Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorhigh

Lazarus FlashHole campaign hit at least three South Korean firms

4 sources · 4 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Kaspersky says Lazarus’s Operation FlashHole hit at least three South Korean organizations, with the earliest evidence in July 2025.

Kaspersky attributes Operation FlashHole to North Korea’s Lazarus Group and says it targeted South Korean organizations through spear-phishing links to tailored sites, some assessed as partly AI-generated, hosted on GitHub Pages. The chain abused mandatory INISAFE CrossWeb EX—observed as version 3.4.1.2—and loaded mostly in-memory malware including TechHub, ClientHub, LPEClient, and Cubridge. LPEClient used ML-KEM-1024 and Threefish to protect later payloads; Cubridge used RSA and RC6 for commands, files, screenshots, and extra payloads. At least three firms in software, construction, and wired communications equipment were affected; the earliest evidence dates to July 2025, and how CrossWeb EX was abused remains unclear. Securelist and Cyber Security News link the activity to Operation SyncHole with medium-to-high confidence; BleepingComputer names Cascade Hole.

Key facts
  • Kaspersky responded in January; earliest evidence dates to July 2025.
  • Observed parent process was INISAFE CrossWeb EX V3 version 3.4.1.2.
  • LPEClient receives four ML-KEM-1024 public keys and decrypts with Threefish.
  • Some components communicate via GitHub, Dropbox, or compromised websites.
  • Other tools steal Chromium passwords, cookies, bookmarks, and browsing history.
  • GBHackers names TouchHub and TouchShift after fsquirt.exe injection.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • Kaspersky SecurelistCrossWeb EX V3 3.4.1.2 and prior abuse in 2021, 2022, and 2023.
  • BleepingComputerLinks the activity to Cascade Hole, not SyncHole.
  • GBHackersNames TouchHub and TouchShift; five hashes all named mscoree.dll.
  • Cyber Security NewsCites Dropbox channels and domain javadevhouse[.]co[.]kr.
Products
CrossWeb EXINISAFE CrossWeb EXGitHub
Threat actors
LazarusLazarus Group
Malware
TechHubTouchHubTouchShiftClientHubLPEClientCubridge
Organizations
Kaspersky
Countries
North KoreaSouth Korea

Coverage

oldest first · one row per article · UTC
  1. · 4d ago Kaspersky SecurelistFirst report

    Lazarus Operation FlashHole targets South Korean organizations

    Kaspersky links at least three firms in three sectors, with earliest evidence in July 2025.

  2. · 3d ago BleepingComputer

    Lazarus uses ML-KEM to deliver malware in FlashHole attacks

    Kaspersky says phishing led to in-memory loaders and the Cubridge backdoor at South Korean firms, starting in July 2025.

  3. · 3d ago GBHackers

    Lazarus hid FlashHole malware traffic with post-quantum keys

    Kaspersky ties July 2025 activity to at least three South Korean organizations and an LPEClient build using ML-KEM-1024.

  4. · 3d ago Cyber Security News

    Lazarus uses ML-KEM-1024 to hide payloads in Operation FlashHole

    Securelist says at least three South Korean organizations were hit, with the earliest evidence in July 2025.