Lazarus abuses INISAFE CrossWeb EX in Operation FlashHole
Original title: Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption
Kaspersky says at least three South Korean firms were targeted since July 2025 via spear-phishing and in-memory loaders.
Kaspersky attributes Operation FlashHole to North Korea-linked Lazarus, targeting at least three organizations in South Korea's construction, software, and wire-communication equipment sectors since at least July 2025. The chain is assessed to follow Operation SyncHole and abuses Initech's INISAFE CrossWeb EX, launching fsquirt.exe and sideloading a malicious DLL. Payloads including TechHub, TouchHub, ClientHub, LPEClient, and Cubridge run largely in memory; the exact initial-access flaw is unclear.
Unconfirmed: Kaspersky has not confirmed the precise FlashHole exploit, and the provided text does not describe the post-quantum encryption named in the headline.
- Lures used links to fabricated portfolio and résumé pages, including a GitHub Pages site.
- TouchHub sideloads TOUCHSHIFT (mscoree.dll) to persist another in-memory TechHub.
- Cubridge fetches plugins after LPEClient is loaded.
- A July 2026 KISA advisory described related Lazarus use of financial security software.
Impact: Espionage access and in-memory malware on targeted hosts
| Product | Affected |
|---|---|
| Initech INISAFE CrossWeb EX | — |
- Vendors
- Initech
- Products
- INISAFE CrossWeb EX
- Threat actors
- Lazarus Group
- Organizations
- Kaspersky
- Countries
- South KoreaNorth Korea
From the original article
5 min read at thehackernews.com
The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors. According to Russian cybersecurity company Kaspersky, the campaign has been active since at least July 2025. It's assessed to pick up
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.