Lazarus APT Group Launches AI-Driven Cyberespionage Campaign

• •Lazarus APT group's Operation FlashHole targets South Korean organizations.
• •Attack methods include AI-generated phishing websites and exploitation of CrossWeb EX vulnerabilities.
• •New tools TouchHub and ClientHub enhance malware delivery and command execution.

Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since at least July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attackers employed spear-phishing tactics, utilizing fraudulent CV and portfolio websites to lure victims. A potential exploitation vector involves vulnerabilities in CrossWeb EX software, widely used in South Korea. The campaign features updated malware and two new tools, TouchHub and ClientHub, which facilitate command execution and malware deployment. AI was reportedly used to generate fake profile photos and tailor phishing websites. Additionally, the updated LPEClient tool employs post-quantum cryptography to secure communications with attackers. Kaspersky recommends organizations patch vulnerabilities, train employees on phishing recognition, and monitor cloud services for potential abuse.