For awareness Medium Monitor
Lazarus spies on South Korean firms using abused security software
The Hacker NewsKaspersky · construction, manufacturing
What happened. Kaspersky attributes Operation FlashHole to North Korea-linked Lazarus Group. It targets at least three South Korean organisations in construction, software and wire-communication equipment manufacturing. The campaign has been active since at least July 2025.
Who is affected. At least three South Korean organisations in the construction, software and wire-communication equipment manufacturing sectors. The source does not name them.
What to do. Brief your security team on Operation FlashHole and review the Kaspersky report for indicators of compromise to check against your logs.
When to act. For awareness: no sign it reaches your site
Editor's reading
Fordetection engineerIT security
- Purdue level
- L4
Why: This is cyber espionage against organisations' corporate systems (L4). The report does not describe any OT-specific tooling.
- Are you exposed?
Compare the indicators in the Kaspersky report with your endpoint and network logs, especially for South Korean security software.
- If you cannot fix it yet
- Allowlist approved security software and its update paths on office systems.
- Keep IT-to-OT access limited to approved jump hosts so an office compromise cannot reach plant systems.
- Watch for
- Security software on office systems launching unexpected child processes or loading unfamiliar files.
- Outbound connections from enterprise hosts to destinations listed in the Kaspersky indicators.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: The Hacker News (opens thehackernews.com)
More on Manufacturing