The notorious **Lazarus Group**, widely attributed to North Korea, is behind a new cyber espionage campaign known as **Operation FlashHole**. This operation has set its sights on at least three South Korean organizations across the construction, software, and wire-communication equipment manufacturing sectors. ### Continuation of Prior Campaigns According to Russian cybersecurity firm **Kaspersky**, **Operation FlashHole** has been active since at least July 2025 and is considered a direct continuation of **Operation SyncHole**. **Operation SyncHole**, first documented by Kaspersky in April 2025, detailed the state-sponsored adversary's targeting of South Korea's software, IT, financial, semiconductor manufacturing, and telecommunications industries since November 2024. It involved delivering malware such as **ThreatNeedle**, **AGAMEMNON**, **wAgent**, **SIGNBT**, and **COPPERHEDGE**. Sojun Ryu, a senior security researcher at **Kaspersky GReAT**, noted the group's increased selectivity: "The group targeted victims more selectively, sending spear-phishing emails with links to fabricated but relevant sites, such as portfolio and résumé pages tailored to each target." ### Exploiting Financial Security Software A key characteristic of these attacks is the exploitation of vulnerabilities in mandatory financial security software prevalent in South Korea. While **Operation SyncHole** leveraged a security flaw in **iniLINE Cross EX**, **Operation FlashHole** has been found to abuse **Initech's INISAFE CrossWeb EX**. Both are essential programs for South Korean internet users to access online banking and government services.  The **Lazarus Group** has a documented history of abusing these types of software. In Q3 2021, they used it to deploy a downloader named **Racket** as part of the **DeathNote** campaign. Between 2022 and 2023, **AhnLab** also disclosed attacks where the threat actor exploited security flaws in this software to distribute DLL malware ("SCSKAppLink.dll") via watering hole attacks. "The group first hacks Korean websites and modifies the content provided from the site," AhnLab reported in July 2023. "When a system using a vulnerable version of **INISAFE CrossWeb EX V6** visits this website via a web browser, the **Lazarus** malware (**SCSKAppLink.dll**) is installed from the distribution site through the **INISAFECrossWebEXSvc.exe** vulnerability."  ### Sophisticated Infection Chain The initial access vector for **FlashHole** is suspected to involve malicious websites hosted on **GitHub pages**. One such site featured a resume of a senior network appliance developer, likely with an AI-generated profile photo. Targets are believed to receive spear-phishing emails containing links to these malicious sites. Visiting these links triggers a complex infection sequence. It involves **CrossWeb EX** to launch the legitimate Windows binary "fsquirt.exe," which then uses DLL sideloading to launch a malicious DLL called **TechHub**. "The infection chain is rather complex and reveals the **Lazarus Group's** advanced operational techniques on targeted hosts," Kaspersky stated. "These techniques conceal their malicious payloads, intent, and their sophisticated malware delivery framework." Notably, the initial execution chain often exists only in memory, signifying the attackers' efforts to hide their compromise.  **TechHub** then downloads **TouchHub** from **GitHub**, which in turn leverages a second DLL sideloading technique to launch **TOUCHSHIFT** ("mscoree.dll"). This establishes persistence by initiating another in-memory instance of **TechHub**. This second **TechHub** instance retrieves another malware family known as **ClientHub** to download and load **LPEClient** into memory. **LPEClient** acts as a conduit for **Cubridge**, the orchestration component of the malware framework designed to fetch various plugins, modules, and tools. ### Overlaps and Broader Context These findings align with a joint July 2026 advisory from the **Korea Internet and Security Agency (KISA)** and domestic cybersecurity vendors. The advisory highlighted the **Lazarus Group's** exploitation of vulnerabilities in financial security programs like **AnySign4PC** to distribute backdoors such as **Struggle** (aka **SIGNBT 3.0**) and **Brandoor** (aka **COPPERHEDGE**), often through spear-phishing and watering hole techniques in a campaign dubbed **Operation Double Barrel**.  The **Lazarus Group's** continued refinement of its tactics, particularly its reliance on exploiting widely used, mandatory software, underscores the persistent and evolving threat it poses to South Korean entities and potentially to any organization relying on similar software architectures.