Lazarus Group's Operation FlashHole hits South Korean firms via INISAFE CrossWeb EX abuse, GitHub C2 and ML-KEM-1024 post-quantum payload delivery

Linha do tempo

1. thehackernews.com ↗ · pub. 27/10/2026 08:32 · coletado 27/10 10:00

   Lazarus Group's Operation FlashHole abuses INISAFE CrossWeb EX to hit South Korean firms with ClientHub, Cubridge and post-quantum C2

   ler a análise desta fonte ocultar

   The North Korea-linked Lazarus Group is running Operation FlashHole, a selective espionage campaign against at least three South Korean organizations in construction, software and wire-communication equipment manufacturing. Kaspersky says the activity dates to at least July 2025 and follows Operation SyncHole. The actor abuses Initech's INISAFE CrossWeb EX, a mandatory financial security program, to deliver a multi-stage in-memory malware framework. The latest LPEClient version uses the post-quantum algorithm ML-KEM-1024 to secure C2 communications, and Kaspersky traces that capability back to at least September 2024. The campaign is described as part of the broader Cascade Hole activity, and a parallel wave using COPPERHEDGE led to data exfiltration to a leak site named ULOSE.

   Technical Details

   • Initial access: The exact vector is unclear. Evidence points to spear-phishing emails linking to fake portfolio and résumé pages hosted on GitHub Pages, one of which used a likely AI-generated profile photo.
   • Execution chain: Visiting the site triggers CrossWeb EX to launch the legitimate Windows binary fsquirt.exe, which sideloads the malicious DLL TechHub. The initial chain exists only in memory.
   • Staging: TechHub downloads TouchHub from GitHub. TouchHub sideloads the rogue DLL TOUCHSHIFT (mscoree.dll), which sets up persistence by launching a second in-memory TechHub instance. That instance retrieves ClientHub, which loads LPEClient into memory. LPEClient acts as a conduit for Cubridge, the orchestration component that fetches plugins and modules.
   • Toolset: TechHub is an advanced version of CLOUDBURST and NickelLoader and communicates with GitHub. Cubridge is an improved SIDESHOW and LightlessCan, and is also assessed as an advanced CookiePlus. It collects system information, runs commands, and steals files and browser data. ClientHub is a previously undocumented backdoor with an HTTPS C2 variant and a Dropbox API variant. Its plugins create ZIP archives, collect files by pattern, delete files and monitor drive changes. LPEClient is a victim-profiling and payload delivery tool in use since 2019.
   • Related activity: Check Point reported in August 2026 that LPEClient was deployed after zero-day exploitation of CVE-2026-68820, a Windows Ancillary Function Driver for WinSock privilege escalation flaw, to deploy the FudModule rootkit. SyncHole exploited iniLINE Cross EX and an Innorix Agent flaw. A July 2026 KISA advisory and AhnLab's "Operation Double Barrel" describe Lazarus exploiting AnySign4PC to deploy Struggle (SIGNBT 3.0) and Brandoor (COPPERHEDGE). The group has abused CrossWeb EX before, in DeathNote (Racket downloader, 2021) and in AhnLab-reported watering-hole attacks (SCSKAppLink.dll, 2022-2023).

   Remediation

   The article gives no explicit remediation guidance. Defenders in South Korea should consider keeping mandatory financial security software such as CrossWeb EX, Cross EX and AnySign4PC fully patched, scrutinizing links in unsolicited résumé or portfolio emails, and monitoring for fsquirt.exe DLL sideloading and for GitHub and Dropbox API traffic from unusual processes.

2. gbhackers.com ↗ · pub. 22/10/2026 04:56 · coletado 22/10 06:00

   Lazarus Group's Operation FlashHole uses ML-KEM post-quantum key exchange in LPEClient against South Korean organizations

   ler a análise desta fonte ocultar

   Lazarus Group, linked to North Korea, ran a cyberespionage campaign dubbed Operation FlashHole against South Korean organizations. The campaign combined spear-phishing, tailored websites, abuse of the financial security application INISAFE CrossWeb EX, and modular malware that ran largely in memory. It follows Operation SyncHole, which abused the related Cross EX product and hit at least six organizations. Kaspersky researchers traced the earliest evidence to July 2025 and identified at least three affected organizations in the software, construction and wired-communications equipment sectors. The most notable development is an updated LPEClient variant that uses post-quantum key establishment (ML-KEM-1024) as one layer of a custom protocol protecting payload delivery.

   Technical Details

   • The exact exploitation method for CrossWeb EX is unclear, but a high-integrity process chain ultimately executed malicious code in memory.
   • Lazarus likely sent selected victims to tailored sites via spear-phishing. The lures were a résumé page and an interior-design portfolio hosted on GitHub Pages. Some content looked AI-generated, but this was not established.
   • The legitimate Windows program fsquirt.exe was launched under the CrossWeb EX process and injected with shellcode carrying TechHub.
   • The chain then deployed TouchHub and TouchShift for persistence, followed by ClientHub and LPEClient. These helped load Cubridge, a framework for receiving commands and deploying plugins, tools and modules.
   • The updated LPEClient obtained four 1,568-byte blocks containing ML-KEM-1024 public keys after profiling the system. It sent encrypted ciphertexts to its C2, then used the shared keys with the Threefish cipher to decrypt a payload that was reflectively loaded into memory.
   • Cubridge uses a handshake combining RSA and RC6, which is more robust than TechHub's.
   • The post-quantum step is only one layer of a custom protocol. It does not make the malware invisible, and it does not mean every stage is quantum-resistant. Its significance is operational: it complicates analysis of the command channel.
   • LPEClient appeared in both FlashHole and SyncHole.

   Remediation

   • Monitor for unusual activity originating from trusted security software.
   • Investigate suspicious in-memory execution.
   • Keep locally required financial security applications patched.
3. bleepingcomputer.com ↗ · pub. 21/10/2026 17:31 · coletado 21/10 18:00

   Lazarus Group's FlashHole campaign uses ML-KEM post-quantum cryptography to deliver payloads to South Korean organizations

   ler a análise desta fonte ocultar

   Kaspersky reports a Lazarus Group operation dubbed FlashHole, targeting South Korean organizations since July 2025 with a complex, mostly in-memory infection chain. The attackers use the NIST-standardized ML-KEM-1024 post-quantum key encapsulation mechanism for C2 communications, so that subsequent payloads are delivered encrypted and are harder to detect. Kaspersky identified at least three victims in the software, construction and wired communication equipment manufacturing sectors, and suspects many more are affected. FlashHole is placed within the broader Cascade Hole activity and linked to the earlier Operation SyncHole with medium-to-high confidence.

   Technical Details

   • Initial access: phishing pages direct targets to crafted GitHub pages that load JavaScript from external domains, triggering an in-memory execution chain involving INISAFE CrossWeb EX.
   • The security tool's process runs the legitimate Windows binary fsquirt.exe, which executes shellcode that installs TechHub, a downloader that pulls additional malware from private GitHub repositories.
   • ClientHub is a new loader that supports Dropbox communications and direct data exchange with LPEClient.
   • LPEClient profiles victims and receives from the C2 a byte array of four 1,568-byte blocks, each holding an ML-KEM-1024 public key. It generates four shared-key and ciphertext pairs, encrypts the ciphertexts with GOST and sends them through ClientHub. The shared secrets provide key material for Threefish, which decrypts the response containing parameters and an executable payload.
   • The final payload, Cubridge, is reflectively loaded into memory. It is a modular backdoor with file management, command execution, reconnaissance, screenshot capture and additional payload loading.
   • Additional tools steal credentials, cookies and browsing history from Chromium-based browsers.
   • Most code runs in memory, though persistence mechanisms leave some files on disk.

   Remediation

   The article provides no specific remediation guidance or IOCs.

4. securelist.com ↗ · pub. 20/10/2026 23:07 · coletado 21/10 01:00 primeiro registro

   Lazarus Group's Operation FlashHole targets South Korean firms via CrossWeb EX abuse, GitHub C2 and new TouchHub/ClientHub malware

   ler a análise desta fonte ocultar

   Kaspersky's analysis of Operation FlashHole describes a Lazarus Group campaign against South Korea that follows Operation SyncHole. The earliest evidence dates to July 2025, and the campaign was observed in January. At least three organizations in the software, construction and wired communication equipment manufacturing sectors were affected, so the group has widened its target scope. The actor sent spear-phishing emails with links to fake résumé and interior-design portfolio sites hosted on GitHub Pages, tailored to each victim. The infection chain abused the mandatory financial security software INISAFE CrossWeb EX and ran largely in memory. It combined updated known malware (TechHub, Cubridge, TouchShift, LPEClient) with the newly identified TouchHub and ClientHub. The article attributes the activity to Lazarus based on overlaps in TTPs and tooling with earlier operations.

   Technical Details

   • Initial access: Phishing links lead to GitHub Pages lure sites that load an external JavaScript file. Visiting the site likely triggers an infection chain through CrossWeb EX (INISAFECrossWebEXSvc.exe, V3 3.4.1.2). The exact abuse method is unclear. The résumé photo appears to be AI-generated.
   • Execution: The legitimate fsquirt.exe runs under the CrossWeb EX process and is injected with shellcode containing the TechHub DLL. The first stage exists only in memory.
   • Persistence: TouchHub, a new parent installer, copies printfilterpipelinesvc.exe to C:\Windows\System32\RasConv\ImeBroker.exe and registers it as a service. The service name is built from a legitimate netsvcs name plus two random characters. TouchHub drops TouchShift as mscoree.dll for DLL side-loading, so it runs as SYSTEM, and it timestomps the files. TouchShift decrypts its payload with AES-CBC-128 and a key derived from XOR operations; the payload is the third TechHub variant.
   • TechHub: A downloader that uses a GitHub private repository, accessed with a Personal Access Token, as its C2 channel. It communicates through issues and file exchanges, with an RSA handshake and AES-encrypted files, and supports four commands. It is an evolution of CLOUDBURST/NickelLoader.
   • Cubridge: The framework orchestrator, matching SIDESHOW/LightlessCan lineage. It uses randomized C2 URLs of the form [C2]/[page1]/[page2]/[page3], RSA and RC6 handshakes, and browser-mimicking headers. It loads plugins, tools and modules (action module with commands 23–41, function module with commands 42–79) through DLL injection, reflective loading and section-mapping injection.
   • ClientHub: A new malware that communicates over HTTP(S) or the Dropbox API. It uses the SNOW 1.0 stream cipher, seen for the first time in Lazarus malware, and mimics Chromium headers (Sec-CH-UA, Sec-Fetch-*). Its bitmask-driven body_type field controls payload loading and invocation, and its configuration is read from msadc.inc.
   • LPEClient: Reworked so that it no longer holds a C2 address and talks to ClientHub through a shared buffer. It profiles hosts, reads OBJECTS.DATA directly to find antivirus products, collects Kernel VA Shadow and Shadow Stack (CET) mitigation states, and encrypts data with GOST (Magma).
   • IOCs and infrastructure: Malicious JavaScript URLs, a Cubridge C2 URL, the fixed Cubridge authentication token and the file artefacts are listed in the indicators.

   Remediation

   • Hunt for the listed file names, paths and URLs, and for services running ImeBroker.exe -TimeBroker.
   • Monitor for child processes such as fsquirt.exe spawned by CrossWeb EX components, and for unexpected GitHub API or Dropbox API traffic from endpoints.
   • Review the joint advisory published in July 2026 by the South Korean government and security vendors, and keep mandatory financial security software up to date.
   • Train staff on targeted phishing that uses tailored résumé or portfolio lures.