A North Korean state-linked hacking operation has begun combining artificial intelligence with post-quantum cryptography, a pairing that signals a notable shift in how advanced persistent threat groups are preparing for the future of digital espionage. Researchers at Kaspersky Lab's Global Research and Analysis Team say the campaign, dubbed Operation FlashHole and attributed to the Lazarus Group, has been active since at least July 2025 and has already struck organizations in South Korea's construction, software development, and telecommunications equipment sectors.
A Familiar Lure, Sharpened by AI
The intrusions reportedly began the way many Lazarus campaigns do: through targeted phishing emails. But the bait has evolved. Victims were directed to fake websites mimicking resumes and professional portfolios, built to look convincing enough to pass casual scrutiny. One such page was hosted on GitHub Pages, a free service commonly used for legitimate project sites, which likely helped it avoid immediate suspicion. The applicant photo on that page was AI-generated, and Kaspersky researchers believe neural networks may have been used more broadly to customize these decoy pages for specific individuals or organizations - a level of personalization that makes social engineering harder to spot and easier to scale.
The group also appears to have exploited CrossWeb EX, legitimate software widely used in South Korea for financial authentication. A possible vulnerability in that program may have served as an entry point, a detail that underscores a recurring theme in the region's threat landscape: attackers repeatedly targeting the specialized authentication and security software that South Korean banks and institutions require users to install.
New Tools for Remote Control
Kaspersky's investigation uncovered two previously undocumented malicious tools, named TouchHub and ClientHub. Both allow attackers to execute commands remotely, deploy additional malware, and maintain communication with infected machines. In at least one variant, the malware used Dropbox as a communication channel with its operators - a tactic that helps malicious traffic blend into ordinary cloud-service activity and complicates detection by network monitoring tools.
Why Post-Quantum Cryptography Matters Here
The most striking element of the campaign involves an updated version of a known Lazarus tool called LPEClient. This version incorporates ML-KEM-1024, a key encapsulation mechanism designed to resist attacks from future quantum computers. Quantum machines capable of breaking today's standard encryption do not yet exist at scale, but intelligence services and cybercriminal groups alike are increasingly preparing for that eventuality, partly out of concern that encrypted data intercepted now could be decrypted later once quantum capabilities mature - a strategy often described as "harvest now, decrypt later."
By building an encrypted channel with ML-KEM-1024, the malware can download and run additional modules directly in a device's memory, leaving less forensic trace on disk. Kaspersky notes that Lazarus has been using post-quantum cryptography since at least September 2024, suggesting this is not an experimental one-off but a sustained investment in next-generation defensive-offensive tradecraft, adopted well ahead of most commercial software.
A Broader Pattern of Technological Adaptation
The convergence of AI-assisted social engineering and quantum-resistant encryption illustrates how state-sponsored actors continue to adopt emerging technologies faster than many defenders anticipate. Separately, researchers at Mysten Labs have argued that artificial intelligence currently poses a more immediate risk to cryptocurrency systems than quantum computing itself - a reminder that AI-driven attacks, not just theoretical quantum breakthroughs, are already reshaping the threat environment organizations must plan for today.