Kaspersky's report of 21 October describes Lazarus approaching Korean firms through fake résumé sites, abusing the financial security software INISAFE CrossWeb EX for a multi-stage in-memory intrusion, and using ML-KEM-1024 post-quantum key exchange to protect its channels. On 1 November Korean outlets reported that the published indicators include a page of the Korean Society of Obstetrics and Gynecology used as a command server, which the society is now checking. The résumé photo is assessed as likely AI-generated, and at least three companies have been hit since July 2025.

[S1] Lazarus Operation FlashHole · [S2] 북한 해킹조직, 국내 학회·언론사 웹사이트 악용 정황 · [S3] 가짜 이력서로 접근한 北 해킹조직 기업 홈피 장악해 '통신거점' 사용

From developments to evidence and analysis

Background

No explicit relationship is recorded.

Evidence

No explicit relationship is recorded.

Follow-ups / later versions

No explicit relationship is recorded.

Related questions

Primary Cyber & critical infrastructure

Cite this article

AI & Security Observatory（2026-11-01）「ラザルスの「FlashHole」作戦、韓国の学会サイトを中継拠点に利用と報道　耐量子暗号とAI生成の履歴書を使用」『AI & Security Observatory』、第1.0版、最終更新2026-11-02。https://ai-security-observatory.org/ja/brief/brief-20261102-09/

AI & Security Observatory (2026-11-01). Korean press reports Lazarus “Operation FlashHole” used Korean academic and media websites as C2, with post-quantum encryption and AI-generated résumés . AI & Security Observatory, version 1.0. Updated 2026-11-02. https://ai-security-observatory.org/en/brief/brief-20261102-09/

BibTeX · JA · RIS · JA · BibTeX · EN · RIS · EN

Version 1.0 · Publication date 1 Nov 2026 · Updated 2 Nov 2026

Revision history
  1. Earlier revisions have not been recorded.