Lazarus Operation FlashHole Abuses South Korean Security Software in Multistage Campaign
Summary
Kaspersky links Operation FlashHole to Lazarus, identifying at least three affected South Korean firms. Its investigation details suspected phishing lures, CrossWeb EX abuse, GitHub-based command and control, and post-quantum-encrypted payload delivery.
Key points
- Kaspersky identified at least three affected organizations in South Korea’s software, construction and wired communication equipment sectors, with campaign evidence dating to July 2025.
- Researchers assess with medium-to-high confidence that targets received phishing links to tailored résumé or portfolio sites. The precise trigger and method of CrossWeb EX abuse remain unclear.
- The initial chain launched fsquirt.exe beneath the CrossWeb EX process and injected TechHub into memory. TechHub used private GitHub repositories, issues and Personal Access Tokens for host profiling and payload delivery.
- TouchHub established persistence through a Windows service and DLL side-loading of TouchShift as mscoree.dll, enabling execution with SYSTEM privileges and leaving much of the subsequent chain in memory.
- Cubridge orchestrated modular payloads supporting Active Directory queries, browser credential theft, file collection and process operations; ClientHub supported HTTP(S) or Dropbox-based command and control.
- The updated LPEClient communicated through ClientHub’s shared buffer, profiled Windows patch and mitigation states, and used ML-KEM-1024 alongside other cryptography to protect subsequent payload delivery.
- Researchers linked FlashHole to earlier Lazarus operations through overlapping tools and techniques, assessing with medium-to-high confidence that the same actor conducted FlashHole and SyncHole.
Article Details
- Attack Vectors
- Researchers assess with medium-to-high confidence that targets received spear-phishing emails linking to malicious GitHub Pages sites tailored as résumé or interior-design portfolio pages.
- The lure sites loaded external malicious JavaScript. Researchers assessed that visiting them likely initiated an infection involving CrossWeb EX, but the precise infection trigger and method of abusing the software remain unclear.
- The initial execution chain ran under the CrossWeb EX service and injected shellcode containing TechHub into the legitimate Windows binary fsquirt.exe.
- Persistence used DLL side-loading and a registered Windows service, followed by predominantly in-memory execution of a multistage malware framework.
- Command-and-control infrastructure included private GitHub repositories, compromised legitimate websites, and, in one ClientHub sample, Dropbox.
- Defensive Notes
- Kaspersky reports detection under MEM:Trojan.Win64.Shellcode.gen, Trojan.Win64.DLLhijack.*, and Trojan.Win64.Lazarus.*.
- Observed persistence artifacts include C:\Windows\System32\RasConv\ImeBroker.exe, a side-loaded mscoree.dll, and ActivationStore.dat. ImeBroker.exe is a copied legitimate printfilterpipelinesvc.exe.
- TouchHub creates a service with a name derived from an existing netsvcs service name plus two random alphabetic characters, the description Microsoft Service, and the command line C:\Windows\System32\RasConv\ImeBroker.exe -TimeBroker.
- Initial infiltration and much of the subsequent payload execution occur only in memory, limiting disk artifacts.
- LPEClient disables a user-mode syscall instrumentation hook, while TouchHub and Cubridge support timestamp manipulation that can hinder forensic analysis.
- The article reports a South Korean plan to phase out mandatory security-software installation beginning in 2026; researchers estimate that exploitation of this software will remain active until it is eliminated or mitigated.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | 2f8475a90a25624ed02f1d18d4e6d65d | Hash of a TouchShift payload named mscoree.dll. |
| MD5 | 676fabe30a28b53925fba98e34b35986 | Hash of a TouchShift payload named mscoree.dll. |
| MD5 | a28cba214058fcae2883d8cffc883abd | Hash of a TouchShift payload named mscoree.dll. |
| MD5 | b4a7eff35f048f06fb0a2d7631f23a7d | Hash of a TouchShift payload named mscoree.dll. |
| MD5 | c105d6b16f544582772de0159f24c00a | Hash of a TouchShift payload named mscoree.dll. |
| MD5 | ec84d6cb2ae7974767aedac246b50a3e | Hash of a TouchShift payload named mscoree.dll. |
| MD5 | ff07641dc56914dd90ee0bd7404d7ad7 | Hash of the ClientHub Loader artifact named liblzma.dll. |
| URL | hxxps[:]//cubedesign[.]co[.]kr/mobile/fashion | Additional Cubridge C2 URL listed in the article's indicators. |
| URL | hxxps[:]//cubedesign[.]co[.]kr/news | Cubridge C2 URL listed in the article's indicators. |
| URL | hxxps[:]//fp-news[.]co[.]kr/shop/cart | Cubridge C2 URL on infrastructure identified as part of the operation. |
| URL | hxxps[:]//javadevhouse[.]co[.]kr/ajax/libs/jquery/1.7.3/jquery.min.js | Malicious external JavaScript URL embedded in the résumé lure site. |
| URL | hxxps[:]//k-wbc[.]co[.]kr/skin/social/social_view.php | ClientHub C2 endpoint listed in the article's indicators. |
| URL | hxxps[:]//pythonapischool[.]com/api/detach | Malicious external JavaScript URL embedded in the interior-design lure site. |
| URL | hxxps[:]//rcsh[.]co[.]kr/modules/bbs/tiles/bbs_div/inputForm.php | ClientHub C2 endpoint listed in the article's indicators. |
| URL | hxxps[:]//www[.]ksog[.]org/insert_file/handle.php | ClientHub C2 endpoint listed in the article's indicators. |
MITRE ATT&CK
T1005 · Data from Local SystemDeployed file-collection components recursively inspect local directories, and Cubridge can read specified files and archive selected files or directories.T1055.001 · Dynamic-link Library InjectionThe initial chain injected shellcode containing TechHub into fsquirt.exe; Cubridge also supports injecting DLL payloads into target processes.T1070.006 · TimestompTouchHub manipulates file MAC timestamps, and Cubridge supports copying one file's MAC timestamps to another.T1071.001 · Web ProtocolsCubridge uses HTTP POST requests and browser-like headers for C2; ClientHub sends GET requests with Chromium-style headers.T1082 · System Information DiscoveryLPEClient profiles computer name, memory, CPU, operating system, Windows build revision, and security mitigation states.T1102.002 · Bidirectional CommunicationTechHub exchanges commands, encrypted host information, and payloads through private GitHub repositories; one ClientHub sample uses Dropbox for C2.T1113 · Screen CaptureCubridge's function module supports capturing all displays and archiving the resulting captures.T1189 · Drive-by CompromiseResearchers assessed that visiting the malicious lure sites likely initiated an infection involving CrossWeb EX, although the precise trigger remains unresolved.T1543.003 · Windows ServiceTouchHub registers and immediately starts a service executing ImeBroker.exe -TimeBroker, enabling TouchShift to run with SYSTEM privileges.T1555.003 · Credentials from Web BrowsersThe deployed browser stealer extracts stored passwords and other browser data; Cubridge also supports retrieving the DPAPI-protected Chromium AES key.T1562.001 · Disable or Modify ToolsLPEClient installs a syscall stub through a modified MD4Update function and uses it to disable a user-mode syscall instrumentation hook.T1566.002 · Spearphishing LinkResearchers assess with medium-to-high confidence that tailored phishing emails linked targets to malicious résumé and portfolio sites on GitHub Pages.T1573.001 · Symmetric CryptographyThe malware encrypts communications and payload exchanges using symmetric algorithms including AES, RC6, SNOW, GOST, and Threefish.T1574.002 · DLL Side-LoadingTouchHub places TouchShift as mscoree.dll beside a copied legitimate executable to launch it through DLL side-loading.T1620 · Reflective Code LoadingTechHub, Cubridge, ClientHub, and LPEClient support reflective loading of payloads directly into memory.
Threat Actors
Malware
ClientHubAfter launching the second time, TechHub deployed another pair, ClientHub and LPEClient, rather than executing Cubridge directly.CLOUDBURSTThis variant is a more advanced version of the malware named CLOUDBURST by Mandiant and NickelLoader by ESET.CookiePlusAs previously noted, similar patterns have been identified in CookiePlus, MISTPEN, SIGNBT, and IMETHOD.COPPERHEDGESince July, around the time Operation SyncHole began winding down, we have also observed several notable attacks against South Korea employing the COPPERHEDGE backdoor and targeting various South Korean organizations.CubridgeAfter launching the second time, TechHub deployed another pair, ClientHub and LPEClient, rather than executing Cubridge directly.GunraAs AhnLab noted in their report, the same backdoor was likely observed in atypical activity, specifically the Gunra ransomware infection.LightlessCanIn those reports, Mandiant identified it as SIDESHOW, and ESET identified one of its modules as LightlessCan.LPEClientAfter launching the second time, TechHub deployed another pair, ClientHub and LPEClient, rather than executing Cubridge directly.NickelLoaderThis variant is a more advanced version of the malware named CLOUDBURST by Mandiant and NickelLoader by ESET.SIDESHOWIn those reports, Mandiant identified it as SIDESHOW, and ESET identified one of its modules as LightlessCan.TechHubFollowing the initial compromise, the legitimate Windows binary fsquirt.exe was executed under the CrossWeb EX process and injected with shellcode containing a malicious DLL – TechHub malware.TouchHubFollowing the initial compromise, the group sought to maintain persistence on the network by installing a pair of malware strains – TouchHub and TouchShift – leveraging DLL side‑loading under the name mscoree.dll.TouchShiftFollowing the initial compromise, the group sought to maintain persistence on the network by installing a pair of malware strains – TouchHub and TouchShift – leveraging DLL side‑loading under the name mscoree.dll.
Vendors
Products
BraveCan be injected into Chromium-based browsers, such as Google Chrome, Microsoft Edge, and Brave. Once injected, it extracts files and credentials from the victim’s browsers, including stored passwords, bookmarks,CrossWeb EXThis chain mirrors the one from the previous operation; however, this time, the attacker abused CrossWeb EX instead of Cross EX, which was abused in Operation SyncHole.Dropbox DocSendThere are at least two versions of ClientHub: one that communicates with websites via HTTP(S) and one that interacts with the Dropbox API using credentials.GitHubAlthough we could not precisely determine what triggered the infection chain, our analysis uncovered a suspicious website hosted on GitHub Pages that is associated with the GitHub account used as the C2 channel.Google ChromeCan be injected into Chromium-based browsers, such as Google Chrome, Microsoft Edge, and Brave. Once injected, it extracts files and credentials from the victim’s browsers, including stored passwords, bookmarks,Microsoft EdgeCan be injected into Chromium-based browsers, such as Google Chrome, Microsoft Edge, and Brave. Once injected, it extracts files and credentials from the victim’s browsers, including stored passwords, bookmarks,Microsoft WindowsFollowing the initial compromise, the legitimate Windows binary fsquirt.exe was executed under the CrossWeb EX process and injected with shellcode containing a malicious DLL – TechHub malware.
Tools
Countries
Industries
ConstructionWe identified a minimum of three organizations impacted by the campaign in South Korea’s software, construction, and wired communication equipment manufacturing sectors.Softwaretheir old and new malware, which we disclosed in full, and used another mandatory South Korean security software program as a part of infection chain using a watering‑hole strategy.wired communication equipment manufacturingWe identified a minimum of three organizations impacted by the campaign in South Korea’s software, construction, and wired communication equipment manufacturing sectors.