Lazarus Campaign Abuses INISAFE CrossWeb EX in South Korea

Kaspersky has attributed Operation FlashHole to the North Korea-linked Lazarus Group, describing a cyber-espionage campaign against at least three South Korean organizations in the construction, software, and wire-communication equipment manufacturing sectors. Active since at least July 2025, the operation abuses Initech’s INISAFE CrossWeb EX, a financial-security product required for access to some South Korean online banking and government services.

The campaign follows Operation SyncHole, which Kaspersky documented in April 2025. That earlier activity targeted South Korean software, IT, financial, semiconductor manufacturing, and telecommunications organizations by exploiting iniLINE Cross EX. FlashHole continues the broader pattern of using widely deployed South Korea-focused security software as an entry point for malware delivery.

Targeted sites and an in-memory execution chain

Kaspersky said FlashHole victims were selected more narrowly and were likely directed through spear-phishing messages to fabricated but relevant websites. One observed GitHub Pages site presented the résumé of a senior network appliance developer and used a profile image suspected to have been generated with artificial intelligence. The precise initial-access mechanism remains unconfirmed, but the malicious sites are central to the observed infection flow.

Visiting a site can trigger an abuse of CrossWeb EX that launches the legitimate Windows binary fsquirt.exe. Attackers then use DLL sideloading to run a malicious DLL named TechHub. Kaspersky said the initial execution chain exists only in memory, an approach intended to conceal the compromise and its payloads on the targeted host.

TechHub retrieves TouchHub from GitHub. TouchHub uses further DLL sideloading to launch TOUCHSHIFT, a rogue mscoree.dll payload that establishes persistence by starting another TechHub instance in memory. That second instance obtains ClientHub, which then downloads and loads LPEClient into memory. LPEClient acts as a conduit to Cubridge, the framework component that fetches additional plugins, modules, and tools.

Modular tooling and post-quantum cryptography

Kaspersky describes TechHub as an advanced version of the CLOUDBURST and NickelLoader downloaders. It can collect device and running-process information while communicating with GitHub for additional payloads. Cubridge is assessed as an evolution of SIDESHOW and LightlessCan, with command-and-control communications and support for reusable plugins, DLL utilities, and modules.

The available capabilities include collecting comprehensive system information, running commands, and stealing files and web-browser data. Plugins can create ZIP archives, collect files that match a search pattern, remove specified files, and monitor local-drive changes. ClientHub, a previously undocumented backdoor, has variants that communicate either over HTTPS with an attacker-controlled server or through the Dropbox API.

A notable feature of the latest malware version is its use of ML-KEM-1024, a post-quantum cryptographic algorithm, to create an encrypted connection to attacker infrastructure before downloading and executing more malware in memory. Kaspersky traced Lazarus use of this cryptography to at least September 2024, more than a year before the FlashHole disclosure.

A recurring entry point for South Korean targets

INISAFE CrossWeb EX has appeared in prior Lazarus activity. It was used to deploy the Racket downloader in the DeathNote campaign in 2021, and AhnLab disclosed watering-hole attacks from 2022 to 2023 that exploited a vulnerable INISAFE CrossWeb EX V6 installation to distribute SCSKAppLink.dll. KISA and South Korean cybersecurity vendors also warned in July 2026 that Lazarus had exploited financial-security software, including AnySign4PC, to deliver Struggle and Brandoor backdoors.

Kaspersky places FlashHole within the broader Cascade Hole campaign and noted a contemporaneous wave involving the COPPERHEDGE backdoor. In at least one case, that infection resulted in data exfiltration to the ULOSE dark-web leak site. For businesses using financial-security components, the practical implication is to patch and inventory these products alongside mainstream endpoint software, while treating targeted links that initiate trusted Windows processes as a high-priority investigation signal.