Lazarus Group's Operation FlashHole hits South Korean firms via INISAFE CrossWeb EX abuse, GitHub C2 and ML-KEM-1024 post-quantum payload delivery

Linha do tempo

1. bleepingcomputer.com ↗ · pub. 21/10/2026 17:31 · coletado 21/10 18:00

   Lazarus Group's FlashHole campaign uses ML-KEM post-quantum cryptography to deliver payloads to South Korean organizations

   ler a análise desta fonte ocultar

   Kaspersky reports a Lazarus Group operation dubbed FlashHole, targeting South Korean organizations since July 2025 with a complex, mostly in-memory infection chain. The attackers use the NIST-standardized ML-KEM-1024 post-quantum key encapsulation mechanism for C2 communications, so that subsequent payloads are delivered encrypted and are harder to detect. Kaspersky identified at least three victims in the software, construction and wired communication equipment manufacturing sectors, and suspects many more are affected. FlashHole is placed within the broader Cascade Hole activity and linked to the earlier Operation SyncHole with medium-to-high confidence.

   Technical Details

   • Initial access: phishing pages direct targets to crafted GitHub pages that load JavaScript from external domains, triggering an in-memory execution chain involving INISAFE CrossWeb EX.
   • The security tool's process runs the legitimate Windows binary fsquirt.exe, which executes shellcode that installs TechHub, a downloader that pulls additional malware from private GitHub repositories.
   • ClientHub is a new loader that supports Dropbox communications and direct data exchange with LPEClient.
   • LPEClient profiles victims and receives from the C2 a byte array of four 1,568-byte blocks, each holding an ML-KEM-1024 public key. It generates four shared-key and ciphertext pairs, encrypts the ciphertexts with GOST and sends them through ClientHub. The shared secrets provide key material for Threefish, which decrypts the response containing parameters and an executable payload.
   • The final payload, Cubridge, is reflectively loaded into memory. It is a modular backdoor with file management, command execution, reconnaissance, screenshot capture and additional payload loading.
   • Additional tools steal credentials, cookies and browsing history from Chromium-based browsers.
   • Most code runs in memory, though persistence mechanisms leave some files on disk.

   Remediation

   The article provides no specific remediation guidance or IOCs.

2. securelist.com ↗ · pub. 20/10/2026 23:07 · coletado 21/10 01:00 primeiro registro

   Lazarus Group's Operation FlashHole targets South Korean firms via CrossWeb EX abuse, GitHub C2 and new TouchHub/ClientHub malware

   ler a análise desta fonte ocultar

   Kaspersky's analysis of Operation FlashHole describes a Lazarus Group campaign against South Korea that follows Operation SyncHole. The earliest evidence dates to July 2025, and the campaign was observed in January. At least three organizations in the software, construction and wired communication equipment manufacturing sectors were affected, so the group has widened its target scope. The actor sent spear-phishing emails with links to fake résumé and interior-design portfolio sites hosted on GitHub Pages, tailored to each victim. The infection chain abused the mandatory financial security software INISAFE CrossWeb EX and ran largely in memory. It combined updated known malware (TechHub, Cubridge, TouchShift, LPEClient) with the newly identified TouchHub and ClientHub. The article attributes the activity to Lazarus based on overlaps in TTPs and tooling with earlier operations.

   Technical Details

   • Initial access: Phishing links lead to GitHub Pages lure sites that load an external JavaScript file. Visiting the site likely triggers an infection chain through CrossWeb EX (INISAFECrossWebEXSvc.exe, V3 3.4.1.2). The exact abuse method is unclear. The résumé photo appears to be AI-generated.
   • Execution: The legitimate fsquirt.exe runs under the CrossWeb EX process and is injected with shellcode containing the TechHub DLL. The first stage exists only in memory.
   • Persistence: TouchHub, a new parent installer, copies printfilterpipelinesvc.exe to C:\Windows\System32\RasConv\ImeBroker.exe and registers it as a service. The service name is built from a legitimate netsvcs name plus two random characters. TouchHub drops TouchShift as mscoree.dll for DLL side-loading, so it runs as SYSTEM, and it timestomps the files. TouchShift decrypts its payload with AES-CBC-128 and a key derived from XOR operations; the payload is the third TechHub variant.
   • TechHub: A downloader that uses a GitHub private repository, accessed with a Personal Access Token, as its C2 channel. It communicates through issues and file exchanges, with an RSA handshake and AES-encrypted files, and supports four commands. It is an evolution of CLOUDBURST/NickelLoader.
   • Cubridge: The framework orchestrator, matching SIDESHOW/LightlessCan lineage. It uses randomized C2 URLs of the form [C2]/[page1]/[page2]/[page3], RSA and RC6 handshakes, and browser-mimicking headers. It loads plugins, tools and modules (action module with commands 23–41, function module with commands 42–79) through DLL injection, reflective loading and section-mapping injection.
   • ClientHub: A new malware that communicates over HTTP(S) or the Dropbox API. It uses the SNOW 1.0 stream cipher, seen for the first time in Lazarus malware, and mimics Chromium headers (Sec-CH-UA, Sec-Fetch-*). Its bitmask-driven body_type field controls payload loading and invocation, and its configuration is read from msadc.inc.
   • LPEClient: Reworked so that it no longer holds a C2 address and talks to ClientHub through a shared buffer. It profiles hosts, reads OBJECTS.DATA directly to find antivirus products, collects Kernel VA Shadow and Shadow Stack (CET) mitigation states, and encrypts data with GOST (Magma).
   • IOCs and infrastructure: Malicious JavaScript URLs, a Cubridge C2 URL, the fixed Cubridge authentication token and the file artefacts are listed in the indicators.

   Remediation

   • Hunt for the listed file names, paths and URLs, and for services running ImeBroker.exe -TimeBroker.
   • Monitor for child processes such as fsquirt.exe spawned by CrossWeb EX components, and for unexpected GitHub API or Dropbox API traffic from endpoints.
   • Review the joint advisory published in July 2026 by the South Korean government and security vendors, and keep mandatory financial security software up to date.
   • Train staff on targeted phishing that uses tailored résumé or portfolio lures.