Kaspersky (21 Oct): Lazarus 'Operation FlashHole' abused South Korea's mandatory CrossWeb EX banking security software and AI-built résumé lure sites to plant an in-memory TechHub/Cubridge malware chain at three South Korean firms
Kaspersky's GReAT published research on 21 October 2026 into Operation FlashHole, a Lazarus Group espionage campaign against South Korea that followed last year's Operation SyncHole. The earliest evidence dates to July 2025, and Kaspersky responded to the activity in January 2026. At least three organisations in South Korea's software, construction and wired communication equipment manufacturing sectors were hit. Targets most likely received spear-phishing emails linking to GitHub Pages sites tailored to them (a résumé of a network appliance developer, later an interior design portfolio), which Kaspersky says were probably AI-generated and loaded malicious JavaScript from javadevhouse.co[.]kr and pythonapischool[.]com. The infection chain then ran through INISAFE CrossWeb EX V3 (3.4.1.2), a financial security program South Korean users must install for online banking and government sites: a legitimate fsquirt.exe launched under the CrossWeb EX service was injected with the TechHub downloader. TechHub uses a private GitHub repository and GitHub issues as its command channel via a personal access token. Persistence came from TouchHub and TouchShift side-loaded as mscoree.dll, followed by ClientHub, LPEClient and the Cubridge orchestrator (related to what Mandiant calls SIDESHOW), most of it kept only in memory. Cubridge's C2 included cubedesign.co[.]kr. Kaspersky says the group appears to have adopted post-quantum cryptography in its tooling and expects attacks on mandatory Korean security software to continue until the government's planned phase-out takes effect. No Australian victims are named. Primary: Kaspersky Securelist.
- Product
- INISAFE CrossWeb EX V3 (South Korean financial security software); Windows hosts; TechHub, Cubridge, TouchHub, TouchShift, ClientHub, LPEClient malware
- Versions
- n/a — campaign / malware family (CrossWeb EX V3 3.4.1.2 seen as parent process; activity from July 2025)
- Exploited in Australia?
- unknown
- Patch to
- Organisations with South Korean staff, partners or subsidiaries: keep CrossWeb EX and similar mandatory security software current or remove it where no longer required; hunt for fsquirt.exe or other processes spawned by INISAFECrossWebEXSvc.exe, unexpected mscoree.dll side-loading, and endpoints talking to the GitHub API with embedded tokens; block javadevhouse.co[.]kr, pythonapischool[.]com and cubedesign.co[.]kr. Full hashes, paths and C2s are in Kaspersky's report.
Primary: Kaspersky Securelist — Dissecting Operation FlashHole, a complex attack by Lazarus (21 Oct 2026) · Vendor: Kaspersky GReAT (primary research, with IoCs) · Talkback — Operation FlashHole listing