A North Korean state-linked hacking operation has begun combining artificial intelligence with encryption designed to survive the quantum computing era, according to new findings from Kaspersky Lab. The campaign, dubbed Operation FlashHole, has targeted at least three South Korean organizations since July 2025, spanning construction, software development, and telecommunications equipment manufacturing.
A Familiar Lure, Updated With AI
The attack chain begins with something cybersecurity professionals have seen for years: phishing emails built around fake job applications. What distinguishes this campaign is the craftsmanship behind the bait. Kaspersky's Global Research and Analysis Team found that victims were directed to counterfeit résumé and portfolio websites, one of which was hosted on GitHub Pages - a free platform normally used for legitimate project showcases. The applicant photo on that page appears to have been generated by artificial intelligence. Researchers believe neural networks may also have helped tailor the content of these fake pages to specific individuals, making the social engineering more convincing and harder to flag as fraudulent.
This matters because phishing has long relied on volume and generic templates, which trained employees can often spot. AI-assisted customization narrows that gap, producing lures that feel personally relevant to the recipient and therefore more likely to be trusted.
Exploiting Trusted Financial Software
Once a target engaged with the fake site, attackers moved to exploit CrossWeb EX, legitimate software widely used in South Korea for financial authentication. Kaspersky's researchers suspect a vulnerability in this program may have given Lazarus Group an entry point into victims' systems. Abusing trusted, locally mandated financial software is a notable escalation: it suggests the attackers studied the specific digital infrastructure South Korean institutions and employees are required to use, rather than relying on generic malware delivery methods.
From there, two previously undocumented tools - TouchHub and ClientHub - allowed operators to execute commands remotely, install further malware, and maintain communication with infected machines. One variant reportedly used Dropbox as a communication channel, a tactic that helps malicious traffic blend into ordinary cloud service activity and evade network monitoring tools tuned to flag suspicious destinations.
Why Post-Quantum Cryptography Changes the Threat Calculation
The most consequential detail concerns an updated version of the LPEClient tool, which uses ML-KEM-1024, a post-quantum key encapsulation mechanism. Standard encryption protocols in use today could theoretically be broken by a sufficiently powerful quantum computer, a capability that does not yet exist at scale but is actively being pursued by governments and research institutions worldwide. Post-quantum cryptography is designed to resist that future threat by relying on mathematical problems quantum algorithms are not expected to solve efficiently.
That Lazarus Group has been using such mechanisms since at least September 2024, according to Kaspersky, indicates a level of technical sophistication rarely associated with criminal or espionage-focused hacking groups. ML-KEM-1024 lets the malware establish an encrypted channel with attacker-controlled servers, through which additional malicious modules can be downloaded and run directly in a device's memory - leaving fewer traces on disk for defenders to find.
The implications extend beyond this single campaign. Security researchers at Mysten Labs have separately argued that artificial intelligence currently poses a more immediate risk to cryptocurrency systems than quantum computing does. Operation FlashHole suggests these two forces are converging rather than competing: AI is being used to make intrusion easier, while post-quantum cryptography is being adopted to make detection and interception harder, well ahead of when quantum computers capable of breaking current encryption are expected to exist.
What Organizations Should Take From This
- Phishing defenses must now account for AI-generated images and content that can defeat traditional visual or linguistic red flags.
- Software mandated for regulatory or financial compliance, such as authentication tools, deserves the same security scrutiny as general-purpose applications.
- Encrypted command-and-control traffic routed through legitimate cloud services is increasingly difficult to distinguish from normal business activity.
- State-linked groups adopting post-quantum cryptography years before quantum computers pose a practical threat signals long-term strategic planning that defenders need to match.
Operation FlashHole is a reminder that advanced persistent threats evolve in step with available technology. As AI tools become cheaper and more capable, and as post-quantum standards move from theoretical research into working exploits, the distance between cutting-edge cryptography and criminal misuse keeps narrowing.