Lazarus abuses South Korean security software to deliver malware
Kaspersky attributes Operation FlashHole, active since at least July 2025, to Lazarus, which targeted at least three South Korean organizations in construction, software and wire-communications equipment manufacturing through INISAFE CrossWeb EX.
The attackers sent tailored emails linking to fabricated résumé or portfolio pages, then abused INISAFE CrossWeb EX—a financial-security tool used for banking and government access—to help deliver malware. Kaspersky also reports post-quantum cryptography in the malware’s communications: encryption designed to resist attacks from future quantum computers. Lazarus had used it by September 2024, so it was not new to FlashHole.
Because the utility supports access to widely used services, it can be present on workstations beyond the three reported targets. For organizations whose staff use it, FlashHole shows how a tailored link and trusted local software can combine in an espionage infection chain; the reporting does not establish broader compromise.