The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors.
According to Russian cybersecurity company Kaspersky, the campaign has been active since at least July 2025. It's assessed to pick up from where Operation SyncHole left off.
"The group targeted victims more selectively, sending spear‑phishing emails with links to fabricated but relevant sites, such as portfolio and résumé pages tailored to each target," Sojun Ryu, senior security researcher at Kaspersky GReAT, said in an exhaustive analysis.
Operation SyncHole was first documented by Kaspersky in April 2025, detailing the state-sponsored adversary's targeting of South Korea's software, IT, financial, semiconductor manufacturing, and telecommunications industries since November 2024 to deliver malware such as ThreatNeedle, AGAMEMNON, wAgent, SIGNBT, and COPPERHEDGE.
The attacks were characterized by the exploitation of a security flaw in iniLINE Cross EX for malware delivery. Cross EX is a mandatory financial security software program installed by South Korean internet users on their computers to support security software across various browser environments when accessing online banking and government services.
The exploit was designed to launch the legitimate "SyncHost.exe" process and inject shellcode into it to load the ThreatNeedle backdoor. The attack chain also incorporated a one-day vulnerability in the Innorix Agent file transfer solution version 9.2.18.496 for lateral movement.
Operation FlashHole continues the prior wave's targeting of South Korea-focused software to breach targets. Where SyncHole exploited Cross EX, FlashHole has been found to abuse Initech's INISAFE CrossWeb EX, another mandatory financial security solution necessary to access online banking and government portals in the country.
According to iniLINE's website, the company entered into a strategic alliance with Initech as far back as 2010 to develop CrossWeb. It's currently marketed by Initech as a certificate-based authentication and electronic-signature solution.
That said, the Lazarus Group has a long history of abusing this software to meet its goals. In Q3 2021, it was used to deploy a downloader named Racket in connection with a long-running campaign called DeathNote.
 |
| Operation FlashHole attack flow during initial compromise |
Between 2022 and 2023, AhnLab also disclosed attacks in which the threat actor exploited a security flaw in the software to distribute DLL malware ("SCSKAppLink.dll") via watering hole attacks, with the DLL payload retrieved from IIS web servers compromised by the threat actor.
"The group first hacks Korean websites and modifies the content provided from the site," AhnLab noted in a July 2023 report. "When a system using a vulnerable version of INISAFE CrossWeb EX V6 visits this website via a web browser, the Lazarus malware (SCSKAppLink.dll) is installed from the distribution site through the INISAFECrossWebEXSvc.exe vulnerability."
 |
| Initial infection chain |
The findings also come against the backdrop of a joint July 2026 advisory published by the Korea Internet and Security Agency (KISA) and domestic cybersecurity vendors, highlighting the Lazarus Group's exploitation of vulnerabilities in such financial security programs like AnySign4PC to distribute backdoors like Struggle (aka SIGNBT 3.0) and Brandoor (aka COPPERHEDGE) after tricking victims into visiting malicious URLs through spear-phishing and watering hole techniques.
"The attackers induced targets to access malicious URLs through various methods, including watering hole and spear-phishing attacks, and then exploited the vulnerabilities to ultimately install backdoor malware," AhnLab said, calling the campaign Operation Double Barrel.
The precise initial access vector for FlashHole is unclear, but signs point to malicious websites hosted on GitHub pages, one version of which hosted the résumé of a senior network appliance developer along with a profile photo likely generated using artificial intelligence (AI).
 |
| Expanded infection chain after gaining persistence |
It's suspected that targets are sent spear-phishing emails containing links to the malicious site, visiting which triggers an infection sequence involving CrossWeb EX to launch the legitimate Windows binary "fsquirt.exe," which is then used to launch a malicious DLL called TechHub via DLL sideloading.
"The infection chain is rather complex and reveals the Lazarus Group's advanced operational techniques on targeted hosts," Kaspersky said. "These techniques conceal their malicious payloads, intent, and their sophisticated malware delivery framework."
"Significantly, the execution chain below exists only in memory during the initial infiltration, highlighting the attackers' considerable efforts to hide the initial compromise."
TechHub, for its part, downloads from GitHub a malware called TouchHub, which leverages a DLL sideloading a second to launch a rogue DLL payload dubbed TOUCHSHIFT ("mscoree.dll") for setting up persistence by kicking off the in‑memory execution of another TechHub instance.
 |
| Overlaps between Lazarus Group Attacks |
This second TechHub instance retrieves another malware family known as ClientHub to download and load LPEClient into memory. LPEClient serves as a conduit for Cubridge, the orchestration component of the malware framework designed to fetch various plugins, modules, and tools.
Additional details about the malware toolset is as follows -
- TechHub, an advanced version of the CLOUDBURST and NickelLoader downloader that communicates with GitHub to fetch additional payloads like TouchHub and ClientHub, as well as collect information about the device and its running processes.
- Cubridge, an improved version of SIDESHOW and LightlessCan capable of communicating with a command-and-control (C2) server and downloading reusable plugins, DLL utilities for one-off tasks, and additional modules to expand its functionality, thereby allowing it to gather comprehensive system information, run commands, and steal files and web browser data. It's also assessed to be an advanced version of CookiePlus.
- TouchHub, a parent installer for TouchShift.
- TouchShift, a malware dropper capable of delivering keyloggers, screenshot utilities, and backdoors,
- ClientHub, a previously undocumented backdoor that comes in two versions: one that communicates with an attacker controlled server, using HTTPS and another that interacts with the Dropbox API. The end goal of the malware is to deploy additional plugins and DLLs. The plugins allow the malware to create ZIP archives, collect files matching a search pattern, delete specific files, and monitor local drive changes and return the collected status information.
- LPEClient, a longstanding victim profiling and payload delivery tool used since 2019.
In August 2026, Check Point revealed that LPEClient was deployed following the zero-day exploitation of CVE-2026-68820, a privilege escalation flaw affecting Windows Ancillary Function Driver for WinSock, to deploy the FudModule rootkit.
What's notable about the latest version of the malware is that it uses ML-KEM-1024, a post-quantum cryptographic algorithm, to establish an encrypted connection with the attackers' server before downloading and running additional malware directly in memory.
"Operation FlashHole is the latest wave in the broader Cascade Hole campaign, which involves the use of South Korean software as a potential entry point to deliver malware targeting the country," Kaspersky said.
The cybersecurity company said the emergence of Operation FlashHole coincided with a fresh wave of attacks targeting various South Korean organizations using the COPPERHEDGE backdoor. In at least one case, the backdoor infection is said to have resulted in the exfiltration of data to a dark web leak site named ULOSE, in a manner similar to Gunra ransomware attacks directed against South Korean entities around the same time.
"Lazarus continues to expand its operations, launches new campaigns while introducing new tools and reworking familiar ones to meet its needs," Ryu said in a statement shared with The Hacker News.
"What deserves closer attention is Lazarus’s adoption of cryptography designed to withstand future quantum threats. Our findings trace its use back to at least September 2024, showing that these capabilities were already protecting the group’s malware communications more than a year before this disclosure."
