# Operation FlashHole: Lazarus watering-hole and spear-phishing campaign abusing INISAFE CrossWeb EX against South Korean organizations

> Kaspersky assesses with medium-to-high confidence that Lazarus Group ran Operation FlashHole, the follow-on to Operation SyncHole, against at least three South Korean software, construction and wired communication equipment manufacturing organizations. Infection abuses INISAFE CrossWeb EX V3 3.4.1.2 via GitHub Pages watering holes and tailored spear-phishing, then deploys in-memory malware (TechHub, Cubridge, TouchHub, TouchShift, ClientHub, LPEClient) with GitHub API and compromised-website C2.

- **Published:** 2026-10-21T02:24:19Z
- **Last reviewed:** 2026-10-21T02:24:19Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4000
- **ID:** TL-2026-4000
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Lazarus Group (North Korea)
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Operation FlashHole is a Lazarus Group campaign documented by Kaspersky (Securelist, 2026-10-21) against at least three South Korean organizations in the software, construction and wired communication equipment manufacturing sectors. Kaspersky reports the group began preparing shortly after Operation SyncHole ended (preparation from July 2025, GitHub accounts created September 2025, activity observed through January 2026). Attribution to Lazarus rests on the same initial vector and target geography as SyncHole, a multi-stage chain, reuse of the LPEClient profiling tool, and operational TTPs.

Initial access combines spear-phishing emails carrying links to GitHub Pages sites (<username>.github.io) with AI-generated lure content such as fake resumes and portfolios, and watering-hole delivery. The victim-side vector abuses INISAFE CrossWeb EX V3 version 3.4.1.2, a plug-in mandatory for South Korean online banking and government services that was also abused in 2021 (Racket downloader), 2022, 2023 and in SyncHole. Kaspersky states the exact execution mechanism is unclear; the outcome is in-memory shellcode execution at high integrity with INISAFECrossWebEXSvc.exe as parent process. No CVE or CVSS score is assigned in the source.

Stage one is TechHub, shellcode injected into fsquirt.exe, which uses private GitHub repositories (created September 2025) and Personal Access Tokens as C2, a hexadecimal host ID (0x1000-0xFFFF), RSA key exchange and AES with XOR, and commands mqdrz (device info), laeca (shellcode execution), aqvxp (process termination) and rtcya (beacon). TechHub overlaps with Mandiant's CLOUDBURST and ESET's NickelLoader. Persistence is built by TouchHub, which copies printfilterpipelinesvc.exe to C:\Windows\System32\RasConv\ImeBroker.exe, registers a service with a randomized name, and timestomps using C:\Windows\System32\drivers\monitor.sys as a reference. The TouchShift loader (mscoree.dll, side-loaded; LIGHTSHOW-like with a LockClrVersion export) derives an XOR key, decrypts with AES-CBC-128 and runs a third TechHub variant reading ActivationStore.dat.

Cubridge is the modular orchestrator (Mandiant SIDESHOW, ESET LightlessCan). It talks to compromised legitimate South Korean websites over HTTPS with a hybrid RSA and RC6 handshake and browser-mimicking headers (X-CSRF-Token). Plugins include ADFinder (LDAP queries) and FileCollector; tools include a browser credential stealer and process collector; ActionModule and FunctionModule commands cover screenshot capture archived with ZipCrypto, DPAPI-protected Chrome key extraction and PPID spoofing. ClientHub, assessed with medium-to-high confidence as the successor of CookiePlus, uses a SNOW 1.0 stream cipher, bitmask commands for reflective plugin loading, a config at C:\Program Files\Common Files\System\msadc\msadc.inc and, in at least one variant, Dropbox API. LPEClient (seen since 2020, reused from SyncHole) profiles hosts (UBR, WMI OBJECTS.DATA antivirus data, Kernel VA Shadow and CET shadow stack state), patches jscript9.dll HeapPageAllocator::ProtectPages to disable user-mode hooks, and receives its payload through a key exchange using four ML-KEM-1024 public keys, GOST and Threefish; the delivered payload is Cubridge. Kaspersky notes the post-quantum cryptography indicates intent to hide follow-on payloads.

Kaspersky also tracks COPPERHEDGE activity as a separate Lazarus monetization stream (paired with Gunra ransomware and standalone data theft for leak sites), assessed with medium-to-high confidence as related but distinct from SyncHole/FlashHole. Defenders in South Korea should prioritize CrossWeb EX child-process telemetry, mscoree.dll side-loading outside system paths, services created from RasConv paths, and GitHub API traffic from non-developer hosts.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1543.003 Windows Service
- T1574.001 DLL
- T1574.001 DLL
- T1055 Process Injection
- T1134.004 Parent PID Spoofing
- T1620 Reflective Code Loading
- T1070.006 Timestomp
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1555.003 Credentials from Web Browsers
- T1087.002 Domain Account
- T1082 System Information Discovery
- T1113 Screen Capture
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1071.001 Web Protocols
- T1102.002 Bidirectional Communication
- T1573.002 Asymmetric Cryptography
- T1584.004 Server

## Sources

- [Operation FlashHole: Lazarus breaks security, defies control (Securelist)](https://securelist.com/lazarus-operation-flashhole/121541/)
- [Kaspersky uncovers new Lazarus-led cyberattacks targeting South Korean supply chains](https://www.kaspersky.com/about/press-releases/kaspersky-uncovers-new-lazarus-led-cyberattacks-targeting-south-korean-supply-chains)
- [Lazarus Hits 6 South Korean Firms via Watering Hole and Cross EX, Innorix Zero-Day (The Hacker News)](https://thehackernews.com/2025/04/lazarus-hits-6-south-korean-firms-via.html)
- [South Korean Companies Targeted by Lazarus via Watering Hole Attacks, Zero-Days (SecurityWeek)](https://www.securityweek.com/south-korean-companies-targeted-by-lazarus-via-watering-hole-attacks-zero-days/)
- [Lazarus Group breached semiconductor and software firms in South Korea (CyberInsider)](https://cyberinsider.com/lazarus-group-breached-semiconductor-and-software-firms-in-south-korea/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4000