Lazarus Group Targets South Korean Organizations in Operation FlashHole

# Lazarus Group Targets South Korean Organizations in Operation FlashHole

https://gcdradar.vercel.app/incidents/lazarus-group-targets-south-korean-organizations-in-operatio · AIR-2026-1577 · closed 2026-11-10

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation): Confirmed real-world targeted intrusion campaign by a known threat group.
- Fix status: No fix needed
- First reported: 2026-10-27 (happened 2025-07)
- AI role: No AI role
- Products: South Korean Security Software

## Summary

The Lazarus Group is carrying out a cyber espionage campaign dubbed Operation FlashHole against South Korean organizations in the construction, software, and wire-communication sectors. The campaign uses compromised South Korean security software to deploy malware protected by post-quantum encryption.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-10-27: Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption (https://thehackernews.com/2026/10/lazarus-abuses-south-korean-security.html)

## Sources

- 2026-10-27 The Hacker News: Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption https://thehackernews.com/2026/10/lazarus-abuses-south-korean-security.html

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.