- Kaspersky reports that Lazarus abused CrossWeb EX, financial security software required in South Korea, to compromise at least three organizations in Operation FlashHole.
- The attackers used GitHub as a hidden command channel and ran much of the chain in memory, which makes it harder to spot.
- Leaders should inventory required third-party software, watch for odd child processes, and review GitHub traffic from non-developer machines.
When the required tool becomes the way in
Some software sits on a computer because nobody chose it. In South Korea, people need financial security software to reach popular banking and government websites. Kaspersky's researchers report that the Lazarus Group has used this fact against victims once more.
The lesson here is simple. A mandatory control is also a predictable target. Attackers know it is installed and trusted. They know it runs quietly in the background. Few teams count it as part of their attack surface.
What Kaspersky found
Kaspersky calls the campaign Operation FlashHole. The first signs date to July 2025. That suggests the group began preparing soon after it finished an earlier campaign, Operation SyncHole, which ran for at least four months.
Kaspersky counted at least three victims in South Korea. They work in software, construction and the making of wired communication equipment. These sectors differ from the SyncHole victims. Kaspersky says this points to a wider set of targets.
This time the attackers misused CrossWeb EX. In SyncHole, the tool was a sibling program called Cross EX. Both appear to come from the same developer, and both deal with financial security.
CrossWeb EX scrambles traffic between a browser and a web server. Kaspersky says Lazarus had misused it before, in 2021, 2022 and 2023.
In July 2026, South Korea's government and several local security vendors published a joint advisory. It covers typical Lazarus methods, including attacks on financial security software.
There are limits. Kaspersky could not tell exactly how CrossWeb EX was abused. It also could not tell what set off the infection.
One detail stands out. The suspicious process was launched by INISAFECrossWebEXSvc.exe. That file comes from an installer bundle for CrossWeb EX V3, version 3.4.1.2. The bundle dates from 2023, after a public KrCERT advisory. The report does not say that version had an unpatched flaw.
A lure built for each target
The group was more selective this time. Kaspersky assesses with medium-to-high confidence that targets got phishing emails. The emails linked to a page hosted on GitHub Pages.
The first page was an online CV for a made-up engineer who built network appliances. In January, the group swapped it for an interior design portfolio. Kaspersky believes the first page likely reached an employee at a wired communication maker. The second likely reached a target in construction.
The CV photo had no EXIF metadata, and its texture looked unnatural. Kaspersky concludes that AI made the image. It also thinks AI likely helped build the site, with hand edits for each target.
That is Kaspersky's inference, not a confirmed fact. It still shows how little effort a believable, targeted lure may now take.
How the attack stays hidden
The first-stage tool is called TechHub. It talks to a private GitHub repository using a Personal Access Token. That is a password-like key for GitHub's programming interface.
TechHub uses GitHub issues like a mailbox. It gives each infected machine an ID. It then swaps encrypted files with the attackers. The handshake ends when an issue's text changes from "hel" to "hey". Only then does the malware take orders.
The next stage is Cubridge. Kaspersky calls it the central orchestrator of the toolkit. It builds a fresh web address for every request from word lists plus a random eight-digit number. Kaspersky's example looks like a news article link. The requests also copy browser headers.
Much of the early chain lives only in memory. Kaspersky found just minimal traces on disk.
To stay on the machine, the attackers used DLL side-loading, with the filename mscoree.dll. In plain terms, a trusted program is tricked into loading a harmful file because it carries the expected name.
This is the defender's problem. Traffic to GitHub looks like normal business. A security-software process is expected to run. Each piece looks ordinary on its own.
Questions for your team
Ask who owns the third-party software your staff or regulators require. Which versions are installed, and who patches them?
Ask whether your tools flag a normal Windows program, such as fsquirt.exe, starting under a security-software process. Kaspersky saw exactly that.
Ask whether you can see GitHub API traffic from machines that are not developer workstations. Ask whether your endpoint tools inspect memory, not just files.
Finally, think about who opens CV and portfolio links, such as recruiters and hiring managers. Kaspersky's findings cover South Korea. Elsewhere, treat them as a lesson in method, not proof of targeting.
A control you are forced to install is still software someone has to watch.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Kaspersky.
