{"id":"CMP-202610-lazarus-operation-flashhole-abuses-south-korea-s-mandatory-i","kind":"campaign","aliases":[],"related":[],"title":"Lazarus (Operation FlashHole) abuses South Korea's mandatory INISAFE CrossWeb EX banking security software to run in-memory malware controlled through GitHub issues","description":null,"summary":"Kaspersky GReAT reports a Lazarus Group espionage campaign against South Korean organizations in software, construction and wired-communication equipment manufacturing. At least three victims confirmed, and Kaspersky expects more. Earliest evidence is July 2025, and Kaspersky published on 2026-10-21. Targets get spear-phishing links to AI-generated resume or portfolio sites on GitHub Pages, which load external JavaScript. An infection chain then starts under the INISAFE CrossWeb EX V3 (3.4.1.2) service process. Kaspersky says the exact abuse method is unknown. The legitimate fsquirt.exe is injected with the TechHub downloader, which uses a private GitHub repository and its issues as command and control, authenticating with a personal access token. Later stages (Cubridge, TouchHub/TouchShift, ClientHub, LPEClient) run mostly in memory. They persist through DLL side-loading as mscoree.dll, use Dropbox, and protect payloads with ML-KEM-1024 post-quantum encryption. Anyone running Windows hosts with CrossWeb EX installed is at risk, especially staff and partners who use Korean banking or government portals.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-10-27T11:46:32+00:00","products":[{"name":"INISAFE CrossWeb EX","fixed":[],"vendor":"Initech","versions":"V3 3.4.1.2 observed; fixed version unknown"},{"name":"GitHub","note":"GitHub Pages lures and private repos/issues abused as C2","fixed":[],"vendor":"GitHub"},{"name":"Windows","fixed":[],"vendor":"Microsoft"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"On Windows hosts with INISAFE CrossWeb EX: look for INISAFECrossWebEXSvc.exe spawning fsquirt.exe or other child processes at high integrity, and for an unexpected mscoree.dll outside the .NET directories (side-loading). On the network, check DNS and proxy logs for javadevhouse.co.kr, pythonapischool.com and cubedesign.co.kr (for example cubedesign.co.kr/news/<section>/<article|list|story>/<8 digits>). Also check for GitHub API traffic (api.github.com /issues, /contents) from non-developer processes, and for unexpected Dropbox API traffic. Full hashes and paths are in the Securelist IoC section.","fix":"Block the listed domains. Hunt on Windows endpoints with CrossWeb EX for the process chain above and for in-memory injection into fsquirt.exe. Remove CrossWeb EX where it is not needed, and update it to the vendor's latest build where it is required. Kaspersky does not name a fixed version, so this is unknown. Warn staff about job-applicant or portfolio links pointing to github.io sites. Restrict which processes can reach api.github.com and Dropbox. If you find a hit, isolate the host and treat it as an APT intrusion.","status":"open","published_at":"2026-10-21T02:07:29+00:00","first_seen_at":"2026-10-27T11:46:32+00:00","triaged_at":"2026-10-27T11:46:32+00:00","updated_at":"2026-10-27T11:46:32+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-10':88B '-202610':26A '-21':89B '1024':189B '2025':82B '2026':87B '3.4.1.2':122B 'abus':4A,129B 'abuses':31A 'access':159B 'ai':98B 'ai-gener':97B 'anyon':194B 'authent':155B 'bank':12A,212B 'campaign':44B,55B 'chain':113B 'clienthub':165B 'cmp':25A 'command':152B 'communic':66B 'confirm':73B 'construct':62B 'control':21A,154B 'crossweb':10A,40A,119B,199B 'cubridg':163B 'dll':174B 'download':141B 'dropbox':181B 'earli':46B 'earliest':78B 'early-warn':45B 'encrypt':193B 'equip':67B 'especi':205B 'espionag':54B 'evid':79B 'ex':11A,41A,120B,200B 'exact':128B 'expect':76B 'extern':109B 'flashhol':3A 'flashhole':30A,38A 'fsquirt.exe':135B 'generat':99B 'get':91B 'github':23A,42A,105B,146B 'govern':214B 'great':49B 'group':53B 'host':197B 'i':36A 'in-memori':17A 'infect':112B 'inisaf':9A,118B 'inisafe':39A 'inject':137B 'instal':201B 'issu':24A,150B 'javascript':110B 'juli':81B 'kasperski':48B,75B,84B,125B 'kem':188B 'korea':6A,33A 'korean':58B,211B 'later':161B 'lazarus':1A,28A,52B 'lazarus-operation-flashhole-abuses-south-korea-s-mandatory-i':27A 'least':70B 'legitim':134B 'link':95B 'load':108B,177B 'lpeclient':166B 'malwar':20A 'mandatori':8A 'mandatory':35A 'manufactur':68B 'memori':19A,170B 'method':130B 'ml':187B 'ml-kem':186B 'most':168B 'mscoree.dll':179B 'oper':2A 'operation':29A,37A 'organ':59B 'page':106B 'partner':208B 'payload':184B 'persist':172B 'person':158B 'phish':94B 'portal':215B 'portfolio':102B 'post':191B 'post-quantum':190B 'privat':145B 'process':124B 'protect':183B 'publish':85B 'quantum':192B 'report':50B 'repositori':147B 'resum':100B 'risk':204B 'run':16A,167B,195B 's':34A 'say':126B 'secur':13A 'servic':123B 'side':176B 'side-load':175B 'site':103B 'softwar':14A,61B 'south':5A,32A,57B 'spear':93B 'spear-phish':92B 'staff':206B 'stage':162B 'start':115B 'target':90B 'techhub':140B 'three':71B 'token':160B 'touchhub/touchshift':164B 'unknown':132B 'use':143B,180B,210B 'v3':121B 'victim':72B 'warn':47B 'window':196B 'windows':43A 'wire':65B 'wired-commun':64B","nicknames":["Operation FlashHole"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T02:07:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-lazarus-operation-flashhole-abuses-south-korea-s-mandatory-i","url":null,"severity":null,"published_at":"2026-10-21T02:07:29+00:00","modified_at":null,"first_seen_at":"2026-10-27T11:46:32+00:00","fetched_at":"2026-10-27T11:46:32+00:00","note":null}],"documents":[{"id":6145,"url":"https://x.com/TheHackersNews/status/2115044361176264773","title":"@TheHackersNews: ⚠️ Lazarus hackers are exploiting South Korean banking security software to depl","kind":"post","source":"x","text":"⚠️ Lazarus hackers are exploiting South Korean banking security software to deploy malware in a new espionage campaign.\n\nThe attacks use GitHub-hosted payloads, new backdoors, and malware communications protected by post-quantum encryption.\n\nRead: https://t.co/Rwz5uLHyvv\n\nlikes 2 reposts 3","published_at":"2026-10-27T11:34:05+00:00","relation":"describes","confidence":null,"note":null},{"id":6147,"url":"https://securelist.com/lazarus-operation-flashhole/121541/","title":"Dissecting Operation FlashHole, a complex attack by Lazarus | Securelist (Kaspersky GReAT)","kind":"blog","source":"analyst","text":"Kaspersky GReAT: Lazarus Operation FlashHole against South Korean organizations (software, construction, wired communication equipment manufacturing), earliest evidence July 2025, at least three victims. Spear-phishing links to AI-generated resume/portfolio sites on GitHub Pages loading external JS (hxxps://javadevhouse.co[.]kr/ajax/libs/jquery/1.7.3/jquery.min.js, hxxps://pythonapischool[.]com/api/detach). Infection chain via INISAFE CrossWeb EX V3 3.4.1.2 service INISAFECrossWebEXSvc.exe spawning fsquirt.exe injected with TechHub shellcode; exact abuse method unclear. TechHub uses private GitHub repo + issues as C2 via PAT (issue titles 1[ID], bodies hel/hey). Persistence via DLL side-loading as mscoree.dll (TouchHub/TouchShift). Cubridge orchestrator C2 hxxps://cubedesign[.]co[.]kr/news/... ; LPEClient uses ML-KEM-1024 for payload decryption; ClientHub uses Dropbox.","published_at":"2026-10-21T02:07:29+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}