> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Lazarus abuses mandatory Korean banking security software in Operation FlashHole campaign - URL: https://f4n6.co.uk/security-feed/lazarus-abuses-mandatory-korean-banking-security-software-in-operation-flashhole-campaign/ - Published: 2026-10-21T10:25:46.000Z - Updated: 2026-10-21T10:25:46.000Z - Author: Jeff Davies - Tags: #security-feed, Lazarus ## 1\. Executive summary Kaspersky has documented Operation FlashHole, a Lazarus Group (MITRE G0032) espionage campaign that uses the mandatory South Korean financial security client INISAFE CrossWeb EX V3 (version 3.4.1.2) as the entry point to a multi-stage, memory-resident malware chain. At least three South Korean organisations in software, construction and wired communication equipment manufacturing were hit, with the earliest activity dated to July 2025 and response work in January 2026\. The chain deploys updated TechHub, Cubridge, TouchShift and LPEClient strains plus two new families, TouchHub and ClientHub, and uses GitHub repositories, compromised South Korean websites and Dropbox as command-and-control. No CVE is associated with this item and there is no CISA KEV entry; the intrusion depends on abuse of a legitimately installed, high-integrity security service rather than a named vulnerability. EMEA financial services exposure is indirect: the campaign targets South Korea, but the same CrossWeb EX-class software and the same Lazarus toolset have appeared in prior operations, and any institution running Korean banking clients or employing staff who access Korean government or banking portals should treat the software as an attack surface. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28 | The intrusion path runs through a third-party financial security product (INISAFE CrossWeb EX V3 3.4.1.2) that the institution does not develop and cannot patch itself. | Third-party risk assessment must cover mandatory client-side security software, its vendor update channel and the integrity level it runs at, not just hosted service providers. | | DORA Art. 30 | The same product is installed under a vendor bundle and runs as a high-integrity service, so contractual terms govern how the vendor discloses flaws and supplies fixes. | Contract clauses should require notification of security defects in the client software and a defined remediation timeline. | | NIS2 Art. 21(2)(d) | The campaign abuses a supply chain component (a vendor-maintained security client) as the initial access vector. | Supply chain security measures must extend to endpoint security software and its update mechanism. | ## 3\. Technical analysis & attack chain Kaspersky assesses with medium-to-high confidence that the same actor behind Operation SyncHole ran FlashHole, based on the initial vector, targets, multi-stage chain and shared use of LPEClient. The attribution to Lazarus Group is corroborated by MITRE ATT&CK (G0032). The specific link between SyncHole and FlashHole rests on Kaspersky's analysis and is single-sourced; the South Korean government joint advisory (July 2026) and AhnLab's Operation Double Barrel report overlap but are cited by Kaspersky rather than independently verified here. Confirmed chain, in order: 1. A target receives a spear-phishing email linking to a fabricated but role-relevant site (a résumé or portfolio page) hosted on GitHub Pages under a `.github.io` domain. Kaspersky could not determine the precise trigger but assesses medium-to-high confidence that visiting the site initiated the CrossWeb EX infection. 2. The lure page loads an external JavaScript file via a script tag from `javadevhouse.co[.]kr` or `pythonapischool[.]com`. 3. The legitimate INISAFE CrossWeb EX service (`INISAFECrossWebEXSvc.exe`, from bundle V3 3.4.1.2) spawns a process at high integrity. The exact abuse method is not established; the chain ends in in-memory execution. 4. The legitimate Windows binary `fsquirt.exe` runs under the CrossWeb EX process and is injected with shellcode carrying a malicious DLL, the TechHub malware. 5. TechHub (first, in-memory instance) deploys TouchHub, which installs persistence and launches TouchShift, which reflectively loads a second TechHub instance. 6. The second TechHub deploys ClientHub and LPEClient. Cubridge is held in memory and redeployed later, after persistence is established, because Kaspersky assesses it as the most sophisticated orchestrator. **TechHub** is a downloader and the initial payload. It is an advanced version of the malware Mandiant calls CLOUDBURST and ESET calls NickelLoader; the earlier version used HTTP(S) C2, this one uses the GitHub API against a private repository with a Personal Access Token, either hard-coded or read from configuration. On load it creates or reads a 4-byte hex identifier in the range 0x1000 to 0xFFFF, checks `GET /issues?state=[open/closed]` to detect and clear prior communication, then handshakes by posting an issue titled `1[ID]` with body `hel`. File exchange uses filenames of the form `[1|2][ID][random-16-byte-key]`, where prefix 2 means repository-to-TechHub and 1 means TechHub-to-repository, and the 16-byte key is the AES key (hard-coded or updated IV). After key exchange it reads a prefix-2 file and checks the content equals `hel`, profiles the host, sends the encrypted profile, then updates the issue body from `hel` to `hey` via `PATCH /issues/[issue number]`. It supports four commands: `mqdrz` (collect device and process information), `laeca` (invoke received shellcode in memory), `aqvxp` (terminate current process) and `rtcya` (beacon). **TouchHub** is a previously unknown installer. It copies the legitimate `C:\Windows\System32\printfilterpipelinesvc.exe` to `C:\Windows\System32\RasConv\ImeBroker.exe`, registers it as a service, and drops an embedded TouchShift payload named `mscoree.dll` in the same directory. It synchronises the MAC timestamps of `C:\Windows\System32\drivers\monitor.sys` with the newly written file to hinder forensics. It collects up to 100 legitimate service names registered under the netsvcs svchost group in `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost`, picks one at random, appends two random alphabetic characters to form a new service name, and creates a service running `C:\Windows\System32\RasConv\ImeBroker.exe -TimeBroker` with description `Microsoft Service`. It also drops `C:\Windows\System32\RasConv\ActivationStore.dat`, TechHub's configuration file. Three files result, launching TouchShift with SYSTEM privileges. **TouchShift** is almost identical to the version Mandiant described, sharing the malicious export `LockClrVersion`. It XORs the argument supplied by TouchHub with a hard-coded key, XORs the result with the executable filename, and uses the outcome as an AES key. All three strings must be exactly 16 bytes, padded with NULL or truncated. One observed combination was `-TimeBroker` padded with NULLs, key `x809G736iC3f8Wp8`, and `ImeBroker.exe` padded with NULLs. It decrypts the embedded payload with AES-CBC-128 without padding; the result is shellcode beginning with a call instruction that wraps the third TechHub version (DLL side-loading with a registered service), which reads `ActivationStore.dat` as external configuration. **Cubridge** (Mandiant: SIDESHOW; one module ESET calls LightlessCan) is the central orchestrator. It selects a predefined C2 and builds a unique URL per request as `[C2_URL]/[page1]/[page2]/[page3]`, drawing page1 from `economy, opinion, politics, national, international, medical, investment, sports, lifestyle, shopping, culture` and page2 from `article, list, story`, with page3 a random integer between 10000000 and 99999999\. One hard-coded C2 observed was `hxxps://cubedesign[.]co[.]kr/news/AABBCC` (version 5.1), where AABBCC is substituted with null, yielding URLs such as `hxxps://cubedesign[.]co[.]kr/news/economy/article/12345678`. Authentication uses a POST with three key-value pairs: a randomly generated key from a word dictionary, an 8-byte hex bot ID, a fixed token `KW4Ofw982CNJjxd51AVqkGAop`, and a 16-byte hex session ID. Handshake combines RSA and RC6\. Traffic mimics a browser with `X-CSRF-Token`, `X-Requested-With` and `Upgrade-Insecure-Requests` headers. Cubridge supports commands 0 to 22 directly (device info, ZipCrypto archiving with hard-coded password `xdkiTajAAxc3i/w[<881fnC!G*cb1Dit2sh.gAk/`, file creation, reflective DLL injection, plugin and shellcode load/unload, scheduled execution, config get/set, and loading `ActionModule.dll` via export `AppinfoView` and `FunctionModule.dll` via export `PresentationFontConfig`). The action module (commands 23 to 41) covers disk and file operations, command execution including PPID spoofing and session impersonation, process termination and thread suspend/resume, secure deletion by overwriting with `0 → 1 → random → 1 → 0`, deletion via the `:EFS` alternate data stream using `SetFileInformationByHandle`, and a non-blocking connect that may be port scanning. The function module (commands 42 to 79) reimplements Windows built-ins (`ipconfig`, `net`, `netsh advfirewall firewall`, `netstat`, `ping -6`, `reg`, `sc`, `ping`, `whoami`, `nslookup`, `schtasks`, `systeminfo`, `arp`), captures all displays, synchronises MAC times, injects and unloads DLLs, and at command 61 calls `CryptUnprotectData` to retrieve the DPAPI-protected AES key from Chromium's `%LOCALAPPDATA%\Google\Chrome\User Data\Local State` using the `encrypted_key` keyword. Command 64 reads a file, decrypts it with XOR key `0x59`, extracts paths and archives them with ZipCrypto. **ClientHub** is new and assessed with medium-high confidence as an advanced version of CookiePlus, based on shared class name, configuration path and plugins. It has at least two versions, one using HTTP(S) and one using the Dropbox API with credentials. Configuration comes from internal resources or `C:\Program Files\Common Files\System\msadc\msadc.inc`, holding SNOW 1.0 keys and IVs, scheduled execution times and SNOW-encrypted C2 addresses. This is the first observed use of SNOW in Lazarus malware. It builds a 32-byte key from a random array overwritten with process ID, the first four bytes of decrypted C2 information, random bytes, a state-machine flag, the current FILETIME and more random bytes, encrypts that with a hard-coded RSA public key and Base64-encodes it, and sends it via GET with browser-like `Sec-CH-UA`, `Sec-CH-UA-Platform`, `Sec-CH-UA-Mobile`, `Sec-Fetch-Mode` and `Sec-Fetch-Dest` headers. The C2 replies with a custom header struct (has\_more\_data, ROR13 body\_checksum, body\_type, unknown, body\_length, IV\[2\]) and a body. body\_type is a bitmask: odd values load a payload (1 reflective DLL, 3 plugin invoke, 5 plugin load without invoke, 11 invoke then unload, 17 interactive shared-buffer session), even values invoke or unload already-loaded payloads (2 invoke, 8 unload, 16 exchange data through the interactive session). Four plugins were observed: file archiver (ZipCrypto, no password), file collector, file cleaner (overwrite with NULLs, rename to a random same-length name, delete), and drive/session monitor. ClientHub also loads LPEClient and carries its C2 traffic. **LPEClient** is the only strain shared with Operation SyncHole and has been revamped: it no longer holds a C2 address and instead talks to ClientHub through a shared buffer. It collects host details including the Windows revision from `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UBR` or the `SYSTEM_BUILD_VERSION_INFORMATION` structure, antivirus products from `C:\Windows\System32\wbem\Repository\OBJECTS.DATA` (keywords `AntiVirusProduct`, `companyName`, `displayName`), Kernel VA Shadow status from `SYSTEM_KERNEL_VA_SHADOW_INFORMATION` and Shadow Stack (CET) status from `SYSTEM_SHADOW_STACK_INFORMATION`. It generates a 32-byte identifier with HighwayHash XORed with system time, compresses with XPRESS Huffman at maximum setting, prefixes message ID `0xF07D6B34` and encrypts with GOST (Magma). Key exchange uses message `0xA39CF278`; the response is AES-CBC-256 decrypted with the SHA-256 hash of a 1,568-byte random value as key. It then receives four 1,568-byte blocks each holding an ML-KEM-1024 public key, derives four shared keys and ciphertexts, encrypts the ciphertexts with GOST and sends them with message `0xEF8C0D51`. The payload response is decrypted with Threefish using a 256-byte key from the four shared keys and a tweak derived by XORing the identifier with 0xA5; the decrypted message must be over 4 KB and start with `MZ`, then is reflectively loaded. Success is signalled with `0xCB790A25`. Before loading, LPEClient bypasses security products by using `HeapPageAllocator::ProtectPages` in `jscript9.dll` to change page protection on `MD4Update` and overwrite its start with a hard-coded syscall stub, disabling a user-mode syscall instrumentation hook. **C2 infrastructure.** At least three primary GitHub repositories and one fallback were used, with GitHub C2 in use since at least July 2025; Kaspersky suspects the accounts were created from hijacked email addresses and disguised by copying normal projects. Cubridge and ClientHub C2 used a small number of compromised legitimate South Korean media and interior design sites, later a broader range of compromised sites, and one ClientHub sample used Dropbox. **Unconfirmed and single-sourced points.** The exact CrossWeb EX abuse method is not established. The claim that the lure images were AI-generated rests on missing EXIF metadata and image texture, which is Kaspersky's inference. The link between the COPPERHEDGE cluster, Gunra ransomware and a dark web leak site is described by Kaspersky and AhnLab and is not corroborated here. The reclassification of the SyncHole ThreatNeedle variant as IMETHOD is Kaspersky's. All of the above is single-sourced to Kaspersky; verify before acting on attribution or infrastructure blocking. ## 4\. Mitigation & containment P1 within 24 hours: - Hunt for the TouchHub persistence artefacts: service binary `C:\Windows\System32\RasConv\ImeBroker.exe` (a copy of `printfilterpipelinesvc.exe`), side-loaded `C:\Windows\System32\RasConv\mscoree.dll`, and `C:\Windows\System32\RasConv\ActivationStore.dat`. Also check `C:\Windows\System32\DrvConh\mscoree.dll` and `C:\Windows\System32\DrvConh\ActivationStore.dat`. Isolate any host with these files. - Search for services whose binary path is `C:\Windows\System32\RasConv\ImeBroker.exe -TimeBroker` and whose description is `Microsoft Service`; a service name derived from a netsvcs entry plus two random letters is the TouchHub signature. - Block the C2 and lure domains at egress: `javadevhouse.co[.]kr`, `pythonapischool[.]com`, `cubedesign[.]co[.]kr`, `fp-news[.]co[.]kr`, `k-wbc[.]co[.]kr`, `rcsh[.]co[.]kr`, `www[.]ksog[.]org`. Treat these as compromised legitimate sites; blocking is containment, not a takedown. - Restrict outbound access to `api.github.com` and `github.io` from endpoints that have no business need, and alert on GitHub API calls from non-developer hosts, especially `POST /issues` and `PATCH /issues/[n]`. - Deploy the Kaspersky verdicts as EDR block rules: `MEM:Trojan.Win64.Shellcode.gen`, `Trojan.Win64.DLLhijack.*`, `Trojan.Win64.Lazarus.*`. P2 within 72 hours: - Audit INISAFE CrossWeb EX V3 installations. Version 3.4.1.2 is the bundle named in this campaign; confirm the installed version and whether a newer build is available from the vendor. Where the software is not required for a business function, remove it. - Monitor for `fsquirt.exe` spawned by `INISAFECrossWebEXSvc.exe`, and for any process at high integrity spawned from the CrossWeb EX service. - Add detection for the ClientHub configuration path `C:\Program Files\Common Files\System\msadc\msadc.inc` and the loader paths `C:\ProgramData\Dell\mscoree.dll`, `C:\ProgramData\Apple\mscoree.dll`, `C:\ProgramData\ssh\mscoree.dll`, `C:\ProgramData\qorestor\mscoree.dll`, `C:\ProgramData\RasConv\mscoree.dll`, plus `C:\ProgramData\Dell\Dell1.tmp`, `C:\ProgramData\Dell\Dell3.tmp`, `C:\ProgramData\Package.txt` and `C:\ProgramData\desktops.ini`. - Review browser credential stores on any suspect host; LPEClient and the browser stealer target Chromium `Local State` and stored passwords, cookies, history and bookmarks. P3 within 7 days: - Add the YARA and Sigma rules in section 6 to detection pipelines and tune. - Review egress proxy logs for the Cubridge URL pattern (`/[page1]/[page2]/[8-digit]` on the listed domains) and for ClientHub's Chromium client-hint headers on non-browser processes. - Where Korean banking or government portals are accessed, document the CrossWeb EX dependency in the third-party register and confirm the vendor's patch notification process. ## 5\. Indicators of compromise | type | value | confidence | source | | ------ | ------------------------------------------------------------------- | ---------- | ----------------------------------------- | | md5 | ec84d6cb2ae7974767aedac246b50a3e | high | Kaspersky (mscoree.dll, TouchShift) | | md5 | a28cba214058fcae2883d8cffc883abd | high | Kaspersky (mscoree.dll, TouchShift) | | md5 | c105d6b16f544582772de0159f24c00a | high | Kaspersky (mscoree.dll, TouchShift) | | md5 | 2f8475a90a25624ed02f1d18d4e6d65d | high | Kaspersky (mscoree.dll, TouchShift) | | md5 | 676fabe30a28b53925fba98e34b35986 | high | Kaspersky (mscoree.dll, TouchShift) | | md5 | b4a7eff35f048f06fb0a2d7631f23a7d | high | Kaspersky (mscoree.dll, TouchShift) | | md5 | ff07641dc56914dd90ee0bd7404d7ad7 | high | Kaspersky (liblzma.dll, ClientHub loader) | | domain | javadevhouse\[.\]co\[.\]kr | medium | Kaspersky (lure JS host) | | domain | pythonapischool\[.\]com | medium | Kaspersky (lure JS host) | | url | hxxps://cubedesign\[.\]co\[.\]kr/news | medium | Kaspersky (Cubridge C2) | | url | hxxps://cubedesign\[.\]co\[.\]kr/mobile/fashion | medium | Kaspersky (Cubridge C2) | | url | hxxps://fp-news\[.\]co\[.\]kr/shop/cart | medium | Kaspersky (Cubridge C2) | | url | hxxps://k-wbc\[.\]co\[.\]kr/skin/social/social\_view.php | medium | Kaspersky (ClientHub C2) | | url | hxxps://rcsh\[.\]co\[.\]kr/modules/bbs/tiles/bbs\_div/inputForm.php | medium | Kaspersky (ClientHub C2) | | url | hxxps://www\[.\]ksog\[.\]org/insert\_file/handle.php | medium | Kaspersky (ClientHub C2) | | path | C:\\Windows\\System32\\RasConv\\ImeBroker.exe | high | Kaspersky (TouchHub service binary) | | path | C:\\Windows\\System32\\RasConv\\mscoree.dll | high | Kaspersky (TouchShift side-load) | | path | C:\\Windows\\System32\\RasConv\\ActivationStore.dat | high | Kaspersky (TechHub config) | | path | C:\\Windows\\System32\\DrvConh\\mscoree.dll | medium | Kaspersky | | path | C:\\Windows\\System32\\DrvConh\\ActivationStore.dat | medium | Kaspersky | | path | C:\\Program Files\\Common Files\\System\\msadc\\msadc.inc | high | Kaspersky (ClientHub config) | | path | C:\\ProgramData\\Dell\\mscoree.dll | medium | Kaspersky | | path | C:\\ProgramData\\Apple\\mscoree.dll | medium | Kaspersky | | path | C:\\ProgramData\\ssh\\mscoree.dll | medium | Kaspersky | | path | C:\\ProgramData\\qorestor\\mscoree.dll | medium | Kaspersky | | path | C:\\ProgramData\\RasConv\\mscoree.dll | medium | Kaspersky | | path | C:\\ProgramData\\Dell\\Dell1.tmp | medium | Kaspersky | | path | C:\\ProgramData\\Dell\\Dell3.tmp | medium | Kaspersky | | path | C:\\ProgramData\\Package.txt | medium | Kaspersky | | path | C:\\ProgramData\\desktops.ini | medium | Kaspersky | ```iocs md5 ec84d6cb2ae7974767aedac246b50a3e md5 a28cba214058fcae2883d8cffc883abd md5 c105d6b16f544582772de0159f24c00a md5 2f8475a90a25624ed02f1d18d4e6d65d md5 676fabe30a28b53925fba98e34b35986 md5 b4a7eff35f048f06fb0a2d7631f23a7d md5 ff07641dc56914dd90ee0bd7404d7ad7 domain javadevhouse[.]co[.]kr domain pythonapischool[.]com url hxxps://cubedesign[.]co[.]kr/news url hxxps://cubedesign[.]co[.]kr/mobile/fashion url hxxps://fp-news[.]co[.]kr/shop/cart url hxxps://k-wbc[.]co[.]kr/skin/social/social_view.php url hxxps://rcsh[.]co[.]kr/modules/bbs/tiles/bbs_div/inputForm.php url hxxps://www[.]ksog[.]org/insert_file/handle.php path C:\Windows\System32\RasConv\ImeBroker.exe path C:\Windows\System32\RasConv\mscoree.dll path C:\Windows\System32\RasConv\ActivationStore.dat path C:\Windows\System32\DrvConh\mscoree.dll path C:\Windows\System32\DrvConh\ActivationStore.dat path C:\Program Files\Common Files\System\msadc\msadc.inc path C:\ProgramData\Dell\mscoree.dll path C:\ProgramData\Apple\mscoree.dll path C:\ProgramData\ssh\mscoree.dll path C:\ProgramData\qorestor\mscoree.dll path C:\ProgramData\RasConv\mscoree.dll path C:\ProgramData\Dell\Dell1.tmp path C:\ProgramData\Dell\Dell3.tmp path C:\ProgramData\Package.txt path C:\ProgramData\desktops.ini ``` The source lists the TouchShift and ClientHub hashes as 32-character MD5 values; they are reproduced verbatim. The C2 URLs are compromised legitimate sites and are defanged here. All indicators are single-sourced to Kaspersky; verify before enforcement. Behavioural indicators: | behaviour | where to observe | confidence | | ---------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------- | ---------- | | fsquirt.exe spawned by INISAFECrossWebEXSvc.exe at high integrity | EDR process tree | medium | | Service created with binary path C:\\Windows\\System32\\RasConv\\ImeBroker.exe -TimeBroker and description Microsoft Service | Windows System event log 7045, service registry | high | | GitHub API calls (POST /issues, PATCH /issues/\[n\]) from non-developer endpoints | egress proxy, GitHub audit logs | medium | | HTTP GET with Sec-CH-UA, Sec-CH-UA-Platform, Sec-Fetch-Mode, Sec-Fetch-Dest from a non-browser process | proxy, EDR network telemetry | medium | | Cubridge URL pattern /\[page1\]/\[page2\]/\[8-digit\] on listed domains | proxy logs | medium | | CryptUnprotectData access to Chromium Local State encrypted\_key | EDR API telemetry | medium | ## 6\. Detection ```yara rule Lazarus_FlashHole_TouchHub_Service { meta: author = "Adverse Trace" date = "2026-10-21" reference = "https://securelist.com/lazarus-operation-flashhole/121541/" description = "Detects TouchHub installer artefacts: RasConv service path, ImeBroker binary name and ActivationStore config" strings: $s1 = "C:\\Windows\\System32\\RasConv\\ImeBroker.exe" ascii wide $s2 = "-TimeBroker" ascii wide $s3 = "ActivationStore.dat" ascii wide $s4 = "Microsoft Service" ascii wide $s5 = "mscoree.dll" ascii wide condition: uint16(0) == 0x5A4D and 3 of them } ``` ```yara rule Lazarus_FlashHole_Cubridge_ClientHub_Config { meta: author = "Adverse Trace" date = "2026-10-21" reference = "https://securelist.com/lazarus-operation-flashhole/121541/" description = "Detects Cubridge and ClientHub hard-coded strings and configuration paths" strings: $c1 = "KW4Ofw982CNJjxd51AVqkGAop" ascii $c2 = "xdkiTajAAxc3i/w[<881fnC!G*cb1Dit2sh.gAk/" ascii $c3 = "msadc.inc" ascii wide $c4 = "ActionModule.dll" ascii wide $c5 = "FunctionModule.dll" ascii wide $c6 = "AppinfoView" ascii $c7 = "PresentationFontConfig" ascii $c8 = "LockClrVersion" ascii condition: uint16(0) == 0x5A4D and 2 of them } ``` ```yaml title: TouchHub service persistence via RasConv ImeBroker id: 7f3c2a91-4b6e-4d2a-9c1e-8a5f0b2d6e13 status: experimental description: Detects creation of the TouchHub service running ImeBroker.exe with the -TimeBroker argument author: Adverse Trace date: 2026-10-21 references: - https://securelist.com/lazarus-operation-flashhole/121541/ logsource: product: windows service: system detection: selection: EventID: 7045 ImagePath|contains: 'C:\Windows\System32\RasConv\ImeBroker.exe' ImagePath|contains: '-TimeBroker' condition: selection falsepositives: - None expected; RasConv and ImeBroker are not legitimate service paths level: critical ``` ```yaml title: CrossWeb EX service spawning fsquirt.exe id: 2b8e5d47-9c1a-4f6b-b3d2-6e0a7c4f1d95 status: experimental description: Detects the FlashHole injection chain where fsquirt.exe is spawned under the INISAFE CrossWeb EX service author: Adverse Trace date: 2026-10-21 references: - https://securelist.com/lazarus-operation-flashhole/121541/ logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: '\INISAFECrossWebEXSvc.exe' Image|endswith: '\fsquirt.exe' condition: selection falsepositives: - Legitimate Bluetooth file transfer launched from the CrossWeb EX context (unlikely) level: high ``` ## Threat actor context **Lazarus Group** · [G0032](https://attack.mitre.org/groups/G0032?ref=f4n6.co.uk) · aka Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY [Lazarus Group](https://attack.mitre.org/groups/G0032?ref=f4n6.co.uk) is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [Lazarus Group](https://attack.mitre.org/groups/G0032?ref=f4n6.co.uk) has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. … ## 7\. Sources - Kaspersky Securelist, "Dissecting Operation FlashHole, a complex attack by Lazarus", 2026-10-21\. https://securelist.com/lazarus-operation-flashhole/121541/ - Kaspersky Securelist, "Operation FlashHole: Lazarus breaks security, defies control", 2026-10-21\. https://securelist.com/lazarus-operation-flashhole/121541/ - MITRE ATT&CK, Lazarus Group (G0032). https://attack.mitre.org/groups/G0032/ ## 8\. Adverse Trace position Adverse Trace assesses Operation FlashHole as a targeted espionage campaign against South Korean organisations, with no CVE and no CISA KEV entry; the risk to EMEA financial services is indirect and depends on whether the institution runs INISAFE CrossWeb EX or similar mandatory Korean banking clients. The attribution to Lazarus Group is corroborated by MITRE ATT&CK; the SyncHole-to-FlashHole link and the COPPERHEDGE, Gunra and leak-site claims are single-sourced to Kaspersky and should be treated as unconfirmed until independently verified. We will monitor for further reporting on the CrossWeb EX abuse method and on the GitHub and Dropbox C2 infrastructure, and we will update this advisory if the vendor publishes a fixed CrossWeb EX build or if the indicators are corroborated by a second source. Clients running Korean banking or government portal access should confirm CrossWeb EX versions and apply the P1 hunts in section 4 now. --- [Read the original source →](https://securelist.com/lazarus-operation-flashhole/121541/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*