Cybersecurity
Lazarus abuses South Korean security software to deploy malware
Kaspersky said the Lazarus Group ran Operation FlashHole against at least three South Korean organisations from July 2025, using targeted phishing, software abuse and post-quantum encryption to load malware in memory.
- Kaspersky said the Lazarus Group ran Operation FlashHole against at least three organisations in South Korea from at least July 2025.
- The company said the attackers sent spear-phishing emails to target-specific fake pages and that the initial access route was still not fully clear.
- Kaspersky said the campaign abused Initech's INISAFE CrossWeb EX to launch legitimate Windows components and sideload TechHub, which led to TouchHub, ClientHub, LPEClient and Cubridge.
- Kaspersky said the newest version used ML-KEM-1024 to create encrypted communications with an attacker server before downloading more malware into memory.
- Kaspersky said FlashHole followed Operation SyncHole and sat within the wider Cascade Hole activity.
Kaspersky attributed Operation FlashHole to the Lazarus Group and said it had hit at least three organisations in South Korea. The targets were said to span construction, software and wire-communication equipment manufacturing, and the activity dated back to at least July 2025.
Sojun Ryu said the group used spear-phishing messages that sent people to fake pages tailored to each target. Kaspersky said the first access route was still unclear, but signs pointed to malicious sites hosted on GitHub Pages.
The chain used Initech's INISAFE CrossWeb EX, which had also been abused before, to launch a legitimate Windows binary and side-load a malicious DLL named TechHub. Kaspersky said TechHub fetched TouchHub and ClientHub, while ClientHub then helped deliver LPEClient and Cubridge.
Kaspersky said the latest version used ML-KEM-1024 to set up encrypted contact with an attacker server before pulling more code into memory. The company also said the campaign fitted into the wider Cascade Hole activity and followed Operation SyncHole, which had used Cross EX.
Named in this story
People
- Sojun Ryu
- senior security researcher who described the targeting
Companies
- Kaspersky
- Russian security company that analysed the activity
- iniLINE
- company that made Cross EX
- Initech
- company that marketed INISAFE CrossWeb EX
- AhnLab
- security vendor that had reported related attacks before
Organisations
- Lazarus Group
- North Korea-linked group blamed for the campaign
- Operation FlashHole
- Kaspersky's name for the latest campaign
- Operation SyncHole
- earlier campaign that FlashHole followed
Governments and agencies
- Korea Internet and Security Agency
- agency that joined a July 2026 advisory
Products and systems
- Cross EX
- South Korean security software abused in the earlier wave
- INISAFE CrossWeb EX
- security software abused in the new campaign
- AnySign4PC
- security programme cited in the July 2026 advisory
- COPPERHEDGE
- backdoor family mentioned in the related attacks
- TechHub
- downloader used in the infection chain
- TouchHub
- malware fetched by TechHub
- ClientHub
- backdoor used to deploy more plugins and DLLs
- LPEClient
- payload delivery tool used in the chain
- Cubridge
- orchestration component that fetched modules
- ML-KEM-1024
- post-quantum algorithm used to encrypt communications
Places
- South Korea
- the country where the targets were located
How the source tells it
Mostly a technical threat report, with light urgency framing through the way the activity is presented as the latest wave in an ongoing campaign.
- urgency repeatedly casting the activity as the newest wave of a continuing operation