Lazarus abuses mandatory Korean banking security software in Operation FlashHole campaign

1. Executive summary

Kaspersky has documented Operation FlashHole, a Lazarus Group (MITRE G0032) espionage campaign that uses the mandatory South Korean financial security client INISAFE CrossWeb EX V3 (version 3.4.1.2) as the entry point to a multi-stage, memory-resident malware chain. At least three South Korean organisations in software, construction and wired communication equipment manufacturing were hit, with the earliest activity dated to July 2025 and response work in January 2026. The chain deploys updated TechHub, Cubridge, TouchShift and LPEClient strains plus two new families, TouchHub and ClientHub, and uses GitHub repositories, compromised South Korean websites and Dropbox as command-and-control. No CVE is associated with this item and there is no CISA KEV entry; the intrusion depends on abuse of a legitimately installed, high-integrity security service rather than a named vulnerability. EMEA financial services exposure is indirect: the campaign targets South Korea, but the same CrossWeb EX-class software and the same Lazarus toolset have appeared in prior operations, and any institution running Korean banking clients or employing staff who access Korean government or banking portals should treat the software as an attack surface.

2. Regulatory framing

3. Technical analysis & attack chain

Kaspersky assesses with medium-to-high confidence that the same actor behind Operation SyncHole ran FlashHole, based on the initial vector, targets, multi-stage chain and shared use of LPEClient. The attribution to Lazarus Group is corroborated by MITRE ATT&CK (G0032). The specific link between SyncHole and FlashHole rests on Kaspersky's analysis and is single-sourced; the South Korean government joint advisory (July 2026) and AhnLab's Operation Double Barrel report overlap but are cited by Kaspersky rather than independently verified here.

Confirmed chain, in order:

1. A target receives a spear-phishing email linking to a fabricated but role-relevant site (a résumé or portfolio page) hosted on GitHub Pages under a <username>.github.io domain. Kaspersky could not determine the precise trigger but assesses medium-to-high confidence that visiting the site initiated the CrossWeb EX infection.
2. The lure page loads an external JavaScript file via a script tag from javadevhouse.co[.]kr or pythonapischool[.]com.
3. The legitimate INISAFE CrossWeb EX service (INISAFECrossWebEXSvc.exe, from bundle V3 3.4.1.2) spawns a process at high integrity. The exact abuse method is not established; the chain ends in in-memory execution.
4. The legitimate Windows binary fsquirt.exe runs under the CrossWeb EX process and is injected with shellcode carrying a malicious DLL, the TechHub malware.
5. TechHub (first, in-memory instance) deploys TouchHub, which installs persistence and launches TouchShift, which reflectively loads a second TechHub instance.
6. The second TechHub deploys ClientHub and LPEClient. Cubridge is held in memory and redeployed later, after persistence is established, because Kaspersky assesses it as the most sophisticated orchestrator.

TechHub is a downloader and the initial payload. It is an advanced version of the malware Mandiant calls CLOUDBURST and ESET calls NickelLoader; the earlier version used HTTP(S) C2, this one uses the GitHub API against a private repository with a Personal Access Token, either hard-coded or read from configuration. On load it creates or reads a 4-byte hex identifier in the range 0x1000 to 0xFFFF, checks GET /issues?state=[open/closed] to detect and clear prior communication, then handshakes by posting an issue titled 1[ID] with body hel. File exchange uses filenames of the form [1|2][ID][random-16-byte-key], where prefix 2 means repository-to-TechHub and 1 means TechHub-to-repository, and the 16-byte key is the AES key (hard-coded or updated IV). After key exchange it reads a prefix-2 file and checks the content equals hel, profiles the host, sends the encrypted profile, then updates the issue body from hel to hey via PATCH /issues/[issue number]. It supports four commands: mqdrz (collect device and process information), laeca (invoke received shellcode in memory), aqvxp (terminate current process) and rtcya (beacon).

TouchHub is a previously unknown installer. It copies the legitimate C:\Windows\System32\printfilterpipelinesvc.exe to C:\Windows\System32\RasConv\ImeBroker.exe, registers it as a service, and drops an embedded TouchShift payload named mscoree.dll in the same directory. It synchronises the MAC timestamps of C:\Windows\System32\drivers\monitor.sys with the newly written file to hinder forensics. It collects up to 100 legitimate service names registered under the netsvcs svchost group in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost, picks one at random, appends two random alphabetic characters to form a new service name, and creates a service running C:\Windows\System32\RasConv\ImeBroker.exe -TimeBroker with description Microsoft Service. It also drops C:\Windows\System32\RasConv\ActivationStore.dat, TechHub's configuration file. Three files result, launching TouchShift with SYSTEM privileges.

TouchShift is almost identical to the version Mandiant described, sharing the malicious export LockClrVersion. It XORs the argument supplied by TouchHub with a hard-coded key, XORs the result with the executable filename, and uses the outcome as an AES key. All three strings must be exactly 16 bytes, padded with NULL or truncated. One observed combination was -TimeBroker padded with NULLs, key x809G736iC3f8Wp8, and ImeBroker.exe padded with NULLs. It decrypts the embedded payload with AES-CBC-128 without padding; the result is shellcode beginning with a call instruction that wraps the third TechHub version (DLL side-loading with a registered service), which reads ActivationStore.dat as external configuration.

Cubridge (Mandiant: SIDESHOW; one module ESET calls LightlessCan) is the central orchestrator. It selects a predefined C2 and builds a unique URL per request as [C2_URL]/[page1]/[page2]/[page3], drawing page1 from economy, opinion, politics, national, international, medical, investment, sports, lifestyle, shopping, culture and page2 from article, list, story, with page3 a random integer between 10000000 and 99999999. One hard-coded C2 observed was hxxps://cubedesign[.]co[.]kr/news/AABBCC (version 5.1), where AABBCC is substituted with null, yielding URLs such as hxxps://cubedesign[.]co[.]kr/news/economy/article/12345678. Authentication uses a POST with three key-value pairs: a randomly generated key from a word dictionary, an 8-byte hex bot ID, a fixed token KW4Ofw982CNJjxd51AVqkGAop, and a 16-byte hex session ID. Handshake combines RSA and RC6. Traffic mimics a browser with X-CSRF-Token, X-Requested-With and Upgrade-Insecure-Requests headers. Cubridge supports commands 0 to 22 directly (device info, ZipCrypto archiving with hard-coded password xdkiTajAAxc3i/w[<881fnC!G*cb1Dit2sh.gAk/, file creation, reflective DLL injection, plugin and shellcode load/unload, scheduled execution, config get/set, and loading ActionModule.dll via export AppinfoView and FunctionModule.dll via export PresentationFontConfig). The action module (commands 23 to 41) covers disk and file operations, command execution including PPID spoofing and session impersonation, process termination and thread suspend/resume, secure deletion by overwriting with 0 → 1 → random → 1 → 0, deletion via the :EFS alternate data stream using SetFileInformationByHandle, and a non-blocking connect that may be port scanning. The function module (commands 42 to 79) reimplements Windows built-ins (ipconfig, net, netsh advfirewall firewall, netstat, ping -6, reg, sc, ping, whoami, nslookup, schtasks, systeminfo, arp), captures all displays, synchronises MAC times, injects and unloads DLLs, and at command 61 calls CryptUnprotectData to retrieve the DPAPI-protected AES key from Chromium's %LOCALAPPDATA%\Google\Chrome\User Data\Local State using the encrypted_key keyword. Command 64 reads a file, decrypts it with XOR key 0x59, extracts paths and archives them with ZipCrypto.

ClientHub is new and assessed with medium-high confidence as an advanced version of CookiePlus, based on shared class name, configuration path and plugins. It has at least two versions, one using HTTP(S) and one using the Dropbox API with credentials. Configuration comes from internal resources or C:\Program Files\Common Files\System\msadc\msadc.inc, holding SNOW 1.0 keys and IVs, scheduled execution times and SNOW-encrypted C2 addresses. This is the first observed use of SNOW in Lazarus malware. It builds a 32-byte key from a random array overwritten with process ID, the first four bytes of decrypted C2 information, random bytes, a state-machine flag, the current FILETIME and more random bytes, encrypts that with a hard-coded RSA public key and Base64-encodes it, and sends it via GET with browser-like Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Mobile, Sec-Fetch-Mode and Sec-Fetch-Dest headers. The C2 replies with a custom header struct (has_more_data, ROR13 body_checksum, body_type, unknown, body_length, IV[2]) and a body. body_type is a bitmask: odd values load a payload (1 reflective DLL, 3 plugin invoke, 5 plugin load without invoke, 11 invoke then unload, 17 interactive shared-buffer session), even values invoke or unload already-loaded payloads (2 invoke, 8 unload, 16 exchange data through the interactive session). Four plugins were observed: file archiver (ZipCrypto, no password), file collector, file cleaner (overwrite with NULLs, rename to a random same-length name, delete), and drive/session monitor. ClientHub also loads LPEClient and carries its C2 traffic.

LPEClient is the only strain shared with Operation SyncHole and has been revamped: it no longer holds a C2 address and instead talks to ClientHub through a shared buffer. It collects host details including the Windows revision from HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UBR or the SYSTEM_BUILD_VERSION_INFORMATION structure, antivirus products from C:\Windows\System32\wbem\Repository\OBJECTS.DATA (keywords AntiVirusProduct, companyName, displayName), Kernel VA Shadow status from SYSTEM_KERNEL_VA_SHADOW_INFORMATION and Shadow Stack (CET) status from SYSTEM_SHADOW_STACK_INFORMATION. It generates a 32-byte identifier with HighwayHash XORed with system time, compresses with XPRESS Huffman at maximum setting, prefixes message ID 0xF07D6B34 and encrypts with GOST (Magma). Key exchange uses message 0xA39CF278; the response is AES-CBC-256 decrypted with the SHA-256 hash of a 1,568-byte random value as key. It then receives four 1,568-byte blocks each holding an ML-KEM-1024 public key, derives four shared keys and ciphertexts, encrypts the ciphertexts with GOST and sends them with message 0xEF8C0D51. The payload response is decrypted with Threefish using a 256-byte key from the four shared keys and a tweak derived by XORing the identifier with 0xA5; the decrypted message must be over 4 KB and start with MZ, then is reflectively loaded. Success is signalled with 0xCB790A25. Before loading, LPEClient bypasses security products by using HeapPageAllocator::ProtectPages in jscript9.dll to change page protection on MD4Update and overwrite its start with a hard-coded syscall stub, disabling a user-mode syscall instrumentation hook.

C2 infrastructure. At least three primary GitHub repositories and one fallback were used, with GitHub C2 in use since at least July 2025; Kaspersky suspects the accounts were created from hijacked email addresses and disguised by copying normal projects. Cubridge and ClientHub C2 used a small number of compromised legitimate South Korean media and interior design sites, later a broader range of compromised sites, and one ClientHub sample used Dropbox.

Unconfirmed and single-sourced points. The exact CrossWeb EX abuse method is not established. The claim that the lure images were AI-generated rests on missing EXIF metadata and image texture, which is Kaspersky's inference. The link between the COPPERHEDGE cluster, Gunra ransomware and a dark web leak site is described by Kaspersky and AhnLab and is not corroborated here. The reclassification of the SyncHole ThreatNeedle variant as IMETHOD is Kaspersky's. All of the above is single-sourced to Kaspersky; verify before acting on attribution or infrastructure blocking.

4. Mitigation & containment

P1 within 24 hours:

• Hunt for the TouchHub persistence artefacts: service binary C:\Windows\System32\RasConv\ImeBroker.exe (a copy of printfilterpipelinesvc.exe), side-loaded C:\Windows\System32\RasConv\mscoree.dll, and C:\Windows\System32\RasConv\ActivationStore.dat. Also check C:\Windows\System32\DrvConh\mscoree.dll and C:\Windows\System32\DrvConh\ActivationStore.dat. Isolate any host with these files.
• Search for services whose binary path is C:\Windows\System32\RasConv\ImeBroker.exe -TimeBroker and whose description is Microsoft Service; a service name derived from a netsvcs entry plus two random letters is the TouchHub signature.
• Block the C2 and lure domains at egress: javadevhouse.co[.]kr, pythonapischool[.]com, cubedesign[.]co[.]kr, fp-news[.]co[.]kr, k-wbc[.]co[.]kr, rcsh[.]co[.]kr, www[.]ksog[.]org. Treat these as compromised legitimate sites; blocking is containment, not a takedown.
• Restrict outbound access to api.github.com and github.io from endpoints that have no business need, and alert on GitHub API calls from non-developer hosts, especially POST /issues and PATCH /issues/[n].
• Deploy the Kaspersky verdicts as EDR block rules: MEM:Trojan.Win64.Shellcode.gen, Trojan.Win64.DLLhijack.*, Trojan.Win64.Lazarus.*.

P2 within 72 hours:

• Audit INISAFE CrossWeb EX V3 installations. Version 3.4.1.2 is the bundle named in this campaign; confirm the installed version and whether a newer build is available from the vendor. Where the software is not required for a business function, remove it.
• Monitor for fsquirt.exe spawned by INISAFECrossWebEXSvc.exe, and for any process at high integrity spawned from the CrossWeb EX service.
• Add detection for the ClientHub configuration path C:\Program Files\Common Files\System\msadc\msadc.inc and the loader paths C:\ProgramData\Dell\mscoree.dll, C:\ProgramData\Apple\mscoree.dll, C:\ProgramData\ssh\mscoree.dll, C:\ProgramData\qorestor\mscoree.dll, C:\ProgramData\RasConv\mscoree.dll, plus C:\ProgramData\Dell\Dell1.tmp, C:\ProgramData\Dell\Dell3.tmp, C:\ProgramData\Package.txt and C:\ProgramData\desktops.ini.
• Review browser credential stores on any suspect host; LPEClient and the browser stealer target Chromium Local State and stored passwords, cookies, history and bookmarks.

P3 within 7 days:

• Add the YARA and Sigma rules in section 6 to detection pipelines and tune.
• Review egress proxy logs for the Cubridge URL pattern (/[page1]/[page2]/[8-digit] on the listed domains) and for ClientHub's Chromium client-hint headers on non-browser processes.
• Where Korean banking or government portals are accessed, document the CrossWeb EX dependency in the third-party register and confirm the vendor's patch notification process.

5. Indicators of compromise

md5  ec84d6cb2ae7974767aedac246b50a3e
md5  a28cba214058fcae2883d8cffc883abd
md5  c105d6b16f544582772de0159f24c00a
md5  2f8475a90a25624ed02f1d18d4e6d65d
md5  676fabe30a28b53925fba98e34b35986
md5  b4a7eff35f048f06fb0a2d7631f23a7d
md5  ff07641dc56914dd90ee0bd7404d7ad7
domain  javadevhouse[.]co[.]kr
domain  pythonapischool[.]com
url  hxxps://cubedesign[.]co[.]kr/news
url  hxxps://cubedesign[.]co[.]kr/mobile/fashion
url  hxxps://fp-news[.]co[.]kr/shop/cart
url  hxxps://k-wbc[.]co[.]kr/skin/social/social_view.php
url  hxxps://rcsh[.]co[.]kr/modules/bbs/tiles/bbs_div/inputForm.php
url  hxxps://www[.]ksog[.]org/insert_file/handle.php
path  C:\Windows\System32\RasConv\ImeBroker.exe
path  C:\Windows\System32\RasConv\mscoree.dll
path  C:\Windows\System32\RasConv\ActivationStore.dat
path  C:\Windows\System32\DrvConh\mscoree.dll
path  C:\Windows\System32\DrvConh\ActivationStore.dat
path  C:\Program Files\Common Files\System\msadc\msadc.inc
path  C:\ProgramData\Dell\mscoree.dll
path  C:\ProgramData\Apple\mscoree.dll
path  C:\ProgramData\ssh\mscoree.dll
path  C:\ProgramData\qorestor\mscoree.dll
path  C:\ProgramData\RasConv\mscoree.dll
path  C:\ProgramData\Dell\Dell1.tmp
path  C:\ProgramData\Dell\Dell3.tmp
path  C:\ProgramData\Package.txt
path  C:\ProgramData\desktops.ini

The source lists the TouchShift and ClientHub hashes as 32-character MD5 values; they are reproduced verbatim. The C2 URLs are compromised legitimate sites and are defanged here. All indicators are single-sourced to Kaspersky; verify before enforcement.

Behavioural indicators:

6. Detection

rule Lazarus_FlashHole_TouchHub_Service
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-21"
        reference = "https://securelist.com/lazarus-operation-flashhole/121541/"
        description = "Detects TouchHub installer artefacts: RasConv service path, ImeBroker binary name and ActivationStore config"
    strings:
        $s1 = "C:\\Windows\\System32\\RasConv\\ImeBroker.exe" ascii wide
        $s2 = "-TimeBroker" ascii wide
        $s3 = "ActivationStore.dat" ascii wide
        $s4 = "Microsoft Service" ascii wide
        $s5 = "mscoree.dll" ascii wide
    condition:
        uint16(0) == 0x5A4D and 3 of them
}

rule Lazarus_FlashHole_Cubridge_ClientHub_Config
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-21"
        reference = "https://securelist.com/lazarus-operation-flashhole/121541/"
        description = "Detects Cubridge and ClientHub hard-coded strings and configuration paths"
    strings:
        $c1 = "KW4Ofw982CNJjxd51AVqkGAop" ascii
        $c2 = "xdkiTajAAxc3i/w[<881fnC!G*cb1Dit2sh.gAk/" ascii
        $c3 = "msadc.inc" ascii wide
        $c4 = "ActionModule.dll" ascii wide
        $c5 = "FunctionModule.dll" ascii wide
        $c6 = "AppinfoView" ascii
        $c7 = "PresentationFontConfig" ascii
        $c8 = "LockClrVersion" ascii
    condition:
        uint16(0) == 0x5A4D and 2 of them
}

title: TouchHub service persistence via RasConv ImeBroker
id: 7f3c2a91-4b6e-4d2a-9c1e-8a5f0b2d6e13
status: experimental
description: Detects creation of the TouchHub service running ImeBroker.exe with the -TimeBroker argument
author: Adverse Trace
date: 2026-10-21
references:

  - https://securelist.com/lazarus-operation-flashhole/121541/
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7045
    ImagePath|contains: 'C:\Windows\System32\RasConv\ImeBroker.exe'
    ImagePath|contains: '-TimeBroker'
  condition: selection
falsepositives:

  - None expected; RasConv and ImeBroker are not legitimate service paths
level: critical

title: CrossWeb EX service spawning fsquirt.exe
id: 2b8e5d47-9c1a-4f6b-b3d2-6e0a7c4f1d95
status: experimental
description: Detects the FlashHole injection chain where fsquirt.exe is spawned under the INISAFE CrossWeb EX service
author: Adverse Trace
date: 2026-10-21
references:

  - https://securelist.com/lazarus-operation-flashhole/121541/
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\INISAFECrossWebEXSvc.exe'
    Image|endswith: '\fsquirt.exe'
  condition: selection
falsepositives:

  - Legitimate Bluetooth file transfer launched from the CrossWeb EX context (unlikely)
level: high

Threat actor context

Lazarus Group · G0032 · aka Labyrinth Chollima, HIDDEN COBRA, Guardians of Peace, ZINC, NICKEL ACADEMY

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. …

7. Sources

• Kaspersky Securelist, "Dissecting Operation FlashHole, a complex attack by Lazarus", 2026-10-21. https://securelist.com/lazarus-operation-flashhole/121541/
• Kaspersky Securelist, "Operation FlashHole: Lazarus breaks security, defies control", 2026-10-21. https://securelist.com/lazarus-operation-flashhole/121541/
• MITRE ATT&CK, Lazarus Group (G0032). https://attack.mitre.org/groups/G0032/

8. Adverse Trace position

Adverse Trace assesses Operation FlashHole as a targeted espionage campaign against South Korean organisations, with no CVE and no CISA KEV entry; the risk to EMEA financial services is indirect and depends on whether the institution runs INISAFE CrossWeb EX or similar mandatory Korean banking clients. The attribution to Lazarus Group is corroborated by MITRE ATT&CK; the SyncHole-to-FlashHole link and the COPPERHEDGE, Gunra and leak-site claims are single-sourced to Kaspersky and should be treated as unconfirmed until independently verified. We will monitor for further reporting on the CrossWeb EX abuse method and on the GitHub and Dropbox C2 infrastructure, and we will update this advisory if the vendor publishes a fixed CrossWeb EX build or if the indicators are corroborated by a second source. Clients running Korean banking or government portal access should confirm CrossWeb EX versions and apply the P1 hunts in section 4 now.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.