Lazarus Uses Fake Résumé Sites to Spread Malware

North Korea-linked Lazarus targeted South Korean organizations with tailored phishing links leading to fake résumé and portfolio websites. The links started a malware infection chain by abusing widely used South Korean financial security software, showing how a convincing job-related lure can lead to a serious compromise.

Key findings

• Kaspersky attributed Operation FlashHole to the North Korea-linked Lazarus Group.
• The campaign targeted at least three South Korean organizations in construction, software, and telecom equipment manufacturing.
• Attackers used tailored spear-phishing links that led victims to fake résumé and portfolio websites.
• The infection chain abused INISAFE CrossWeb EX, financial security software used in South Korea, and deployed malware in memory.
• Lazarus used post-quantum ML-KEM-1024 encryption to protect command-and-control traffic.

Who’s being targeted

• Commonly targeted roles: Hiring managers, Recruiters, Human resources, Construction-sector employees, Software-sector employees, Telecom equipment manufacturing employees, IT and security teams.
• Affected industries: Construction, Software, Telecom equipment manufacturing.
• Attack channels: email, website.
• Impersonated: A job applicant or professional candidate.

Awareness takeaways

• Treat unexpected résumé and portfolio links as untrusted, even when they appear tailored to a real business need. Verify candidates through the organization’s established recruiting process before opening external links.
• Do not install, update, or approve software from a website reached through an unsolicited message; contact IT through known internal channels if a security component appears necessary.
• Give extra phishing training to employees in targeted industries and to staff who handle recruiting, because attackers can customize job-related messages for their intended victims.

Red flags to watch for

• An unexpected applicant link is sent instead of an attached résumé or an application through the normal recruiting system.
• The website asks to install, update, or run security software before showing the portfolio.
• The message is unusually tailored to the recipient or organization but arrives through an unverified channel.