North Korea-linked hacking group Lazarus has been linked to a cyber espionage campaign targeting at least three South Korean organizations in the construction, software, and wire-communication equipment manufacturing sectors.
Dubbed Operation FlashHole, the campaign has been active since at least July 2025, according to Russian cybersecurity firm Kaspersky. Researchers believe the operation is a continuation of Operation SyncHole, a previous campaign that targeted South Korean organizations across multiple industries.
“The group targeted victims more selectively, sending spear-phishing emails with links to fabricated but relevant sites, such as portfolio and résumé pages tailored to each target,” said Sojun Ryu, a senior security researcher at Kaspersky’s Global Research and Analysis Team (GReAT).
Kaspersky first documented Operation SyncHole in April 2025, reporting attacks against South Korean software, IT, financial, semiconductor manufacturing, and telecommunications organizations dating back to November 2024. The campaign used several malware families, including ThreatNeedle, AGAMEMNON, wAgent, SIGNBT, and COPPERHEDGE.
Those attacks exploited a security vulnerability in iniLINE Cross EX, a financial security application widely installed on South Korean computers to support secure access to online banking and government services. The exploit launched the legitimate SyncHost.exe process and injected shellcode to load the ThreatNeedle backdoor. Attackers also exploited a vulnerability in Innorix Agent version 9.2.18.496, a file transfer solution, to move laterally across compromised networks.
Operation FlashHole continues Lazarus’s strategy of abusing South Korean financial security software to gain access to targeted systems. However, instead of exploiting Cross EX, the new campaign has been observed abusing Initech’s INISAFE CrossWeb EX, another security solution used to access online banking services and government portals.
Lazarus has a history of exploiting INISAFE CrossWeb EX. In the third quarter of 2021, the group used the software to deliver a downloader called Racket as part of its long-running DeathNote campaign. Between 2022 and 2023, the group also exploited vulnerabilities in the software to distribute malicious DLL files through compromised websites.
In those attacks, Lazarus compromised legitimate websites and modified their content to deliver malware to visitors running vulnerable versions of INISAFE CrossWeb EX. When victims visited the manipulated websites, the software’s vulnerable service component was abused to install a malicious DLL called SCSKAppLink.dll.
The latest findings also follow a July 2026 joint advisory from South Korea’s cybersecurity authorities and domestic security vendors warning about attacks that exploit vulnerabilities in financial security applications. The campaign, tracked as Operation Double Barrel, used spear-phishing and watering hole attacks to trick victims into visiting malicious URLs before deploying backdoors such as Struggle, also known as SIGNBT 3.0, and Brandoor, also known as COPPERHEDGE.
Kaspersky has not confirmed the exact initial infection method used in Operation FlashHole. However, researchers identified signs pointing to malicious websites hosted on GitHub Pages. One of the sites reportedly displayed the résumé of a senior network appliance developer alongside a profile photograph suspected of being AI-generated.
The researchers believe attackers sent targeted phishing emails containing links to these websites. Visiting a malicious page could trigger an infection chain involving INISAFE CrossWeb EX and the legitimate Windows executable fsquirt.exe. Attackers then used DLL sideloading to execute a malicious library named TechHub.
According to Kaspersky, the infection process is designed to remain largely in memory during the initial compromise, making it harder for security tools to detect the malicious activity. The researchers described the chain as evidence of Lazarus’s efforts to conceal its payloads and complicate the analysis of its operations.
Once executed, TechHub downloads another malware component called TouchHub from GitHub. TouchHub then uses DLL sideloading to launch a malicious DLL named TOUCHSHIFT, identified as mscoree.dll. This component establishes persistence by triggering the in-memory execution of another TechHub instance.
The second TechHub instance retrieves ClientHub, a previously undocumented backdoor that helps deliver another malware component called LPEClient. The latter acts as a victim-profiling and payload-delivery tool, allowing the attackers to prepare compromised systems for additional stages of the attack.
LPEClient subsequently loads Cubridge, a malware orchestration component that communicates with command-and-control servers and downloads additional plugins, modules, and utilities. These tools can collect system information, execute commands, steal files and browser data, and expand the attackers’ access to compromised machines.
Kaspersky identified several other components in the malware framework. TechHub, an advanced downloader related to CLOUDBURST and NickelLoader, communicates with GitHub to retrieve additional payloads and gather information about infected devices. TouchHub serves as an installer for TouchShift, while TouchShift can deliver keyloggers, screenshot utilities, and backdoors.
ClientHub comes in two versions. One communicates with attacker-controlled servers over HTTPS, while the other uses the Dropbox API. Its plugins can create ZIP archives, search for and collect files, delete selected files, and monitor changes to local drives.
Cubridge is an updated tool that builds on capabilities associated with earlier Lazarus malware, including SIDESHOW, LightlessCan, and CookiePlus. It supports the delivery of reusable plugins and specialized DLL utilities that allow attackers to perform different tasks on compromised systems.
LPEClient has been used by Lazarus since at least 2019. In August 2026, Check Point reported that the group deployed the tool following the exploitation of CVE-2026-68820, a Windows privilege escalation vulnerability affecting the Ancillary Function Driver for WinSock. The attack chain ultimately delivered the FudModule rootkit.
One notable feature of the latest malware framework is its use of ML-KEM-1024, a post-quantum cryptographic algorithm, to establish an encrypted connection with the attackers’ server before downloading and executing additional malware directly in memory.
Kaspersky said Operation FlashHole represents the latest wave in the broader Cascade Hole campaign, which involves abusing South Korean software as a potential entry point for malware infections targeting organizations in the country.
The researchers also observed a new wave of attacks against South Korean organizations involving the COPPERHEDGE backdoor. In at least one case, the infection reportedly led to data being exfiltrated to a dark web leak site named ULOSE, resembling incidents associated with Gunra ransomware attacks against South Korean entities.
“Lazarus continues to expand its operations, launches new campaigns while introducing new tools and reworking familiar ones to meet its needs,” Ryu said.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
He also highlighted the group’s adoption of cryptographic technology designed to withstand future quantum threats. Kaspersky’s findings indicate that Lazarus had been using these capabilities since at least September 2024, more than a year before the disclosure of Operation FlashHole.
