Threat intel

On October 21, Kaspersky's Global Research and Analysis Team (GReAT) presented Operation FlashHole at its Security Analyst Summit in Bali. It is an espionage campaign that Kaspersky attributes to Lazarus, the North Korean state-backed group, with medium-to-high confidence. It has run since at least July 2025 and has hit at least three South Korean organizations in construction, software and wired communication equipment manufacturing. Kaspersky expects the real number to be higher.

The way in was a job application. Targets received spear-phishing emails pointing to a resume or portfolio site, and the infection then ran through CrossWeb EX, a security plug-in that South Korean banking and government sites require people to install. Most of the chain ran only in memory. Any organization that runs mandatory browser helper software, in Korea or elsewhere, should read this as a warning about that whole category of tool.

How it works

The lure sites were hosted on GitHub Pages. One started as the resume of a "senior network appliance developer" and was later swapped for an interior design portfolio, each matched to the sector of the intended victim. Kaspersky judged the resume photo to be AI-generated and believes AI helped build the sites. The pages loaded JavaScript from outside domains, which Kaspersky lists among its indicators.

CrossWeb EX is a plug-in and web authentication tool that runs a local service so websites can talk to it from the browser. On victim machines, Kaspersky found that service process, INISAFECrossWebEXSvc.exe from the INISAFE CrossWeb EX V3 3.4.1.2 bundle, launching fsquirt.exe, the legitimate Windows Bluetooth file transfer wizard. That fsquirt.exe was injected with shellcode carrying the first malware stage. Researchers rate it highly likely that visiting the lure site triggered this and suspect a vulnerability in CrossWeb EX, but they could not establish the exact method. Treat the root cause as unknown.

This is the second time in two years. In April 2025, Kaspersky described Operation SyncHole, in which Lazarus abused Cross EX, a different Korean security product, to compromise at least six South Korean organizations. Kaspersky links the two campaigns with medium-to-high confidence. Separately, a USENIX Security 2025 study of Korea's mandatory financial security software found 19 vulnerabilities across these programs. They are attractive targets because they run on most PCs in the country and talk to any website that calls them.

The malware chain

Kaspersky names six components. Most of them run only in memory:

• TechHub, the first downloader, injected into fsquirt.exe. It talks to a private GitHub repository through the GitHub API with a personal access token, so its command traffic looks like ordinary GitHub use.
• Cubridge, a modular backdoor that pulls in plugins and tools and handles files, commands, reconnaissance and screenshots.
• TouchHub and TouchShift, which make it persistent: a copied legitimate Windows binary is registered as a service and side-loads a malicious DLL (a planted library the trusted program loads by name).
• ClientHub, a backdoor not seen before, with one variant using Dropbox for command and control.
• LPEClient, a long-running Lazarus tool that also appeared in SyncHole. It profiles the machine, including which security software is installed, and changes memory protections to disable a user-mode monitoring hook that security tools rely on.

The updated LPEClient gets four ML-KEM-1024 public keys from its server, derives shared keys from them, and uses those to decrypt the next payload, which it runs straight from memory. ML-KEM is the post-quantum key exchange standard NIST published in 2024. Kaspersky's technical write-up describes this step, and its reading is that the group wants to hide later payloads from anyone capturing the traffic. In practice, network inspection will not reveal the payload, so detection has to happen on the endpoint.

What to do

Find and update the plug-ins. List every machine with CrossWeb EX, Cross EX, Innorix Agent or similar Korean banking and government helpers installed (look for INISAFE* services and processes). Update them from the vendor or the site that requires them. Kaspersky has not named a fixed CrossWeb EX version, so updating lowers the risk but does not close this specific gap.

Shrink where they run. Remove these plug-ins from servers, developer workstations and admin machines. Staff who need banking or government portals can use a dedicated machine or a virtual desktop that holds no source code or admin credentials. A plug-in that any website can talk to should not sit on a machine that can reach your build systems.

Hunt for the process tree. In your EDR or Sysmon data, search process creation events (Sysmon Event ID 1) for any child of INISAFECrossWebEXSvc.exe, and for fsquirt.exe with any parent other than a user's Explorer session. A plug-in service has no reason to start the Bluetooth wizard. Also look for remote thread creation into fsquirt.exe (Sysmon Event ID 8).

Hunt for the persistence. Kaspersky's indicators include mscoree.dll in folders where it does not belong, such as C:\Windows\System32\RasConv\ or C:\Windows\System32\DrvConh\ next to an ActivationStore.dat file, and a service whose binary is C:\Windows\System32\RasConv\ImeBroker.exe with the argument -TimeBroker. Check new service installs (System log Event ID 7045, Security log Event ID 4697) for system binaries copied to odd folders.

Watch cloud APIs used for command and control. Alert on connections to api.github.com or the Dropbox API from processes that are not browsers, Git clients or approved sync tools. On machines with no developers, any such traffic deserves a look.

Scan memory, not only files. Run memory scans that flag executable regions with no file behind them, and confirm your EDR's user-mode hooks are still in place on hosts that run these plug-ins. If you find a hit, isolate the host, collect a memory image before rebooting, and rotate any GitHub, cloud or VPN credentials used on it.

Resume lures and HR

Recruiters open unknown links from strangers as part of the job, which makes them a reliable entry point. Ask candidates to apply through your applicant tracking system or as attachments that pass through mail scanning, instead of following links to personal sites. When a link has to be opened, open it in an isolated browser or a non-domain device that has no banking plug-ins installed. Forward unsolicited applications with a personal-site link to security when the role is technical or the sender is unknown. An AI-generated photo or a generic name on a polished site is a weak signal on its own; mention it in the report anyway.

The wider lesson

Mandatory security software runs with high privilege, listens for websites, and is rarely on the patch list because nobody in IT chose it. Put it in your asset inventory, give it an owner, and treat it like any other internet-facing service.

Our security operations team hunts for in-memory loaders and odd process trees like this one, and safeguarding and hardening work covers removing or isolating third-party plug-ins. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.

---

Sources: Kaspersky Securelist, Kaspersky press release on FlashHole, Kaspersky press release on SyncHole, Techzine, GridinSoft, SecurityOnline, SecurityWeek on SyncHole, USENIX Security 2025 paper.