Lazarus Group's Operation FlashHole hits South Korean firms via INISAFE CrossWeb EX abuse, GitHub C2 and ML-KEM-1024 post-quantum payload delivery

Linha do tempo

1. gbhackers.com ↗ · pub. 22/10/2026 04:56 · coletado 22/10 06:00

   Lazarus Group's Operation FlashHole uses ML-KEM post-quantum key exchange in LPEClient against South Korean organizations

   ler a análise desta fonte ocultar

   Lazarus Group, linked to North Korea, ran a cyberespionage campaign dubbed Operation FlashHole against South Korean organizations. The campaign combined spear-phishing, tailored websites, abuse of the financial security application INISAFE CrossWeb EX, and modular malware that ran largely in memory. It follows Operation SyncHole, which abused the related Cross EX product and hit at least six organizations. Kaspersky researchers traced the earliest evidence to July 2025 and identified at least three affected organizations in the software, construction and wired-communications equipment sectors. The most notable development is an updated LPEClient variant that uses post-quantum key establishment (ML-KEM-1024) as one layer of a custom protocol protecting payload delivery.

   Technical Details

   • The exact exploitation method for CrossWeb EX is unclear, but a high-integrity process chain ultimately executed malicious code in memory.
   • Lazarus likely sent selected victims to tailored sites via spear-phishing. The lures were a résumé page and an interior-design portfolio hosted on GitHub Pages. Some content looked AI-generated, but this was not established.
   • The legitimate Windows program fsquirt.exe was launched under the CrossWeb EX process and injected with shellcode carrying TechHub.
   • The chain then deployed TouchHub and TouchShift for persistence, followed by ClientHub and LPEClient. These helped load Cubridge, a framework for receiving commands and deploying plugins, tools and modules.
   • The updated LPEClient obtained four 1,568-byte blocks containing ML-KEM-1024 public keys after profiling the system. It sent encrypted ciphertexts to its C2, then used the shared keys with the Threefish cipher to decrypt a payload that was reflectively loaded into memory.
   • Cubridge uses a handshake combining RSA and RC6, which is more robust than TechHub's.
   • The post-quantum step is only one layer of a custom protocol. It does not make the malware invisible, and it does not mean every stage is quantum-resistant. Its significance is operational: it complicates analysis of the command channel.
   • LPEClient appeared in both FlashHole and SyncHole.

   Remediation

   • Monitor for unusual activity originating from trusted security software.
   • Investigate suspicious in-memory execution.
   • Keep locally required financial security applications patched.
2. bleepingcomputer.com ↗ · pub. 21/10/2026 17:31 · coletado 21/10 18:00

   Lazarus Group's FlashHole campaign uses ML-KEM post-quantum cryptography to deliver payloads to South Korean organizations

   ler a análise desta fonte ocultar

   Kaspersky reports a Lazarus Group operation dubbed FlashHole, targeting South Korean organizations since July 2025 with a complex, mostly in-memory infection chain. The attackers use the NIST-standardized ML-KEM-1024 post-quantum key encapsulation mechanism for C2 communications, so that subsequent payloads are delivered encrypted and are harder to detect. Kaspersky identified at least three victims in the software, construction and wired communication equipment manufacturing sectors, and suspects many more are affected. FlashHole is placed within the broader Cascade Hole activity and linked to the earlier Operation SyncHole with medium-to-high confidence.

   Technical Details

   • Initial access: phishing pages direct targets to crafted GitHub pages that load JavaScript from external domains, triggering an in-memory execution chain involving INISAFE CrossWeb EX.
   • The security tool's process runs the legitimate Windows binary fsquirt.exe, which executes shellcode that installs TechHub, a downloader that pulls additional malware from private GitHub repositories.
   • ClientHub is a new loader that supports Dropbox communications and direct data exchange with LPEClient.
   • LPEClient profiles victims and receives from the C2 a byte array of four 1,568-byte blocks, each holding an ML-KEM-1024 public key. It generates four shared-key and ciphertext pairs, encrypts the ciphertexts with GOST and sends them through ClientHub. The shared secrets provide key material for Threefish, which decrypts the response containing parameters and an executable payload.
   • The final payload, Cubridge, is reflectively loaded into memory. It is a modular backdoor with file management, command execution, reconnaissance, screenshot capture and additional payload loading.
   • Additional tools steal credentials, cookies and browsing history from Chromium-based browsers.
   • Most code runs in memory, though persistence mechanisms leave some files on disk.

   Remediation

   The article provides no specific remediation guidance or IOCs.

3. securelist.com ↗ · pub. 20/10/2026 23:07 · coletado 21/10 01:00 primeiro registro

   Lazarus Group's Operation FlashHole targets South Korean firms via CrossWeb EX abuse, GitHub C2 and new TouchHub/ClientHub malware

   ler a análise desta fonte ocultar

   Kaspersky's analysis of Operation FlashHole describes a Lazarus Group campaign against South Korea that follows Operation SyncHole. The earliest evidence dates to July 2025, and the campaign was observed in January. At least three organizations in the software, construction and wired communication equipment manufacturing sectors were affected, so the group has widened its target scope. The actor sent spear-phishing emails with links to fake résumé and interior-design portfolio sites hosted on GitHub Pages, tailored to each victim. The infection chain abused the mandatory financial security software INISAFE CrossWeb EX and ran largely in memory. It combined updated known malware (TechHub, Cubridge, TouchShift, LPEClient) with the newly identified TouchHub and ClientHub. The article attributes the activity to Lazarus based on overlaps in TTPs and tooling with earlier operations.

   Technical Details

   • Initial access: Phishing links lead to GitHub Pages lure sites that load an external JavaScript file. Visiting the site likely triggers an infection chain through CrossWeb EX (INISAFECrossWebEXSvc.exe, V3 3.4.1.2). The exact abuse method is unclear. The résumé photo appears to be AI-generated.
   • Execution: The legitimate fsquirt.exe runs under the CrossWeb EX process and is injected with shellcode containing the TechHub DLL. The first stage exists only in memory.
   • Persistence: TouchHub, a new parent installer, copies printfilterpipelinesvc.exe to C:\Windows\System32\RasConv\ImeBroker.exe and registers it as a service. The service name is built from a legitimate netsvcs name plus two random characters. TouchHub drops TouchShift as mscoree.dll for DLL side-loading, so it runs as SYSTEM, and it timestomps the files. TouchShift decrypts its payload with AES-CBC-128 and a key derived from XOR operations; the payload is the third TechHub variant.
   • TechHub: A downloader that uses a GitHub private repository, accessed with a Personal Access Token, as its C2 channel. It communicates through issues and file exchanges, with an RSA handshake and AES-encrypted files, and supports four commands. It is an evolution of CLOUDBURST/NickelLoader.
   • Cubridge: The framework orchestrator, matching SIDESHOW/LightlessCan lineage. It uses randomized C2 URLs of the form [C2]/[page1]/[page2]/[page3], RSA and RC6 handshakes, and browser-mimicking headers. It loads plugins, tools and modules (action module with commands 23–41, function module with commands 42–79) through DLL injection, reflective loading and section-mapping injection.
   • ClientHub: A new malware that communicates over HTTP(S) or the Dropbox API. It uses the SNOW 1.0 stream cipher, seen for the first time in Lazarus malware, and mimics Chromium headers (Sec-CH-UA, Sec-Fetch-*). Its bitmask-driven body_type field controls payload loading and invocation, and its configuration is read from msadc.inc.
   • LPEClient: Reworked so that it no longer holds a C2 address and talks to ClientHub through a shared buffer. It profiles hosts, reads OBJECTS.DATA directly to find antivirus products, collects Kernel VA Shadow and Shadow Stack (CET) mitigation states, and encrypts data with GOST (Magma).
   • IOCs and infrastructure: Malicious JavaScript URLs, a Cubridge C2 URL, the fixed Cubridge authentication token and the file artefacts are listed in the indicators.

   Remediation

   • Hunt for the listed file names, paths and URLs, and for services running ImeBroker.exe -TimeBroker.
   • Monitor for child processes such as fsquirt.exe spawned by CrossWeb EX components, and for unexpected GitHub API or Dropbox API traffic from endpoints.
   • Review the joint advisory published in July 2026 by the South Korean government and security vendors, and keep mandatory financial security software up to date.
   • Train staff on targeted phishing that uses tailored résumé or portfolio lures.