Lazarus Group's Operation FlashHole targets South Korean firms via CrossWeb EX abuse, GitHub C2 and new TouchHub/ClientHub malware
Kaspersky's analysis of Operation FlashHole describes a Lazarus Group campaign against South Korea that follows Operation SyncHole. The earliest evidence dates to July 2025, and the campaign was observed in January. At least three organizations in the software, construction and wired communication equipment manufacturing sectors were affe…