Kaspersky has tied a fresh espionage push against South Korea to the Lazarus Group, tracking it as Operation FlashHole. At least three organisations across construction, software and wire-communication equipment manufacturing were hit, and the researchers judge the campaign has been running since at least July 2025.
Where the earlier Operation SyncHole abused iniLINE Cross EX, this wave targets INISAFE CrossWeb EX, from Initech. Both are mandatory financial security components that Korean users install to reach online banking and government portals, which makes them a shared dependency rather than a niche application. Lazarus has used CrossWeb going back to 2021 and through AhnLab-documented watering hole work in 2022 and 2023.
The chain, mostly in memory
Kaspersky describes targeted spear-phishing mail linking to fake but plausible pages, including a portfolio site and a resume for a senior network appliance developer, complete with what appears to be an AI-generated profile photo. Loading the page triggers CrossWeb EX to launch fsquirt.exe, a legitimate Windows binary, which sideloads a malicious DLL called TechHub.
TechHub pulls TouchHub and ClientHub from GitHub, which in turn sideloads TOUCHSHIFT as mscoree.dll for persistence, then hands off to LPEClient and finally to Cubridge, the modular framework that fetches plugins, runs commands and takes browser data.
The execution chain exists only in memory during the first stage, which is why Kaspersky calls the concealment notable.
Defensive read
Because the vector is a signed, required domestic application rather than an obvious exploit, blocking the loader means watching for trusted binaries spawning unusual children and for GitHub-hosted payload retrieval. KISA and Korean vendors issued a joint advisory on this software class in July 2026.
