The North Korea-linked Lazarus Group has been linked to a cyber espionage campaign known as Operation FlashHole, targeting at least three organizations in South Korea across the construction, software, and wire-communication equipment manufacturing industries.
The campaign has reportedly been active since at least July 2025 and appears to build on an earlier cyber espionage operation known as Operation SyncHole. The attackers are using targeted phishing emails, malicious websites, and vulnerabilities in South Korean financial security software to infiltrate selected organizations.
Security researchers say the campaign demonstrates the group’s continued efforts to refine its malware delivery methods, evade detection, and steal sensitive information from targeted systems.
Operation FlashHole Uses Targeted Phishing Attacks
Operation FlashHole relies on carefully prepared spear-phishing emails containing links to websites designed to appear relevant to specific targets. These websites may resemble professional portfolio pages, résumés, or other legitimate online resources.
Investigators have identified suspicious websites hosted on GitHub Pages, including a page containing the résumé of a senior network appliance developer and a profile photograph believed to have been generated using artificial intelligence.
Although the exact initial infection method remains unclear, researchers suspect that victims receive phishing emails directing them to these malicious pages. Visiting the websites may trigger an infection chain that abuses installed financial security software to execute malicious code.
Abuse of South Korean Financial Security Software
A key feature of Operation FlashHole is the exploitation of INISAFE CrossWeb EX, a financial security solution used in South Korea to support certificate-based authentication and electronic signatures for online banking and government services.
The Lazarus Group has previously abused similar software to deliver malware. In earlier campaigns, attackers exploited vulnerabilities in financial security applications to install malicious DLL files and establish access to compromised systems.
Operation FlashHole appears to follow a similar approach, using the trusted software environment as a potential entry point for malware execution.
The attack chain reportedly abuses CrossWeb EX to launch the legitimate Windows executable fsquirt.exe. Attackers then use DLL sideloading to load a malicious component called TechHub.
DLL sideloading is a technique in which attackers exploit the way a legitimate application loads dynamic-link libraries (DLLs) to execute malicious code under the cover of a trusted program.
This approach can make malicious activity more difficult to identify during the early stages of an intrusion.
Connection to Operation SyncHole
Operation FlashHole follows an earlier campaign known as Operation SyncHole, which targeted South Korean organizations beginning in November 2024.
That campaign affected multiple industries, including software development, information technology, finance, semiconductor manufacturing, and telecommunications.
The attacks involved exploiting a vulnerability in iniLINE Cross EX, another financial security application widely used in South Korea. The attackers used the software to help deliver malware families such as ThreatNeedle, AGAMEMNON, wAgent, SIGNBT, and COPPERHEDGE.
The earlier campaign also involved the exploitation of a vulnerability in the Innorix Agent file-transfer solution to facilitate lateral movement within compromised networks.
The similarities between the two operations suggest that the Lazarus Group continues to exploit trusted South Korean software as a way to gain access to targeted organizations.
Multi-Stage Malware Infection Chain
Operation FlashHole uses a complex infection process involving several malware components. Each stage helps the attackers establish persistence, retrieve additional payloads, collect information, or execute further commands.
The reported infection chain includes the following components:
- TechHub: A downloader that communicates with GitHub to retrieve additional malware, including TouchHub and ClientHub. It can also collect information about the infected device and running processes.
- TouchHub: An installer component responsible for delivering TouchShift.
- TouchShift: A malware dropper capable of deploying additional malicious tools, including keyloggers, screenshot utilities, and backdoors.
- ClientHub: A previously undocumented backdoor with variants that communicate with attacker-controlled infrastructure over HTTPS or interact with the Dropbox API.
- LPEClient: A long-running malware tool used for victim profiling and delivering additional payloads.
- Cubridge: A malware orchestration component that communicates with command-and-control servers and downloads plugins, utilities, and other modules.
These components allow attackers to collect system information, execute commands, search for and collect files, monitor changes to local drives, and potentially steal browser data and other sensitive information.
Some versions of the malware can also communicate through legitimate cloud services, complicating efforts to distinguish malicious activity from normal network traffic.
Malware Executes in Memory to Evade Detection
One notable feature of Operation FlashHole is its use of in-memory execution during the initial stages of infection.
Rather than relying exclusively on conventional files written to disk, parts of the infection chain operate directly in system memory. This can reduce certain forensic traces and make detection more difficult for security monitoring systems.
The attackers also use legitimate Windows processes and DLL sideloading techniques to conceal malicious execution.
By separating the infection process into multiple stages, the group can retrieve additional tools only after an initial foothold has been established. This modular approach gives attackers greater flexibility when adapting their operations to different victims.
Lazarus Adopts Post-Quantum Cryptography
Another significant development is the reported use of ML-KEM-1024, a post-quantum key-encapsulation mechanism, to establish encrypted communications with attacker-controlled infrastructure.
ML-KEM is designed to help protect cryptographic key establishment against attacks from sufficiently powerful future quantum computers.
Its appearance in the malware framework highlights the group’s interest in advanced cryptographic techniques to protect communications between compromised systems and command-and-control servers.
Researchers have reportedly traced the use of this technology in Lazarus-related activity back to at least September 2024, suggesting that the capability predates the public disclosure of Operation FlashHole.
The use of post-quantum cryptography does not itself make malware undetectable. However, it can make network communications harder to inspect when combined with other evasion techniques.
Broader Lazarus Group Activity
Operation FlashHole is part of a wider pattern of cyber operations associated with the Lazarus Group, which has repeatedly targeted organizations in South Korea and other countries.
Previous campaigns have involved financial theft, cyber espionage, malware deployment, and the exploitation of software vulnerabilities to gain unauthorized access to victim systems.
In July 2026, South Korean authorities and domestic security organizations issued a joint advisory concerning attacks that exploited vulnerabilities in financial security applications, including AnySign4PC. The activity was associated with a campaign called Operation Double Barrel and involved the deployment of backdoors such as Struggle and Brandoor.
Separately, earlier reporting in August 2026 described the use of LPEClient following the exploitation of a Windows privilege-escalation vulnerability identified as CVE-2026-68820, with the objective of deploying the FudModule rootkit.
These developments illustrate how the group continues to reuse established tools while introducing new components and techniques.
Data Theft and Potential Consequences
The Lazarus Group’s activities can have consequences beyond initial system compromise. Once attackers establish persistent access, they may collect confidential documents, browser information, login credentials, and other business-sensitive data.
Related activity involving the COPPERHEDGE backdoor has reportedly been associated with data exfiltration from at least one victim, with stolen information subsequently appearing on a dark web leak site.
Such incidents demonstrate the potential overlap between espionage-focused intrusions and financially motivated data theft or extortion.
However, the available findings do not establish that every organization affected by Operation FlashHole experienced data exfiltration or ransomware deployment.
How Organizations Can Defend Against Similar Attacks
Organizations, particularly those operating in South Korea’s technology, construction, manufacturing, and telecommunications sectors, should consider the following security measures:
- Update financial security software: Apply security patches for INISAFE CrossWeb EX and other installed authentication or banking applications.
- Monitor legitimate Windows processes: Investigate unusual executions of trusted programs, including unexpected DLL loading.
- Strengthen email security: Filter suspicious links and attachments, and train employees to recognize targeted phishing attempts.
- Inspect outbound network traffic: Monitor unexpected connections to GitHub-hosted content, cloud APIs, and unfamiliar command-and-control infrastructure.
- Use endpoint detection and response: Look for suspicious in-memory execution, DLL sideloading, and unusual process relationships.
- Apply least-privilege access: Restrict permissions and segment critical systems to limit lateral movement.
- Review browser and account security: Reset potentially compromised credentials, revoke suspicious sessions, and investigate unusual account activity.
- Prepare an incident response plan: Preserve forensic evidence, isolate affected systems, and assess whether sensitive data has been accessed or removed.
Organizations should also maintain an accurate inventory of third-party security applications installed on employee devices, particularly software required for online banking, electronic signatures, and government services.
Conclusion
Operation FlashHole highlights the Lazarus Group’s continued use of targeted phishing, vulnerable software, DLL sideloading, and modular malware to compromise organizations in South Korea.
The campaign’s multi-stage infection chain and reported adoption of post-quantum cryptography demonstrate the group’s evolving technical capabilities.
For organizations, the key lesson is that trusted applications can become an entry point when they contain exploitable vulnerabilities or are abused by sophisticated attackers. Keeping software updated, monitoring suspicious process activity, strengthening phishing defenses, and investigating unusual network communications remain essential to reducing the risk of compromise.
