KASPERSKY says it uncovered Operation FlashHole, a cyber-espionage campaign targeting South Korean companies in the software, construction and wired communications equipment sectors. It confirmed at least three victims, but believes the number affected is considerably higher. Kaspersky responded to the activity in January 2026 and found traces dating back to July 2025. The firm attributes the operation to the Lazarus Group with medium-to-high confidence, citing shared tools including LPEClient.
The attackers reportedly used tailored phishing links to fake CV and portfolio websites hosted on GitHub Pages. They then abused CrossWeb EX, a security programme required for access to many South Korean banking and government services. Kaspersky could not determine exactly how the software was exploited, but says the infection chain led to malware running in memory.
Its tools included TechHub, which used a private GitHub repository for command-and-control traffic, and loaders that installed further components, culminating in the Cubridge framework. Kaspersky also reported updated encryption, including ML-KEM-1024, GOST and Threefish in LPEClient, and the SNOW stream cipher in ClientHub.
The toolkit included tools to collect files and browser credentials and query Active Directory, supporting the assessment that the campaign was focused on espionage. Kaspersky says South Korea plans to phase out mandatory security software from 2026, but expects abuse of such programmes to continue while they remain in use. It recommends reviewing whether CrossWeb EX and similar plug-ins are still required, and monitoring for unusual GitHub API activity and DLL side-loading.