Lazarus (Operation FlashHole) abuses South Korea's mandatory INISAFE CrossWeb EX banking security software to run in-memory malware controlled through GitHub issues

Kaspersky GReAT reports a Lazarus Group espionage campaign against South Korean organizations in software, construction and wired-communication equipment manufacturing. At least three victims confirmed, and Kaspersky expects more. Earliest evidence is July 2025, and Kaspersky published on 2026-10-21. Targets get spear-phishing links to AI-generated resume or portfolio sites on GitHub Pages, which load external JavaScript. An infection chain then starts under the INISAFE CrossWeb EX V3 (3.4.1.2) service process. Kaspersky says the exact abuse method is unknown. The legitimate fsquirt.exe is injected with the TechHub downloader, which uses a private GitHub repository and its issues as command and control, authenticating with a personal access token. Later stages (Cubridge, TouchHub/TouchShift, ClientHub, LPEClient) run mostly in memory. They persist through DLL side-loading as mscoree.dll, use Dropbox, and protect payloads with ML-KEM-1024 post-quantum encryption. Anyone running Windows hosts with CrossWeb EX installed is at risk, especially staff and partners who use Korean banking or government portals.

Summary written from the sources below. Check the originals before acting.