KASPERSKY says Lazarus used a new campaign, dubbed Operation FlashHole, to target South Korean organisations from at least July 2025. Researchers identified at least three affected firms in the software, construction and wired communication equipment sectors, while warning that the true number may be higher. They assess with medium-to-high confidence that the campaign was carried out by the same actor behind Operation SyncHole. FlashHole is part of the wider Cascade Hole activity, which uses South Korean software as a possible route into organisations.
The attackers appear to have sent tailored spear-phishing emails linking to fabricated portfolio, résumé or interior-design websites hosted on GitHub Pages. Kaspersky assesses with medium-to-high confidence that visiting a site could start an infection through CrossWeb EX, a financial security application required for access to many South Korean banking and government websites. The precise abuse method remains unclear.
The attack then ran malware in memory, using an elaborate chain that included TechHub, TouchHub, TouchShift, ClientHub, LPEClient and Cubridge. The tools could profile infected computers, steal browser data and collect files; Kaspersky also found communication through GitHub repositories, compromised websites and, in one sample, Dropbox.
Kaspersky says the chain was substantially updated from the previous operation and designed to conceal activity, with little malware left on disk. It identified CrossWeb EX V3 version 3.4.1.2 in the observed process chain, but the report does not specify a general remediation procedure.
The South Korean government’s October 2025 plan to phase out mandatory security software installations from 2026 may eventually reduce this attack surface, although Kaspersky expects operations exploiting the software to remain active while it is still in use.