# Lazarus Group Exploits South Korean Software for Advanced Malware Deployment

*Published October 28, 2026*
*Source: [https://thehackernews.com/2026/10/lazarus-abuses-south-korean-security.html](https://thehackernews.com/2026/10/lazarus-abuses-south-korean-security.html)*

## Executive Summary

The Lazarus Group has launched a new campaign, Operation FlashHole, exploiting South Korean financial security software to deliver malware through advanced techniques including post-quantum cryptography. This operation highlights the group's growing sophistication and the persistent threat they pose to South Korean industries.

## Article

The Lazarus Group, a cyber espionage entity linked to North Korea, has been implicated in a sophisticated campaign known as Operation FlashHole, targeting organizations in South Korea's construction, software, and wire-communication sectors. According to cybersecurity firm Kaspersky, the attacks have been active since July 2025, following up on a previous campaign named Operation SyncHole. This recent wave involves the exploitation of vulnerabilities in South Korean financial security software, specifically Initech's INISAFE CrossWeb EX, which is essential for online banking and government services.

The group's approach includes sending spear-phishing emails with links to sites that appear legitimate, such as job portfolios and resumes tailored to their targets. Once a victim visits these sites, a complex infection chain is initiated. This involves using legitimate Windows processes and sophisticated techniques like DLL sideloading to avoid detection, ultimately deploying malware such as TechHub and ClientHub. The campaign showcases the group's advanced operational methods, including the use of post-quantum cryptographic algorithms to secure communications with their command servers.

The attacks coincide with a broader campaign called Cascade Hole, which has been exploiting South Korean software for malware distribution. Previous exploits by Lazarus have involved similar tactics, including leveraging vulnerabilities in software like Cross EX and AnySign4PC. The group's activities have resulted in the exfiltration of sensitive data, with some leaks appearing on the dark web.

Kaspersky highlights the significance of Lazarus's use of post-quantum cryptography, which began as early as September 2024, to protect their malware operations from future quantum computing threats. This development underlines the evolving sophistication of the group's strategies and their ongoing threat to South Korean organizations.