The Lazarus group has been linked to Operation FlashHole, a targeted espionage campaign active since July 2025 against South Korean organizations.
The multi-stage infection chain exploits vulnerabilities in financial security software, uses native Windows processes for execution, and relies on external platforms for command and control.
According to Russian security firm Kaspersky, this operation has been active since at least July 2025. The perpetrators send targeted emails containing links to fake websites and fake resumes.
How to set the trap
The attack exploits vulnerabilities in mandatory financial security and authentication software, such as INISAFE CrossWeb EX. To hide their tracks, the malicious programs execute directly in the computer's memory upon initial penetration, leveraging legitimate Windows processes with obfuscation techniques.
The attackers' tools then communicate with external servers and popular services, such as GitHub and Dropbox, to receive instructions.
New encryption technologies
A special feature of this campaign is that the perpetrators adopted an advanced post-quantum encryption algorithm, known as ML-KEM-1024, to protect their server connections until at least September 2024.
READ ALSO
How artificial intelligence helps fraudsters steal corporate passwords
Similar attacks by the same group are linked to previous data leaks on dark web sites.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
end of article
Top comments (0)