Dissecting Operation FlashHole A Complex Attack by Lazarus
Dissecting Operation FlashHole: A Complex Attack by Lazarus
In January, we responded to the Lazarus Group’s novel attack campaign against South Korea, which followed last year’s Operation SyncHole. In this new operation, the group employed an updated malware chain that included both their old and new malware, using a mandatory South Korean security software program as part of the infection chain through a watering-hole strategy.
Notably, the group targeted victims more selectively, sending spear-phishing emails with links to fabricated but relevant sites, such as portfolio and résumé pages tailored to each target. We dubbed this activity Operation FlashHole. Our examination reveals that the earliest evidence of this new operation dates back to July 2025. We identified a minimum of three organizations impacted by the campaign in South Korea’s software, construction, and wired communication equipment manufacturing sectors.
We detected a suspicious execution chain originating from legitimate South Korean software. This chain mirrors the one from the previous operation; however, this time, the attacker abused CrossWeb EX instead of Cross EX. CrossWeb EX is a financial security solution required to access widely used online banking and government websites. This is not the first time Lazarus has abused this software. The attack chain ultimately leads to the execution of the malware in memory.
Although we could not precisely determine what triggered the infection chain, our analysis uncovered a suspicious website hosted on GitHub Pages associated with the GitHub account used as the C2 channel. The first site with the résumé had a photograph supposedly of a job seeker, but the lack of EXIF metadata and the unnatural texture of the image indicate that it was generated by AI. The group most likely also used AI to create the lure site. We assess with medium-to-high confidence that the targets received phishing emails containing links to the malicious site hosted on GitHub Pages. The research results showed a high possibility that visiting the malicious site initiated an infection process involving CrossWeb EX software.
Following the initial compromise, the legitimate Windows binary fsquirt.exe was executed under the CrossWeb EX process and injected with shellcode containing a malicious DLL - TechHub malware. The infection chain is rather complex and reveals the Lazarus Group’s advanced operational techniques on targeted hosts. Significantly, the execution chain exists only in memory during the initial infiltration, highlighting the attackers’ considerable efforts to hide the initial compromise.
The group sought to maintain persistence on the network by installing a pair of malware strains - TouchHub and TouchShift - leveraging DLL side-loading under the name mscoree.dll. The full chain comprises advanced variants of the known Lazarus malware strains, including TechHub, Cubridge, TouchShift, LPEClient, and the newly identified TouchHub and ClientHub. TechHub, a downloader that plays a central role in this attack, communicates with GitHub using a Personal Access Token (PAT). This variant is a more advanced version of the malware named CLOUDBURST by Mandiant and NickelLoader by ESET. The latest iteration we found, however, communicates with GitHub instead and has updated command strings.
Depending on which stage loads the malware, it contacts a private GitHub repository via the GitHub API using either hard-coded credentials or credentials retrieved from its configuration file. When TechHub loads, it creates a 4-byte hexadecimal identifier (ID) or reads one from the configuration file, enabling the attackers to distinguish between compromised hosts.
For more details, check out the full article: Read full article
🚀 Stay informed and vigilant!