Lazarus Hackers Employ AI and Post-Quantum Encryption in Cyber Espionage

The North Korean hacker group Lazarus Group is using artificial intelligence and post-quantum cryptography in its cyber espionage campaign, Operation FlashHole. This was reported by experts from Kaspersky Lab.

According to Kaspersky’s Global Research and Analysis Team (GReAT), the attacks have been ongoing since at least July 2025. The hacking operations have affected at least three organizations in South Korea, including those in construction, software development, and wired communication equipment manufacturing.

The attacks began with targeted phishing emails containing links to fake websites featuring resumes and portfolios. One such site was hosted on GitHub Pages, with the applicant’s photo generated by AI. Researchers suggest that neural networks may have been used to tailor these fake pages to specific targets.

During the campaign, the attackers used legitimate software, CrossWeb EX, which is employed in South Korea for financial authentication. Researchers believe a potential vulnerability in the program may have helped the attackers infiltrate victims’ systems.

Experts discovered two previously unknown malicious tools, TouchHub and ClientHub. These tools allow the execution of commands on infected devices, installation of additional malware, and communication with operators. In one variant, Dropbox is used for communication with the attackers.

Researchers paid special attention to an updated version of the LPEClient tool. It uses ML-KEM-1024, a post-quantum key exchange mechanism designed to protect connections from potential future quantum computer attacks. This mechanism establishes an encrypted channel with the attackers’ server, allowing the malware to download and execute additional modules directly in memory.

According to Kaspersky Lab, the group has been using post-quantum cryptography since at least September 2024.

Previously, AI was identified as a more serious threat to cryptocurrencies than quantum computing, according to Mysten Labs.

Follow ForkLog on social media

Cybersecurity Experts Warn of New Wave of North Korean Hacker Attacks

North Korean Hackers Linked to $280 Million Drift DeFi Protocol Breach

User Hacks North Korean Hacker

North Korean Hackers Establish Fake Firms to Deceive Users

ZachXBT says he infiltrated $1B laundering network for Lazarus Group

Mysten Labs: AI in North Korean hackers’ hands is more dangerous than quantum computing

Lazarus Group Suspected in Bitrefill Cyberattack

Lazarus Group Implicated in $44 Million CoinDCX Hack

BitMEX Uncovers Operational Security Flaws in Lazarus Group