A cyber espionage campaign attributed by Kaspersky to the North Korea-linked Lazarus Group reportedly targeted organisations in South Korea by abusing legitimate security software to deploy malware. The activity, described as Operation FlashHole, affected at least three organisations in construction, software, and wire-communication equipment manufacturing.

While the reported victims are in South Korea, the broader lesson is relevant for European businesses: software that is normally trusted inside corporate environments can become an attack path if third-party tools, update mechanisms, or endpoint controls are not closely managed.

What happened

According to Kaspersky, the campaign has been active since at least July 2025 and has been attributed to Lazarus, a threat group widely associated with North Korean state-linked operations. The researchers said the attackers abused South Korean security software as part of the infection chain and used malware incorporating post-quantum cryptography.

Based on the source report, the known targets were limited to at least three South Korean organisations across multiple industries. The available information points to espionage activity rather than a broad financially motivated ransomware campaign.

The reference to post-quantum encryption does not mean mainstream business systems are suddenly protected or broken by quantum computing. In this context, it refers to the attackers using newer cryptographic methods inside their malware, which can make analysis and interception more difficult for defenders.

Why it matters for European businesses

This case matters because many European companies rely on a large mix of endpoint protection tools, remote management software, identity agents, browser security tools, VPN clients, and sector-specific software that often run with elevated privileges. If attackers can exploit trust in those tools, they may gain an effective route into internal systems without using more obvious malware delivery methods.

For SMEs, the main issue is not the specific South Korean software named in the original reporting, but the attack pattern:

• Trusted software can become a weak point if deployment tools, update paths, or local privileges are not tightly controlled.
• Security tooling itself needs scrutiny; products installed for protection can also expand the attack surface if not monitored.
• Advanced threat actors are adapting, including by using more sophisticated cryptography and stealth techniques that can complicate detection and forensic work.
• Supply-chain and third-party software risk remains high, especially for businesses with many local agents, plugins, and administrative tools across endpoints.

For regulated organisations and companies covered by stricter cybersecurity expectations, the incident also reinforces the importance of software inventory, incident response readiness, and vendor risk management.

Who may be affected

The immediate victims named in the reporting were South Korean organisations, but similar attack methods are relevant for a wider set of European businesses, especially:

• manufacturing and industrial companies using specialist desktop or network software,
• software companies with developer endpoints and privileged internal tools,
• IT-managed SMEs with multiple endpoint agents and remote administration products,
• businesses operating across international supply chains,
• regulated firms that must demonstrate stronger cyber resilience and third-party oversight.

Digital agencies, e-commerce businesses, and service companies should also pay attention if they rely on numerous SaaS connectors, browser extensions, local sync tools, or outsourced IT support with broad device access.

What companies should consider

• Review trusted software inventory and identify which endpoint tools, agents, and security products have elevated privileges or broad access.
• Limit unnecessary admin rights on user devices and service accounts to reduce the impact of abused software components.
• Strengthen application control so only approved software and signed components can run where practical.
• Monitor software behaviour, not only malware signatures, including unusual child processes, persistence mechanisms, lateral movement, and unexpected network connections.
• Assess vendor and supply-chain risk for security tools and other business-critical software, including update mechanisms and support access.
• Prepare for stealthier intrusions by improving logging, endpoint detection, threat hunting, and incident response playbooks.
• Segment sensitive systems so compromise of one endpoint agent or workstation does not easily expose core business systems.

At this stage, the reporting supports a practical takeaway rather than a Europe-specific alert: businesses should not assume that software is safe simply because it is widely deployed or security-related. The operational priority is to verify what runs in the environment, what privileges it has, and how quickly suspicious activity around trusted tools can be investigated.