Kaspersky Says Lazarus Abused South Korea's Mandatory CrossWeb EX Security Software in Operation FlashHole, Running GitHub-Controlled Malware Mostly in Memory Behind Post-Quantum Encryption

SINGAPORE - North Korea's Lazarus Group has again turned the security software South Koreans are required to install against them, according to research Kaspersky published on Oct. 21. In a campaign the company calls Operation FlashHole, the group abused CrossWeb EX, a financial security program needed to reach widely used online banking and government websites, as a step in an infection chain that ran almost entirely in memory.

Kaspersky said the earliest evidence of the operation dates to July 2025, shortly after the group's previous South Korean campaign, Operation SyncHole, ended. It identified at least three victims, in the software, construction and wired communication equipment manufacturing sectors, and said it was confident that "a considerably larger number of organizations across a broader spectrum of industries have been affected."

Résumés, interior design and GitHub Pages

Kaspersky could not pin down exactly what triggered the infections, but it assessed with medium-to-high confidence that targets received spear-phishing emails linking to sites hosted on GitHub Pages. One posed as the résumé of a senior network appliance developer and was likely aimed at an employee of a wired communication manufacturer. In January it was replaced by an interior design showcase that likely reached a construction-sector target.

The researchers said the job seeker's photograph on the résumé site lacked EXIF metadata and had an unnatural texture, indicating it was generated by AI, and that the group most likely used AI to build the lure site as well before tailoring it by hand. Each site loaded an external JavaScript file from attacker infrastructure.

The suspicious chain began under CrossWeb EX's service process, INISAFECrossWebEXSvc.exe, from version 3.4.1.2 of INISAFE CrossWeb EX V3, and the spawned process ran at a high integrity level. Kaspersky said the exact way CrossWeb EX was abused remains unclear. The legitimate Windows binary fsquirt.exe was then injected with shellcode carrying a downloader Kaspersky calls TechHub.

A command channel built on GitHub issues

TechHub, which Kaspersky describes as a more advanced version of the malware Mandiant named CLOUDBURST and ESET named NickelLoader, talks to a private GitHub repository through the GitHub API using a personal access token. Its handshake is visible in the repository itself: it opens an issue titled with a "1" and a host identifier, sets the body to "hel," exchanges keys through files in the repository, and changes the body to "hey" when it is ready for commands. Kaspersky said the group has used GitHub as a command server since at least July 2025, across at least three primary repositories and one fallback, likely on accounts created with hijacked email addresses.

TechHub's main payload is Cubridge, an orchestrator Kaspersky links to the malware Mandiant called SIDESHOW and to a module ESET called LightlessCan. Cubridge builds a fresh, news-style address for every request on compromised South Korean websites, such as a path ending in /news/economy/article/ followed by a random eight-digit number, and mimics browser traffic with X-CSRF-Token and X-Requested-With headers.

For persistence, a new installer Kaspersky named TouchHub copies the legitimate printfilterpipelinesvc.exe to C:\Windows\System32\RasConv\ImeBroker.exe, registers it as a service with the description "Microsoft Service" under a name made from a real netsvcs service plus two random letters, and drops a side-loaded loader named mscoree.dll beside it. It also copies the timestamps of the monitor.sys driver onto the new file to frustrate forensic timelines.

Rare ciphers, and post-quantum keys

A second new component, ClientHub, which Kaspersky assesses is an advanced version of the earlier CookiePlus malware, encrypts its command-server addresses with the SNOW 1.0 stream cipher, the first time Kaspersky has seen that cipher in Lazarus malware. It sends requests with Sec-CH-UA and Sec-Fetch headers normally produced by Chromium-based browsers, and one sample used Dropbox for command and control.

ClientHub relays traffic for LPEClient, a profiling and delivery tool Lazarus has used since 2019. The new LPEClient no longer holds its own server address. It encrypts its messages with GOST, Russia's national cipher standard, receives four ML-KEM-1024 public keys from the server, and uses the derived keys to decrypt the next payload with the Threefish cipher. Before loading that payload, it disables a user-mode syscall instrumentation hook. "Ironically, the group seems to have adopted more secure post-quantum cryptography faster than many legitimate security products," the researchers wrote.

Kaspersky also tied a separate cluster built on the COPPERHEDGE backdoor, which began around the same time, to monetization. In one case, it said, an infection ended with data posted to a dark web leak site apparently created only for that activity, and AhnLab has linked the same backdoor to a Gunra ransomware infection.

South Korea announced in October 2025 that it would begin phasing out mandatory security software for users in 2026. Kaspersky expects operations exploiting that software "will remain highly active for some time" until it is fully eliminated or mitigated.

What defenders should do

• Treat child processes of INISAFECrossWebEXSvc.exe and other banking security agents as high-signal, especially fsquirt.exe or other system binaries spawned at high integrity.
• Hunt for printfilterpipelinesvc.exe copies outside System32, for C:\Windows\System32\RasConv\ImeBroker.exe or mscoree.dll in RasConv, DrvConh or ProgramData subfolders, and for new services described only as "Microsoft Service" that run with the -TimeBroker argument.
• Baseline GitHub API use from workstations; a non-developer host creating and editing issues or pulling files from private repositories with a token deserves a look.
• Flag non-browser processes sending Sec-CH-UA or Sec-Fetch headers, and block or search proxy logs for javadevhouse.co[.]kr, pythonapischool[.]com and cubedesign[.]co[.]kr.
• Pull the full hash, path and C2 lists from Kaspersky's report. Kaspersky detects the activity as MEM:Trojan.Win64.Shellcode.gen, Trojan.Win64.DLLhijack.* and Trojan.Win64.Lazarus.*.