Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption

The Lazarus Group, linked to North Korea, has been identified as the actor behind a cyber espionage campaign called Operation FlashHole. This campaign has targeted at least three organizations in South Korea, across various sectors including construction, software, and wire-communication equipment manufacturing. The campaign is believed to have been active since at least July 2025, according to Kaspersky, a Russian cybersecurity company. The group is utilizing post-quantum encryption to deploy malware, and is also abusing South Korean security software as part of its tactics.