Lazarus Group Exploits South Korean Security Software in Operation FlashHole Campaign
North Korea-linked threat actor uses post-quantum encryption to target strategic sectors, Kaspersky reports
Key Takeaways
- Lazarus Group attributed to Operation FlashHole targeting South Korea.
- Campaign active since at least July 2025.
- Targets construction, software, and wire-communication equipment manufacturing sectors.
- Malware deployed via abuse of South Korean security software.
Related Security News
FBI Attributes Record $6.43 Billion Binance Heist to North Korea-Aligned TraderTraitor
The U.S. Federal Bureau of Investigation, in coordination with the U.S. Secret Service and IRS Criminal Investigation, has officially attributed a cryptocurrency theft exceeding $6.43 billion from Binance to the North Korea-aligned hacking group TraderTraitor. The group, also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899, is assessed to be among the most sophisticated and financially motivated actors associated with the Democratic People's Republic of Korea. The attribution was made public on November 1, 2026. The scale of the theft, if verified, would represent the largest single financial loss attributed to North Korea-linked actors to date. Technical details of the exploitation method were not disclosed in the FBI's announcement, though the agency indicated the investigation remains ongoing. The advisory highlights the growing threat to the global cryptocurrency ecosystem and the need for enhanced security measures across exchanges and wallet providers.
