That sentence sums up the latest wave of a long-running espionage campaign Kaspersky researchers have tied to the North Korea‑linked Lazarus Group. Dubbed Operation FlashHole, the activity has been active since at least July 2025 and continues a pattern of highly targeted intrusions that exploit South Korean financial‑security software as a stepping stone into otherwise well‑protected corporate and institutional networks.
Operation FlashHole and the Cascade Hole context
Kaspersky links Operation FlashHole to a broader Cascade Hole campaign focused on abusing South Korean software. FlashHole follows April 2025 reporting on Operation SyncHole and is assessed to pick up where SyncHole left off, reusing the same overall playbook: trick victims into visiting malicious URLs, exploit vulnerabilities or the target's installed mandatory security components, and load backdoors and loaders into memory.
Abuse of mandatory financial-security software: INISAFE CrossWeb EX and Cross EX
Where Operation SyncHole exploited iniLINE's Cross EX, FlashHole has been found to abuse Initech's INISAFE CrossWeb EX — both mandatory, browser‑environment support programs South Korean users install to access online banking and government services. Kaspersky and prior reporting by AhnLab document a multi‑year pattern: in Q3 2021 CrossWeb was used to deploy a downloader called Racket in the DeathNote campaign; in 2022–2023 AhnLab detailed watering‑hole attacks that delivered a DLL named SCSKAppLink.dll by exploiting INISAFE CrossWeb EX; and in July 2023 AhnLab described attacks that installed Lazarus malware via an INISAFE service binary (INISAFECrossWebEXSvc.exe).
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageTechnical chain: TechHub, TouchHub, TOUCHSHIFT, ClientHub, LPEClient and Cubridge
Kaspersky lays out a multi‑stage, fileless and DLL‑sideloading centric framework. Reported details include:
- Initial lure: spear‑phishing links to malicious pages hosted on GitHub pages, including a résumé page with an AI‑generated profile photo.
- Loader and sideload: visiting the malicious site triggers CrossWeb EX to launch the legitimate Windows binary fsquirt.exe, which is used to sideload a malicious DLL called TechHub.
- Dropper cascade: TechHub downloads TouchHub, which sideloads TOUCHSHIFT (mscoree.dll) to establish persistence and run additional TechHub instances in memory; those instances fetch ClientHub, which in turn loads LPEClient to serve as a conduit for Cubridge.
- Orchestration and plugin model: Cubridge acts as a modular orchestration component that fetches plugins and tools to enumerate systems, run commands, steal files and browser data, and expand functionality. ClientHub exists in two variants — one using HTTPS to communicate with attacker servers and another using the Dropbox API.
Kaspersky emphasizes that much of the execution chain exists only in memory during initial infiltration, increasing the difficulty of detection.
Post-quantum encryption and zero‑day linkage: ML‑KEM‑1024 and CVE‑2026‑68820
A notable technical evolution in FlashHole is the use of ML‑KEM‑1024, a post‑quantum cryptographic algorithm, to encrypt connections between malware and attacker servers before fetching additional payloads. Kaspersky reports Lazarus’s adoption of such cryptography dates back to at least September 2024. Separately, Check Point reported in August 2026 that LPEClient was used after exploitation of CVE‑2026‑68820 — a privilege‑escalation flaw in Windows Ancillary Function Driver for WinSock — to deploy a FudModule rootkit.
What this means for South Korean banks, software vendors, and security teams
- South Korean banks and government portals: The campaigns repeatedly target mandatory client‑side security components (Cross EX, INISAFE CrossWeb EX, AnySign4PC), making the security of those outsourced or third‑party modules central to protecting end users and institutional access.
- Software vendors (iniLINE, Initech and others): The abuse highlights the risks tied to widely deployed authentication and signature solutions; past vulnerabilities have been leveraged for thread delivery, and vendors are implicated in joint advisories such as the July 2026 KISA advisory that flagged exploitation of AnySign4PC.
- Security teams and incident responders: The in‑memory, DLL‑sideloading, and modular plugin design — combined with the use of post‑quantum cryptography for C2 — increases the challenge of detection and analysis, while separate exploitation of a Windows zero‑day (CVE‑2026‑68820) demonstrates the attacker’s willingness to chain distinct weaknesses to gain persistence.
Kaspersky also notes the operational footprint left by these campaigns: COPPERHEDGE backdoor use coincided with data exfiltration to a dark web leak site named ULOSE, and the broader toolset Kaspersky documents includes well‑known families such as ThreatNeedle, AGAMEMNON, wAgent, SIGNBT (Struggle), COPPERHEDGE (Brandoor) and newer components like ClientHub and Cubridge.
Taken together, the evidence Kaspersky and other vendors present paints a consistent picture: a threat actor that has repeatedly weaponized widely deployed South Korean financial‑security products, retooled modular malware frameworks, and introduced post‑quantum cryptography into its communications. Kaspersky traces that cryptographic adoption back to at least September 2024, and the campaign has continued to evolve through at least July 2025 and into 2026, reinforcing a pattern of iterative capability-building that defenders will now have to contend with.
