Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption

The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign called Operation FlashHole targeting at least three South Korean organizations in construction, software, and wire-communication equipment manufacturing sectors. The campaign has been active since at least July 2025 and was identified by Kaspersky. A notable characteristic of this campaign is the abuse of legitimate South Korean security software to deploy malware. The malware deployed uses post-quantum encryption, representing an advanced and forward-looking operational security measure by the threat actor. This campaign reflects Lazarus Group's continued focus on South Korean targets across multiple industry verticals.