Lazarus Group's Operation FlashHole targets South Korean firms via CrossWeb EX abuse, GitHub C2 and new TouchHub/ClientHub malware

Linha do tempo

1. securelist.com ↗ · pub. 20/10/2026 23:07 · coletado 21/10 01:00 primeiro registro

   Lazarus Group's Operation FlashHole targets South Korean firms via CrossWeb EX abuse, GitHub C2 and new TouchHub/ClientHub malware

   ler a análise desta fonte ocultar

   Kaspersky's analysis of Operation FlashHole describes a Lazarus Group campaign against South Korea that follows Operation SyncHole. The earliest evidence dates to July 2025, and the campaign was observed in January. At least three organizations in the software, construction and wired communication equipment manufacturing sectors were affected, so the group has widened its target scope. The actor sent spear-phishing emails with links to fake résumé and interior-design portfolio sites hosted on GitHub Pages, tailored to each victim. The infection chain abused the mandatory financial security software INISAFE CrossWeb EX and ran largely in memory. It combined updated known malware (TechHub, Cubridge, TouchShift, LPEClient) with the newly identified TouchHub and ClientHub. The article attributes the activity to Lazarus based on overlaps in TTPs and tooling with earlier operations.

   Technical Details

   • Initial access: Phishing links lead to GitHub Pages lure sites that load an external JavaScript file. Visiting the site likely triggers an infection chain through CrossWeb EX (INISAFECrossWebEXSvc.exe, V3 3.4.1.2). The exact abuse method is unclear. The résumé photo appears to be AI-generated.
   • Execution: The legitimate fsquirt.exe runs under the CrossWeb EX process and is injected with shellcode containing the TechHub DLL. The first stage exists only in memory.
   • Persistence: TouchHub, a new parent installer, copies printfilterpipelinesvc.exe to C:\Windows\System32\RasConv\ImeBroker.exe and registers it as a service. The service name is built from a legitimate netsvcs name plus two random characters. TouchHub drops TouchShift as mscoree.dll for DLL side-loading, so it runs as SYSTEM, and it timestomps the files. TouchShift decrypts its payload with AES-CBC-128 and a key derived from XOR operations; the payload is the third TechHub variant.
   • TechHub: A downloader that uses a GitHub private repository, accessed with a Personal Access Token, as its C2 channel. It communicates through issues and file exchanges, with an RSA handshake and AES-encrypted files, and supports four commands. It is an evolution of CLOUDBURST/NickelLoader.
   • Cubridge: The framework orchestrator, matching SIDESHOW/LightlessCan lineage. It uses randomized C2 URLs of the form [C2]/[page1]/[page2]/[page3], RSA and RC6 handshakes, and browser-mimicking headers. It loads plugins, tools and modules (action module with commands 23–41, function module with commands 42–79) through DLL injection, reflective loading and section-mapping injection.
   • ClientHub: A new malware that communicates over HTTP(S) or the Dropbox API. It uses the SNOW 1.0 stream cipher, seen for the first time in Lazarus malware, and mimics Chromium headers (Sec-CH-UA, Sec-Fetch-*). Its bitmask-driven body_type field controls payload loading and invocation, and its configuration is read from msadc.inc.
   • LPEClient: Reworked so that it no longer holds a C2 address and talks to ClientHub through a shared buffer. It profiles hosts, reads OBJECTS.DATA directly to find antivirus products, collects Kernel VA Shadow and Shadow Stack (CET) mitigation states, and encrypts data with GOST (Magma).
   • IOCs and infrastructure: Malicious JavaScript URLs, a Cubridge C2 URL, the fixed Cubridge authentication token and the file artefacts are listed in the indicators.

   Remediation

   • Hunt for the listed file names, paths and URLs, and for services running ImeBroker.exe -TimeBroker.
   • Monitor for child processes such as fsquirt.exe spawned by CrossWeb EX components, and for unexpected GitHub API or Dropbox API traffic from endpoints.
   • Review the joint advisory published in July 2026 by the South Korean government and security vendors, and keep mandatory financial security software up to date.
   • Train staff on targeted phishing that uses tailored résumé or portfolio lures.