Lazarus Operation FlashHole targets South Korean organizations
Original title: Operation FlashHole: Lazarus breaks security, defies control
Kaspersky links at least three firms in three sectors, with earliest evidence in July 2025.
Kaspersky says it responded in January to a Lazarus campaign it calls Operation FlashHole, aimed at South Korea after Operation SyncHole. The group sent spear-phishing links to tailored résumé and portfolio sites, which Kaspersky assesses were partly AI-generated, and abused mandatory CrossWeb EX security software. At least three organizations in software, construction, and wired communications equipment manufacturing were affected. The earliest evidence dates to July 2025; the published excerpt cuts off during the infection chain.
Unconfirmed: The CrossWeb EX abuse method is unclear, and links between specific lure sites and victims are described as likely.
- Kaspersky assesses phishing links to GitHub Pages with medium-to-high confidence.
- The observed parent process was INISAFE CrossWeb EX V3 version 3.4.1.2.
- A GitHub account used as a C2 channel hosted the lure sites.
- How CrossWeb EX was abused remains unclear.
- Lazarus previously abused the software in 2021, 2022, and 2023.
Impact: In-memory malware execution at high integrity
- Products
- CrossWeb EXINISAFE CrossWeb EX
- Threat actors
- Lazarus Group
- Organizations
- Kaspersky
- Countries
- South Korea
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cubedesign.co.kr | analysis identified a single hardcoded C2 server – hxxps://cubedesign[.]co[.]kr/news/AABBCC – associated with the examined instance tha |
| domain | pythonapischool.com | js Malicious link embedded in interior design site: hxxps://pythonapischool[.]com/api/detach Based on the analysis, we assess with medium-t |
| url | https://cubedesign.co.kr/news/AABBCC | sts. Our analysis identified a single hardcoded C2 server – hxxps://cubedesign[.]co[.]kr/news/AABBCC – associated with the examined instance that is configu |
| url | https://cubedesign.co.kr/news/economy/article/12345678 | e hardcoded URL can later be transformed, for example, into hxxps://cubedesign[.]co[.]kr/news/economy/article/12345678 by following the steps described above. Authentication |
| url | https://javadevhouse.co.kr/ajax/libs/jquery/1.7.3/jquery.min.js | a a script tag. Malicious link embedded in the résumé site: hxxps://javadevhouse.co[.]kr/ajax/libs/jquery/1.7.3/jquery.min.js Malicious link embedded in interior design site: hxxps:// |
| url | https://pythonapischool.com/api/detach | ery.min.js Malicious link embedded in interior design site: hxxps://pythonapischool[.]com/api/detach Based on the analysis, we assess with medium-to-high conf |
From the original article
13 min read at securelist.com
Kaspersky researchers analyze Operation FlashHole – a recent complex attack by Lazarus, involving a sophisticated malware set, watering-hole technique and abuse of CrossWeb EX financial security software.
By Sojun Ryu · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.