Lazarus Operation FlashHole Abuses CrossWeb EX and GitHub to Spy on South Korean Firms
Do Son 
Expanded infection chain after gaining persistence | Image: Kaspersky Labs
| At a glance | |
| Actor | Lazarus Group, a North Korea-linked threat actor (Kaspersky, medium-to-high confidence) |
| Activity | Cyber espionage through spear phishing, watering-hole sites, and abuse of mandatory security software |
| Targets | South Korean firms in software, construction, and wired communication equipment |
| Scale | At least three confirmed victims; Kaspersky believes many more were hit |
| Status | No law-enforcement action reported; South Korea is phasing out mandatory security software |
| Source | Kaspersky GReAT (Securelist), with context from a South Korean joint advisory and AhnLab |
TL;DR
Kaspersky has exposed Operation FlashHole, a new Lazarus Group campaign against South Korean companies. The attackers sent targets to fake resume and portfolio sites, then abused the mandatory CrossWeb EX security tool to run malware in memory. The campaign follows last year’s Operation SyncHole and uses a heavily upgraded malware chain.
What happened
Kaspersky responded to the attacks in January 2026. However, the earliest traces date back to July 2025. That timing suggests the group began preparing soon after Operation SyncHole ended.
This time, Lazarus abused CrossWeb EX, a financial security program. South Koreans must install it to use many online banking and government sites. Lazarus has abused the same software before, in 2021, 2022, and 2023. Kaspersky could not pin down the exact method, but the chain ends with malware running in memory.
AI-made lure sites
The lures were tailored to each target. One fake site showed the resume of a senior network appliance developer. Later, the attackers swapped it for an interior design showcase. Both sites lived on GitHub Pages.
The resume photo had no EXIF data and an unnatural texture. As a result, Kaspersky believes AI generated it. The job seeker’s name also resembled a Korean version of “John Doe.” Kaspersky says this “suggests the Lazarus Group has incorporated AI into its long-standing strategy.”
Kaspersky assesses with medium-to-high confidence that targets got phishing emails linking to these sites. Visiting a site likely started the infection through CrossWeb EX.
A memory-only malware chain
The first payload, TechHub, ran inside a legitimate Windows binary. It uses a private GitHub repository for command and control. It even passes messages through GitHub issues and uploaded files.
Next, the group set up persistence with two loaders, TouchHub and TouchShift, using DLL side-loading. These redeployed TechHub, which then dropped ClientHub and LPEClient. Finally, LPEClient loaded Cubridge, the framework’s main orchestrator. Kaspersky notes the early chain “exists only in memory during the initial infiltration.”
Post-quantum encryption
The updated LPEClient no longer stores a server address. Instead, it relays traffic through ClientHub. It also uses ML-KEM-1024, a NIST post-quantum standard, along with GOST and Threefish ciphers. Kaspersky observes that the group “seems to have adopted more secure post-quantum cryptography faster than many legitimate security products.”
Meanwhile, ClientHub uses the SNOW stream cipher, a first for Lazarus. It also fakes Chromium browser headers to blend in.
Who is behind it
Kaspersky attributes Operation FlashHole to the same actor behind SyncHole. It rates this link at medium-to-high confidence. The shared use of LPEClient is the strongest clue. Earlier versions of TechHub, Cubridge, and TouchShift also appeared in Lazarus’s “Dream Job” campaign.
Other researchers track the same tools under different names. Mandiant calls earlier TechHub and Cubridge versions CLOUDBURST and SIDESHOW. ESET calls them NickelLoader and LightlessCan. In July 2026, the South Korean government and local vendors published a joint advisory on similar Lazarus methods. AhnLab’s “Operation Double Barrel” report also covers recent Lazarus activity.
Impact and scale
Kaspersky confirmed at least three victims. They work in software, construction, and wired communication equipment. Still, Kaspersky remains “confident that a considerably larger number of organizations” were affected.
Software makers appear in both SyncHole and FlashHole. Kaspersky suggests the group wants source code and new bugs for future attacks. The toolkit supports that goal. It includes a browser credential stealer, an Active Directory query tool, file collectors, and secure file deletion.
Separately, Kaspersky tracks a related cluster using the COPPERHEDGE backdoor. That activity appears focused on money, including ransomware and a dark web leak site. In contrast, Operation FlashHole looks like pure espionage.
What comes next
In October 2025, South Korea announced plans to phase out mandatory security software starting in 2026. However, Kaspersky expects attacks on this software to “remain highly active for some time” until it is gone.
How to stay protected
- Update or remove CrossWeb EX and similar banking plug-ins where they are no longer required.
- Treat unsolicited resume or portfolio links with caution, even when they look relevant.
- Monitor for unusual GitHub API traffic from workstations, especially to private repositories.
- Watch for new services that side-load DLLs from system folders.
- Use memory scanning and EDR, since much of the chain never touches disk.
- Protect source code repositories with strong access controls and MFA.
Overall, Operation FlashHole shows the Lazarus Group refining old tools fast while keeping South Korea’s software supply chain in its sights.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
