---
id: "CMP-202610-lazarus-operation-flashhole-abuses-south-korea-s-mandatory-i"
kind: "campaign"
aliases: []
title: "Lazarus (Operation FlashHole) abuses South Korea's mandatory INISAFE CrossWeb EX banking security software to run in-memory malware controlled through GitHub issues"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "INISAFE CrossWeb EX", "fixed": [], "vendor": "Initech", "versions": "V3 3.4.1.2 observed; fixed version unknown"}, {"name": "GitHub", "note": "GitHub Pages lures and private repos/issues abused as C2", "fixed": [], "vendor": "GitHub"}, {"name": "Windows", "fixed": [], "vendor": "Microsoft"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: "2026-10-21T02:07:29+00:00"
first_seen_at: "2026-10-27T11:46:32+00:00"
updated_at: "2026-10-27T11:46:32+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-27T11:46:32+00:00"}]
---

# Lazarus (Operation FlashHole) abuses South Korea's mandatory INISAFE CrossWeb EX banking security software to run in-memory malware controlled through GitHub issues

Kaspersky GReAT reports a Lazarus Group espionage campaign against South Korean organizations in software, construction and wired-communication equipment manufacturing. At least three victims confirmed, and Kaspersky expects more. Earliest evidence is July 2025, and Kaspersky published on 2026-10-21. Targets get spear-phishing links to AI-generated resume or portfolio sites on GitHub Pages, which load external JavaScript. An infection chain then starts under the INISAFE CrossWeb EX V3 (3.4.1.2) service process. Kaspersky says the exact abuse method is unknown. The legitimate fsquirt.exe is injected with the TechHub downloader, which uses a private GitHub repository and its issues as command and control, authenticating with a personal access token. Later stages (Cubridge, TouchHub/TouchShift, ClientHub, LPEClient) run mostly in memory. They persist through DLL side-loading as mscoree.dll, use Dropbox, and protect payloads with ML-KEM-1024 post-quantum encryption. Anyone running Windows hosts with CrossWeb EX installed is at risk, especially staff and partners who use Korean banking or government portals.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :INISAFE CrossWeb EX affected ? fixed ?
- :GitHub affected ? fixed ?
- :Windows affected ? fixed ?

## How to check

On Windows hosts with INISAFE CrossWeb EX: look for INISAFECrossWebEXSvc.exe spawning fsquirt.exe or other child processes at high integrity, and for an unexpected mscoree.dll outside the .NET directories (side-loading). On the network, check DNS and proxy logs for javadevhouse.co.kr, pythonapischool.com and cubedesign.co.kr (for example cubedesign.co.kr/news/<section>/<article|list|story>/<8 digits>). Also check for GitHub API traffic (api.github.com /issues, /contents) from non-developer processes, and for unexpected Dropbox API traffic. Full hashes and paths are in the Securelist IoC section.

## Fix

Block the listed domains. Hunt on Windows endpoints with CrossWeb EX for the process chain above and for in-memory injection into fsquirt.exe. Remove CrossWeb EX where it is not needed, and update it to the vendor's latest build where it is required. Kaspersky does not name a fixed version, so this is unknown. Warn staff about job-applicant or portfolio links pointing to github.io sites. Restrict which processes can reach api.github.com and Dropbox. If you find a hit, isolate the host and treat it as an APT intrusion.

## Timeline

- 2026-10-27T11:46:32+00:00 analyst

## Documents

- [describes] @TheHackersNews: ⚠️ Lazarus hackers are exploiting South Korean banking security software to depl https://x.com/TheHackersNews/status/2115044361176264773
- [describes] Dissecting Operation FlashHole, a complex attack by Lazarus | Securelist (Kaspersky GReAT) https://securelist.com/lazarus-operation-flashhole/121541/

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_