacturing sectors. The attackers used spear-phishing, abuse of legitimate CrossWeb EX software and deployed updated malware, including previously undocumented tools.

Kaspersky GReAT has uncovered a new wave of attacks linked to Lazarus’s Operation SyncHole, first discovered last year. The attackers have since evolved their tools and techniques, making the campaign more persistent and sophisticated.

As a part of the campaign, the researchers uncovered a GitHub Pages website linked to a GitHub account used as a command-and-control (C2) channel. Created in September 2025, the account initially hosted a website featuring the CV of a purported senior network-appliance developer — a lure consistent with Operation DreamJob, Lazarus’s signature job-themed campaign. The page included an AI-generated photograph of a purported job seeker. Kaspersky researchers believe the attackers also used AI to tailor the fraudulent websites to their targets. The campaign began with spear-phishing emails containing links to fabricated portfolio and CV websites tailored to individual targets.

The research results showed a high possibility that visiting the malicious site initiated an infection process involving CrossWeb EX software, a security plugin and web authentication software widely used in South Korea. The malicious activity may have been enabled by a potential vulnerability in CrossWeb EX software, which could have provided an initial entry point for the attackers. Notably, previously a security advisory was published, confirming the existence of a vulnerability in the financial security software. Through extensive analysis, researchers identified multiple malicious payloads and reconstructed the infection chain, revealing a sophisticated malware delivery framework and advanced techniques for concealing malicious activity on targeted systems.

The attackers combined updated versions of their existing malware with two previously undocumented tools — TouchHub and ClientHub. These components install additional malware, execute commands on infected computers and communicate with the attackers with the ultimate goal of cyberespionage. One of the new tools has a variant that uses Dropbox to communicate with its operators. The campaign also uses an updated version of LPEClient, a longstanding Lazarus tool that collects information infected computers and delivers additional malware. The new version gathers details installed security software, Windows security protections and other system characteristics, then compresses and encrypts the information before sending it to the attackers.

The updated LPEClient also uses ML-KEM-1024, a post-quantum cryptographic mechanism designed to protect communications against potential attacks by future quantum computers. It uses this mechanism to establish an encrypted connection with the attackers’ server before downloading and running additional malware directly in memory. To evade detection, it also attempts to bypass security monitoring by changing memory protections and disabling a monitoring hook that security tools use to detect suspicious system activity.

“ Lazarus continues to expand its operations, launches new campaigns while introducing new tools and reworking familiar ones to meet its needs. Our analysis of Operation FlashHole, along with evidence from investigations, suggests that the group is also bringing AI into its long-established playbook, a shift we have observed among other threat actors aligned with Lazarus. What deserves closer attention is Lazarus’s adoption of cryptography designed to withstand future quantum threats. Our findings trace its use back to at least September 2024, showing that these capabilities were already protecting the group’s malware communications more than a year before this disclosure, ” says Sojun Ryu, senior security researcher at Kaspersky GReAT.

The full report is available on Securelist.com .

To stay protected from Lazarus attacks and campaigns such as Operation FlashHole, organizations are advised to follow these best practices:

Train employees to recognize targeted phishing attempts. Verify unexpected emails and links, even when they lead to convincing professional websites, and report suspicious messages to the security team.

Train employees to recognize targeted phishing attempts. Verify unexpected emails and links, even when they lead to convincing professional websites, and report suspicious messages to the security team.

Keep software up to date and apply security patches promptly. Regularly assess vulnerabilities in business-critical applications and disable unnecessary components to reduce the risk of exploitation.

Keep software up to date and apply security patches promptly. Regularly assess vulnerabilities in business-critical applications and disable unnecessary components to reduce the risk of exploitation.

Restrict user privileges and monitor connections to cloud services that could be abused for command and control.

Restrict user privileges and monitor connections to cloud services that could be abused for command and control.

To protect the company against a wide range of threats including tools used in Operation FlashHole, use solutions from the Kaspersky product line that provide real-time protection, threat visibility, investigation and the response capabilities of EDR and XDR for organizations of any size and industry. Depending on your current needs and available resources, you can choose the most relevant product tier and easily migrate to another one if your cybersecurity requirements are changing.

To protect the company against a wide range of threats including tools used in Operation FlashHole, use solutions from the Kaspersky product line that provide real-time protection, threat visibility, investigation and the response capabilities of EDR and XDR for organizations of any size and industry. Depending on your current needs and available resources, you can choose the most relevant product tier and easily migrate to another one if your cybersecurity requirements are changing.

Adopt managed security services by Kaspersky such as Compromise Assessment , Managed Detection and Response (MDR) and / or Incident Response , covering the entire incident management cycle – from threat identification to continuous protection and remediation. They help to protect against evasive cyberattacks, investigate incidents and provide additional expertise even if a company lacks cybersecurity workers.

Adopt managed security services by Kaspersky such as Compromise Assessment , Managed Detection and Response (MDR) and / or Incident Response , covering the entire incident management cycle – from threat identification to continuous protection and remediation. They help to protect against evasive cyberattacks, investigate incidents and provide additional expertise even if a company lacks cybersecurity workers.

Provide your InfoSec professionals with an in-depth visibility into cyberthreats targeting your organization. Kaspersky Threat Intelligence provides rich and meaningful context across the entire incident management cycle and helps identify cyber risks in a timely manner.

Provide your InfoSec professionals with an in-depth visibility into cyberthreats targeting your organization. Kaspersky Threat Intelligence provides rich and meaningful context across the entire incident management cycle and helps identify cyber risks in a timely manner.

the Global Research & Analysis Team

Established in 2008, Global Research & Analysis Team (GReAT) operates at the very heart of Kaspersky, uncovering APTs, cyber-espionage campaigns, major malware, ransomware and underground cyber-criminal trends across the world. Today GReAT consists of 35+ experts working globally – in Europe, Russia, Latin America, Asia and the Middle East. Talented security professionals provide company leadership in anti-malware research and innovation, bringing unrivaled expertise, passion and curiosity to the discovery and analysis of cyberthreats.