Lazarus Campaign Abuses South Korean INISAFE Software and Uses Post-Quantum Encryption
Summary
Kaspersky attributes Operation FlashHole to Lazarus, targeting at least three South Korean organizations. The campaign abuses INISAFE CrossWeb EX to deliver multi-stage malware; its initial access vector remains unclear, and its latest malware uses ML-KEM-1024 for an,
Key points
- Kaspersky says Operation FlashHole has been active since at least July 2025 and targets organizations in South Korea’s construction, software, and wire-communication equipment manufacturing sectors.
- The campaign abuses Initech’s INISAFE CrossWeb EX, a financial security solution, to help deliver malware; the precise initial access vector is unclear.
- Kaspersky says spear-phishing links to malicious websites, including pages hosted on GitHub, may lead to an infection sequence involving the legitimate Windows binary fsquirt.exe and DLL sideloading.
- The described malware chain includes TechHub, TouchHub, TOUCHSHIFT, ClientHub, LPEClient, and Cubridge, with components launched or executed in memory.
- Kaspersky reports that the latest malware version uses ML-KEM-1024 to encrypt communications with the attackers’ server before downloading and running additional malware in memory.
- Kaspersky describes FlashHole as part of the broader Cascade Hole campaign and a continuation of Lazarus activity targeting South Korean software.
Article Details
- Attack Vectors
- Operation FlashHole reportedly used spear-phishing links to malicious, tailored résumé or portfolio websites; the precise initial access vector is unclear.
- Visiting a malicious website could trigger exploitation of INISAFE CrossWeb EX, which launched fsquirt.exe and a DLL-sideloading sequence.
- TechHub downloaded TouchHub from GitHub; the malware chain then loaded additional malware in memory.
- In earlier attacks described in the article, Lazarus used compromised websites and watering-hole techniques to distribute malware through vulnerable South Korean financial-security software.
MITRE ATT&CK
T1055 · Process InjectionIn the earlier Operation SyncHole chain, shellcode was injected into the legitimate SyncHost.exe process to load ThreatNeedle.T1105 · Ingress Tool TransferTechHub downloaded TouchHub from GitHub, and the malware framework fetched additional plugins, modules, and tools.T1189 · Drive-by CompromiseThe article describes watering-hole attacks involving compromised websites, including prior Lazarus activity and the related advisory's reported attacks.T1203 · Exploitation for Client ExecutionThe article says vulnerable INISAFE CrossWeb EX was exploited when a target visited a malicious website, triggering the infection sequence.T1566.002 · Spearphishing LinkKaspersky said targets were sent spear-phishing emails containing links to malicious sites.T1573 · Encrypted ChannelA newer malware version used ML-KEM-1024 to establish an encrypted connection with the attackers' server before downloading malware.T1574.002 · DLL Side-LoadingThe FlashHole chain used DLL sideloading to launch TechHub and described another sideloading step involving TouchHub and a rogue DLL.
CVE
People
Threat Actors
Malware
ClientHubThis second TechHub instance retrieves another malware family known as ClientHub to download and load LPEClient into memory. LPEClient serves as a conduit for Cubridge, the orchestration component of the malwareCOPPERHEDGEindustries since November 2024 to deliver malware such as ThreatNeedle, AGAMEMNON, wAgent, SIGNBT, and COPPERHEDGE.Cubridgefamily known as ClientHub to download and load LPEClient into memory. LPEClient serves as a conduit for Cubridge, the orchestration component of the malware framework designed to fetch various plugins, modules, andFudModulea privilege escalation flaw affecting Windows Ancillary Function Driver for WinSock, to deploy the FudModule rootkit.LPEClientThis second TechHub instance retrieves another malware family known as ClientHub to download and load LPEClient into memory. LPEClient serves as a conduit for Cubridge, the orchestration component of the malwareTechHublaunch the legitimate Windows binary "fsquirt.exe," which is then used to launch a malicious DLL called TechHub via DLL sideloading.TouchHubTechHub, for its part, downloads from GitHub a malware called TouchHub, which leverages a DLL sideloading a second to launch a rogue DLL payload dubbed TOUCHSHIFT ("mscoree.dll") for setting up persistence by kickingTouchShiftcalled TouchHub, which leverages a DLL sideloading a second to launch a rogue DLL payload dubbed TOUCHSHIFT ("mscoree.dll") for setting up persistence by kicking off the in‑memory execution of another TechHub
Vendors
AhnLabBetween 2022 and 2023, AhnLab also disclosed attacks in which the threat actor exploited a security flaw in the software to distribute DLL malware ("SCSKAppLink.dll") via watering hole attacks, with the DLL payloadCheck PointIn August 2026, Check Point revealed that LPEClient was deployed following the zero-day exploitation of CVE-2026-68820, a privilege escalation flaw affecting Windows Ancillary Function Driver for WinSock, to deploy theiniLINEThe attacks were characterized by the exploitation of a security flaw in iniLINE Cross EX for malware delivery. Cross EX is a mandatory financial security software program installed by South Korean internet users onInitechsoftware to breach targets. Where SyncHole exploited Cross EX, FlashHole has been found to abuse Initech's INISAFE CrossWeb EX, another mandatory financial security solution necessary to access online bankingKasperskyAccording to Russian cybersecurity company Kaspersky, the campaign has been active since at least July 2025. It's assessed to pick up from where Operation SyncHole left off.
Products
AnySign4PCthe Lazarus Group's exploitation of vulnerabilities in such financial security programs like AnySign4PC to distribute backdoors like Struggle (aka SIGNBT 3.0) and Brandoor (aka COPPERHEDGE) after trickingCross EXThe attacks were characterized by the exploitation of a security flaw in iniLINE Cross EX for malware delivery. Cross EX is a mandatory financial security software program installed by South Korean internet users onINISAFE CrossWeb EXto breach targets. Where SyncHole exploited Cross EX, FlashHole has been found to abuse Initech's INISAFE CrossWeb EX, another mandatory financial security solution necessary to access online banking and governmentInnorix Agentto load the ThreatNeedle backdoor. The attack chain also incorporated a one-day vulnerability in the Innorix Agent file transfer solution version 9.2.18.496 for lateral movement.
Countries
North KoreaThe North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, andSouth Koreato a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors.
Industries
Constructioncampaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors.semiconductor manufacturingdetailing the state-sponsored adversary's targeting of South Korea's software, IT, financial, semiconductor manufacturing, and telecommunications industries since November 2024 to deliver malware such as ThreatNeedle,SoftwareOperation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors.Telecommunicationsadversary's targeting of South Korea's software, IT, financial, semiconductor manufacturing, and telecommunications industries since November 2024 to deliver malware such as ThreatNeedle, AGAMEMNON, wAgent, SIGNBT,wire-communication equipment manufacturingat least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors.