Lazarus group uses AI and post-quantum cryptography in its cyberattacks

Kaspersky’s investigation reveals Lazarus’s use of new malware, cloud-based command-and-control, and quantum-resistant cryptography.

Kaspersky has identified a cyberespionage campaign attributed to the Lazarus advanced persistent threat (APT) group, dubbed Operation FlashHole. Active since at least July 2025, the campaign has affected at least three organisations in South Korea across the construction, software and wire-communications equipment manufacturing sectors.

The attackers used targeted phishing emails and fraudulent CV and portfolio websites to lure victims. Researchers also identified a potential exploitation route involving CrossWeb EX, legitimate security and web authentication software widely used in South Korea.

The campaign combines updated malware with two previously undocumented tools, TouchHub and ClientHub, which allow attackers to execute commands, deploy additional malware and communicate with compromised systems. Researchers found indications that AI was used to generate profile photographs and tailor fraudulent websites to individual targets. The operation builds on techniques associated with earlier Lazarus campaigns , including Operation DreamJob and Operation SyncHole.

A key finding is an updated version of LPEClient, a Lazarus tool that collects system information and delivers additional malware. The new version uses ML-KEM-1024, a post-quantum cryptographic mechanism standardised to help protect communications against potential attacks from future quantum computers . It establishes a shared secret for an encrypted connection with an attacker-controlled server before downloading and executing additional payloads in memory.

Kaspersky researchers traced the group’s use of post-quantum cryptography in malware communications to at least September 2024. Kaspersky recommends that organisations patch vulnerable software, train employees to recognise targeted phishing attempts, restrict user privileges and monitor cloud services that could be abused for command-and-control communications.

The campaign illustrates how cyberespionage groups are adopting AI-assisted social engineering and post-quantum cryptography alongside evolving malware. The immediate concern is that malicious actors are using these mechanisms to protect their own communications from interception and analysis. Security teams therefore need to consider both sides of the transition to post-quantum cryptography: protecting legitimate systems against future quantum threats and understanding how malicious actors are already adopting the technology.