North Korea's Lazarus Group has again turned South Korea's mandatory banking security software against the people required to install it. Researchers at Kaspersky say a campaign they call Operation FlashHole abused CrossWeb EX, a program South Koreans need to reach widely used online banking and government websites, to launch a chain of malware that lived almost entirely in memory.
Kaspersky's Sojun Ryu details the operation in the original report. The team responded to the intrusions in January and traced the earliest evidence back to July 2025, shortly after the group wrapped up its previous campaign, Operation SyncHole. At least three South Korean organizations were hit, in the software, construction and wired communication equipment manufacturing sectors. Those are different sectors from SyncHole's, which Kaspersky reads as Lazarus widening its target list.
Software every Korean must install became the way in
CrossWeb EX encrypts traffic between a user's browser and a bank or government site, and it typically runs quietly in the background. That combination is what makes it attractive. SyncHole abused a sibling product, Cross EX, which Kaspersky says appears to come from the same developer, and Lazarus has leaned on CrossWeb EX before, in 2021 to deliver the Racket downloader and again in 2022 and 2023.
Kaspersky could not pin down exactly how CrossWeb EX was abused this time. What it did see was the end result: the service process, INISAFECrossWebEXSvc.exe from INISAFE CrossWeb EX V3 version 3.4.1.2 (a build released in 2023 after a KrCERT advisory), spawning a legitimate Windows binary, fsquirt.exe, running at high integrity and injected with malicious code. Kaspersky notes that a South Korean government and vendor joint advisory published in July 2026 also covered Lazarus exploitation of financial security software.
A fake job seeker and an AI-made face
The lures were tailored. Kaspersky found a GitHub Pages site tied to the same GitHub account the malware used for command and control. The account was created last September, and the site first showed the résumé of a senior network appliance developer, likely aimed at an employee of the telecom equipment maker. In January it was swapped for an interior design portfolio, likely aimed at the construction target. The job seeker's photo carried no EXIF metadata and had an unnatural texture, which led Kaspersky to judge it AI-generated.
Kaspersky assesses with medium-to-high confidence that targets received spear-phishing emails linking to these sites, and that visiting them likely kicked off the infection involving CrossWeb EX.
Six malware families, mostly never written to disk
The first payload, a downloader Kaspersky calls TechHub, talks to a private GitHub repository through the GitHub API using a personal access token, using GitHub issues to run its handshake. Kaspersky describes it as a more advanced version of the malware Mandiant named CLOUDBURST and ESET named NickelLoader, which previously used plain HTTP(S) servers.
For persistence the group installed a new pair, TouchHub and TouchShift, side-loaded under the name mscoree.dll, then a second TechHub instance that dropped ClientHub and LPEClient. At the top sits Cubridge, the framework's orchestrator, an evolution of what Mandiant tracked as SIDESHOW. Cubridge builds a fresh C2 address for every request out of news-site words such as "economy" and "article". Kaspersky says a separate "function module" that reimplements Windows commands like ipconfig, netstat and whoami appears to be based on ESET's LightlessCan, seen for the first time as a standalone module.
Watch CrossWeb EX's children and GitHub API traffic
Organizations in South Korea should treat the CrossWeb EX service launching fsquirt.exe as a red flag, look for mscoree.dll loaded from unexpected locations, and question GitHub API calls carrying personal access tokens from machines that have no business making them. Block the indicators below. Kaspersky's report carries the full hash list.
- Lure-site script hosts: hxxps://javadevhouse[.]co[.]kr/ajax/libs/jquery/1[.]7[.]3/jquery[.]min[.]js and hxxps://pythonapischool[.]com/api/detach
- Cubridge hard-coded C2: hxxps://cubedesign[.]co[.]kr/news/
- Other network indicators listed by Kaspersky: fp-news[.]co[.]kr, k-wbc[.]co[.]kr, rcsh[.]co[.]kr, www[.]ksog[.]org
- Sample MD5s: ec84d6cb2ae7974767aedac246b50a3e, a28cba214058fcae2883d8cffc883abd, c105d6b16f544582772de0159f24c00a
FlashHole is the latest chapter in a pattern that goes back to Operation Dream Magic and its MagicLine watering holes: in South Korea, the software the state requires for safe banking keeps doubling as Lazarus's most dependable front door.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.