A North Korean state-linked hacking group has begun combining artificial intelligence with post-quantum cryptography to breach corporate networks in South Korea, according to researchers at Kaspersky Lab. The campaign, dubbed Operation FlashHole, has targeted at least three organizations since July 2025, spanning construction, software development, and telecommunications equipment manufacturing. The findings suggest that Lazarus Group, long known for financially motivated cybercrime and espionage, is adopting defensive technologies originally designed to protect systems from future quantum-computing threats - and turning them toward offense.
Fake Résumés, Real Breaches
Kaspersky's Global Research and Analysis Team traced the intrusions to a familiar but increasingly refined tactic: spear-phishing emails directing victims to fraudulent websites disguised as job applicants' résumés and portfolios. One such page was hosted on GitHub Pages, a legitimate platform often used for personal or project websites, lending the fake site an air of credibility. The applicant's photograph on the page was generated by artificial intelligence, and researchers believe neural networks may also have been used to customize the content of these decoy pages for specific targets - a level of personalization that makes the lures harder to spot than generic phishing attempts.
Once a victim engaged with the fake site, the attackers pivoted to exploiting CrossWeb EX, a legitimate financial authentication program widely used in South Korea. Researchers suspect an unpatched vulnerability in the software may have given the group a foothold inside victims' systems, a technique consistent with Lazarus Group's history of abusing trusted local software to bypass security defenses that would normally flag unfamiliar applications.
New Tools, Familiar Playbook
Analysts identified two previously undocumented malicious tools, named TouchHub and ClientHub, used during the campaign. Both allow attackers to issue remote commands on compromised devices, deploy additional malware, and maintain communication with operators. In at least one variant, the malware relayed stolen data and instructions through Dropbox, exploiting the fact that traffic to mainstream cloud services rarely triggers alarms in corporate security systems - a technique that lets malicious activity hide in plain sight among legitimate network traffic.
The Quantum-Safe Twist
The most notable element of the campaign is an updated version of LPEClient, a tool Lazarus Group has used in previous operations. This version incorporates ML-KEM-1024, a key-encapsulation mechanism built on lattice-based mathematics and standardized as part of the post-quantum cryptography effort led by the US National Institute of Standards and Technology. Unlike conventional encryption methods such as RSA, which could theoretically be broken by a sufficiently powerful quantum computer, ML-KEM is designed to resist attacks from both classical and quantum machines.
In Operation FlashHole, this mechanism is used to establish an encrypted channel between infected machines and the attackers' command servers, allowing additional malicious modules to be downloaded and executed directly in memory - a method that leaves fewer traces on disk and complicates forensic analysis. Kaspersky notes that Lazarus Group has been experimenting with post-quantum cryptography since at least September 2024, suggesting a sustained, deliberate investment rather than a one-off experiment.
Why It Matters
The adoption of quantum-resistant encryption by a cybercriminal and espionage operation is a reminder that defensive innovations in cryptography inevitably attract offensive interest as well. Post-quantum standards were developed to protect sensitive communications against a future in which quantum computers could break today's encryption; here, the same mathematics is being used to shield attacker infrastructure from detection and interception by defenders and law enforcement. Combined with AI-assisted social engineering, the campaign illustrates how state-linked groups are professionalizing their operations, narrowing the gap between cutting-edge academic cryptography and real-world criminal tradecraft. Separately, researchers at Mysten Labs have argued that artificial intelligence currently poses a more immediate risk to cryptocurrency security than quantum computing - a view that Operation FlashHole, with its blend of both technologies, does little to contradict.