A North Korean state-linked hacking group has begun combining artificial intelligence with post-quantum cryptography to conceal its espionage operations, according to researchers at Kaspersky Lab. The campaign, dubbed Operation FlashHole, has targeted at least three South Korean organizations since July 2025, spanning construction, software development, and telecommunications equipment manufacturing.
How the attacks unfold
Kaspersky's Global Research and Analysis Team found that the intrusions began with carefully targeted phishing emails directing victims to fraudulent websites built around fake resumes and professional portfolios. One such page was hosted on GitHub Pages and featured a photo of an "applicant" generated by artificial intelligence. Researchers believe neural networks may have been used to customize these decoy pages for individual targets, a tactic that suggests a more automated, scalable approach to social engineering than earlier Lazarus campaigns.
Once inside a network, the attackers exploited CrossWeb EX, legitimate software widely used in South Korea for financial authentication. Investigators suspect a vulnerability in the program may have given the hackers a foothold into victims' systems, turning a trusted financial tool into an entry point for espionage.
New malware and a quantum-era defense
Kaspersky identified two previously undocumented malicious tools, named TouchHub and ClientHub, which allow attackers to execute remote commands, deploy additional malware, and maintain communication channels with their command infrastructure. One variant was found using Dropbox as a covert communication channel, blending malicious traffic with ordinary cloud-service activity to avoid detection.
The most striking element of the campaign is an updated version of the LPEClient tool, which now uses ML-KEM-1024, a post-quantum key exchange mechanism standardized to resist decryption by future quantum computers. This mechanism builds an encrypted channel to the attackers' server, through which additional malicious modules can be downloaded and run directly in a device's memory, leaving minimal traces on disk. Kaspersky notes that Lazarus has been experimenting with post-quantum cryptography since at least September 2024, placing the group among the earliest known adopters of such techniques outside legitimate industry and research contexts.
Why this matters beyond one campaign
Post-quantum cryptography exists to protect data against a threat that is still largely theoretical: a sufficiently powerful quantum computer capable of breaking today's standard encryption. That a state-sponsored hacking group is already deploying such safeguards for its own infrastructure, well ahead of widespread civilian adoption, signals both technical sophistication and a long-term view of operational security. It also complicates detection efforts, since defenders accustomed to identifying conventional encryption patterns now face traffic designed to resist both current and future cryptanalysis.
The use of AI-generated personas and tailored phishing content points to a broader trend already noted elsewhere in the security community. Mysten Labs has previously argued that artificial intelligence poses a more immediate risk to cryptocurrency systems than quantum computing itself, precisely because AI lowers the cost and effort of crafting convincing, individualized deception at scale. Operation FlashHole appears to validate that concern in practice: the technology enabling more persuasive fake identities is being deployed well before quantum computing becomes a practical offensive tool.
For organizations in finance, software development, and critical infrastructure, the episode underscores a familiar lesson in a new form: legitimate, trusted software can become a liability if left unpatched, and recruitment-themed phishing remains a durable entry vector precisely because it exploits ordinary professional trust rather than technical ignorance.