Skip to content

Breaches and incidentsBriefChecked against a primary source

Lazarus “Operation FlashHole” against South Korean firms

Kaspersky: at least three South Korean organizations (construction, software, wire-communication equipment) targeted since at least July 2025.

Disclosed: 21 Oct 2026

What happened

Technique: spear-phishing to fake portfolio and CV sites, likely abusing the CrossWeb EX browser plugin (possible vulnerability); updated LPEClient using ML-KEM-1024 to set up its C2 channel; new TouchHub and ClientHub tools; Dropbox and GitHub Pages C2; AI-generated lure persona.
Attribution: Kaspersky attributes to Lazarus.

Sources

https://www.kaspersky.com/about/press-releases/kaspersky-identifies-new-lazarus-apt-campaign-utilizing-ai-and-post-quantum-encryption

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.