Lazarus Group Exploits South Korean Security Software in Operation FlashHole.

"hel" — the handshake marker TechHub posts to GitHub to begin communication, then updates the issue body to "hey" after a successful exchange, according to the Securelist analysis.

How the attack reached users: CrossWeb EX and tailored watering holes

The campaign, dubbed Operation FlashHole, targeted South Korea and shows evidence dating back to July 2025. The attackers abused the mandatory financial security product INISAFE CrossWeb EX (CrossWeb EX V3 version 3.4.1.2 is cited) as part of an in‑browser infection chain, mirroring tactics used in the previous Operation SyncHole but swapping Cross EX for CrossWeb EX. Phishing e‑mails directed victims to fabricated but relevant sites hosted on GitHub Pages (the GitHub account in question was created "last September"), including a résumé page and an interior‑design portfolio tailored to each target. The résumé used an AI‑generated image (no EXIF metadata and unusual texture), indicating the adversary incorporated AI into their lures.

Malware architecture: TechHub, Cubridge, ClientHub, and LPEClient

The intrusion unfolds as a multistage, largely in‑memory framework. TechHub acts as the downloader and initial payload; unlike earlier variants that used HTTP(S) C2, this TechHub communicates with GitHub via the GitHub API and uses Personal Access Tokens. TechHub performs a brief GitHub issue‑based handshake (creating an issue titled 1[ID] with body "hel", retrieving an RSA public key file, uploading an encrypted XOR key, then changing the issue body to "hey") before profiling the host and accepting four command types including direct in‑memory shellcode loading.

Cubridge is described as the central orchestrator and loader framework. It builds C2 URLs from human‑looking path components (for example: /news/economy/article/12345678) and employs RSA plus RC6 for handshaking. Cubridge supports plugins, tools, and two core modules — an ActionModule handling file/process/system operations (commands 23–41) and a FunctionModule implementing many Windows built‑in commands (commands 42–79). Observed tools include a browser stealer and a process collector.

ClientHub is a separate controller with bitmask‑style command semantics, supporting HTTP(S) and Dropbox‑backed variants, and delivering plugins such as a file archiver, file collector, file cleaner, and a drive/session monitor. LPEClient — reused from prior campaigns — is the profiling and payload delivery component that now communicates via a shared buffer through ClientHub and employs layered, post‑quantum and other nonstandard cryptographic steps (ML‑KEM blocks, Threefish decryption) before reflectively loading a final payload.

Persistence and service‑side loaders: TouchHub and TouchShift

The actors achieved SYSTEM‑level persistence with TouchHub, a previously undocumented parent installer that copies a legitimate printfilterpipelinesvc.exe to C:\Windows\System32\RasConv\ImeBroker.exe, drops a side‑loaded mscoree.dll (TouchShift), registers a randomly named service under a netsvcs svchost group name, and starts it immediately. TouchShift decrypts embedded AES‑CBC‑128 shellcode using a derived 16‑byte key based on supplied arguments, a hard‑coded XOR key, and the executable name; the decrypted shellcode launches a third TechHub variant (DLL side‑loading with a registered service). The actor also synchronizes MAC timestamps on certain files (for example monitor.sys) to hinder forensics.

Infrastructure, victims, and indicators

• At least three South Korean firms were identified as victims in the software, construction, and wired communication equipment manufacturing sectors; the software sector was targeted in both SyncHole and FlashHole.
• The adversary used GitHub repositories as C2 since at least July 2025 and leveraged a small set of compromised legitimate South Korean websites (media and interior design domains) as Cubridge and ClientHub C2 servers. One ClientHub sample used Dropbox as a C2 channel.
• Examples of observed C2 hosts: javadevhouse.co[.]kr, pythonapischool[.]com, cubedesign[.]co[.]kr (with multiple paths), fp-news[.]co[.]kr, k-wbc[.]co[.]kr, rcsh[.]co[.]kr, and www.ksog.org (paths listed in the report).
• Kaspersky detection labels for this activity include MEM:Trojan.Win64.Shellcode.gen, Trojan.Win64.DLLhijack.*, and Trojan.Win64.Lazarus.*. The report provides file‑hash indicators and file paths such as C:\Windows\System32\RasConv\mscoree.dll and C:\Windows\System32\RasConv\ActivationStore.dat for defenders to reference.

What this means for South Korean security teams, policymakers, and enterprises

• South Korean security teams: monitor interactions between browsers and mandatory financial security software such as CrossWeb EX, and examine in‑memory execution patterns and service‑side DLL side‑loading traces (e.g., RasConv\ImeBroker.exe and mscoree.dll paths).
• Policymakers: the Securelist analysis notes the South Korean government published a joint advisory (July 2026) covering these techniques and that Seoul unveiled a plan in October 2025 to phase out mandatory installation of security software beginning in 2026 — a policy move cited as relevant to reducing this attack surface over time.
• Enterprises in targeted sectors (software, construction, wired communications): the report highlights tailored spear‑phishing and watering‑hole pages designed to appear as relevant résumés or portfolios; organizations should scrutinize inbound links and external content that mimic recruitment or vendor materials.

Securelist's analysis shows a group refining and modularizing a multi‑year toolset: GitHub‑based handshakes, in‑memory loaders, service side‑loading, post‑quantum key steps and an extensive plugin set. The attackers appear to have prioritized concealment and host profiling while continuing to exploit mandatory security software — a vulnerability the October 2025 policy shift aims to reduce but which the report warns will remain exploitable for some time. Read the full technical write‑up at https://securelist.com/lazarus-operation-flashhole/121541/.