Threat reportAPTTL-2026-4000
Operation FlashHole: Lazarus watering-hole and spear-phishing campaign abusing INISAFE CrossWeb EX against South Korean organizations
Operation FlashHole (TL-2026-4000), also tracked as Operation FlashHole, is a high-severity advanced persistent threat campaign, first published 2026-10-21. It is attributed to Lazarus Group (North Korea) with medium confidence, affects INITECH INISAFE CrossWeb EX V3, maps to 21 MITRE ATT&CK techniques (T1005, T1027, T1036.005), and is covered by 9 detection rules and 31 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 21MITRE ATT&CK
- Actors
- 1Lazarus Group
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 31Indicators of compromise
Key facts for TL-2026-4000
- Threat ID
- TL-2026-4000
- Also known as
- Operation FlashHole, Operation SyncHole (predecessor campaign)
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- Lazarus Group
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- ESPIONAGE
- Target sectors
- software, construction, telecoms, manufacturing
- Target regions
- south korea
- Detection rules
- 9
- Indicators of compromise
- 31
Malware and tooling in Operation FlashHole
Malware and tooling: Bankshot, ClientHub, Cubridge, LPEClient, TOUCHSHIFT, TechHub, GOST
How Operation FlashHole works
Kaspersky assesses with medium-to-high confidence that Lazarus Group ran Operation FlashHole, the follow-on to Operation SyncHole, against at least three South Korean software, construction and wired communication equipment manufacturing organizations. Infection abuses INISAFE CrossWeb EX V3 3.4.1.2 via GitHub Pages watering holes and tailored spear-phishing, then deploys in-memory malware (TechHub, Cubridge, TouchHub, TouchShift, ClientHub, LPEClient) with GitHub API and compromised-website C2.
Operation FlashHole is a Lazarus Group campaign documented by Kaspersky (Securelist, 2026-10-21) against at least three South Korean organizations in the software, construction and wired communication equipment manufacturing sectors. Kaspersky reports the group began preparing shortly after Operation SyncHole ended (preparation from July 2025, GitHub accounts created September 2025, activity observed through January 2026). Attribution to Lazarus rests on the same initial vector and target geography as SyncHole, a multi-stage chain, reuse of the LPEClient profiling tool, and operational TTPs.
Initial access combines spear-phishing emails carrying links to GitHub Pages sites (<username>.github.io) with AI-generated lure content such as fake resumes and portfolios, and watering-hole delivery. The victim-side vector abuses INISAFE CrossWeb EX V3 version 3.4.1.2, a plug-in mandatory for South Korean online banking and government services that was also abused in 2021 (Racket downloader), 2022, 2023 and in SyncHole. Kaspersky states the exact execution mechanism is unclear; the outcome is in-memory shellcode execution at high integrity with INISAFECrossWebEXSvc.exe as parent process. No CVE or CVSS score is assigned in the source.
Stage one is TechHub, shellcode injected into fsquirt.exe, which uses private GitHub repositories (created September 2025) and Personal Access Tokens as C2, a hexadecimal host ID (0x1000-0xFFFF), RSA key exchange and AES with XOR, and commands mqdrz (device info), laeca (shellcode execution), aqvxp (process termination) and rtcya (beacon). TechHub overlaps with Mandiant's CLOUDBURST and ESET's NickelLoader. Persistence is built by TouchHub, which copies printfilterpipelinesvc.exe to C:\Windows\System32\RasConv\ImeBroker.exe, registers a service with a randomized name, and timestomps using C:\Windows\System32\drivers\monitor.sys as a reference. The TouchShift loader (mscoree.dll, side-loaded; LIGHTSHOW-like with a LockClrVersion export) derives an XOR key, decrypts with AES-CBC-128 and runs a third TechHub variant reading ActivationStore.dat.
Cubridge is the modular orchestrator (Mandiant SIDESHOW, ESET LightlessCan). It talks to compromised legitimate South Korean websites over HTTPS with a hybrid RSA and RC6 handshake and browser-mimicking headers (X-CSRF-Token). Plugins include ADFinder (LDAP queries) and FileCollector; tools include a browser credential stealer and process collector; ActionModule and FunctionModule commands cover screenshot capture archived with ZipCrypto, DPAPI-protected Chrome key extraction and PPID spoofing. ClientHub, assessed with medium-to-high confidence as the successor of CookiePlus, uses a SNOW 1.0 stream cipher, bitmask commands for reflective plugin loading, a config at C:\Program Files\Common Files\System\msadc\msadc.inc and, in at least one variant, Dropbox API. LPEClient (seen since 2020, reused from SyncHole) profiles hosts (UBR, WMI OBJECTS.DATA antivirus data, Kernel VA Shadow and CET shadow stack state), patches jscript9.dll HeapPageAllocator::ProtectPages to disable user-mode hooks, and receives its payload through a key exchange using four ML-KEM-1024 public keys, GOST and Threefish; the delivered payload is Cubridge. Kaspersky notes the post-quantum cryptography indicates intent to hide follow-on payloads.
Kaspersky also tracks COPPERHEDGE activity as a separate Lazarus monetization stream (paired with Gunra ransomware and standalone data theft for leak sites), assessed with medium-to-high confidence as related but distinct from SyncHole/FlashHole. Defenders in South Korea should prioritize CrossWeb EX child-process telemetry, mscoree.dll side-loading outside system paths, services created from RasConv paths, and GitHub API traffic from non-developer hosts.
MITRE ATT&CK techniques used in TL-2026-4000
Collection
T1005 Data from Local System; T1113 Screen Capture; T1560 Archive Collected Data
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1055 Process Injection; T1070.006 Timestomp; T1134.004 Parent PID Spoofing; T1140 Deobfuscate/Decode Files or Information; T1574.001 DLL; T1620 Reflective Code Loading
Command and Control
T1071.001 Web Protocols; T1102.002 Bidirectional Communication; T1573.002 Asymmetric Cryptography
Discovery
T1082 System Information Discovery; T1087.002 Domain Account
Execution
Persistence
Credential Access
T1555.003 Credentials from Web Browsers
Initial Access
stealth
Resource Development
Affected products and versions in Operation FlashHole
- INITECH — INISAFE CrossWeb EX V3
Vulnerable versions: 3.4.1.2
Remediation for Operation FlashHole
Patches
- Update INISAFE CrossWeb EX beyond version 3.4.1.2 per vendor and KrCERT guidance; the source does not name a fixed version
Immediate actions
- Hunt for mscoree.dll outside C:\Windows\System32 and WinSxS, especially in C:\Windows\System32\RasConv, C:\Windows\System32\DrvConh and C:\ProgramData subfolders (Dell, Apple, ssh, qorestor, RasConv)
- Hunt for services whose binary is C:\Windows\System32\RasConv\ImeBroker.exe and for ActivationStore.dat and msadc.inc files
- Block and investigate outbound HTTPS to the listed compromised Korean sites and the lure domains javadevhouse.co.kr and pythonapischool.com
- Review proxy logs for GitHub API calls authenticated with Personal Access Tokens from servers or non-developer workstations, and for unexpected Dropbox API use
- Alert on INISAFECrossWebEXSvc.exe spawning child processes or injecting into fsquirt.exe
Workarounds
- Disable the CrossWeb EX service on hosts that do not need online banking or government portal access
Longer-term hardening
- Deploy EDR with in-memory shellcode, process injection and PPID-spoofing detections
- Restrict or remove CrossWeb EX where not required and keep INISAFE components updated
- Restrict GitHub Pages and GitHub API access to approved users and accounts
- Train staff on spear-phishing with fake resumes and portfolios linking to GitHub Pages
Timeline of Operation FlashHole
- INISAFE CrossWeb EX first abused by Lazarus in 2021 (Racket downloader); abuse continued in 2022 and 2023 (month/day approximate, year per source)
- Operation SyncHole begins (Kaspersky, earlier report: Nov 2024 to Feb 2025), abusing CrossWeb EX against South Korean organizations; month approximate
- Lazarus begins preparing Operation FlashHole shortly after SyncHole ended (July 2025 per source; day approximate)
- Private GitHub repositories and accounts used as TechHub C2 created (September 2025; day approximate)
- FlashHole activity against at least three South Korean software, construction and wired communication equipment organizations observed through January 2026 (day approximate)
- Kaspersky publishes Operation FlashHole analysis on Securelist
Sources cited for Operation FlashHole
- Operation FlashHole: Lazarus breaks security, defies control (Securelist)
- Kaspersky uncovers new Lazarus-led cyberattacks targeting South Korean supply chains
- Lazarus Hits 6 South Korean Firms via Watering Hole and Cross EX, Innorix Zero-Day (The Hacker News)
- South Korean Companies Targeted by Lazarus via Watering Hole Attacks, Zero-Days (SecurityWeek)
- Lazarus Group breached semiconductor and software firms in South Korea (CyberInsider)
Detection coverage for TL-2026-4000
As of 2026-10-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4000 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.