Lazarus Group Targets South Korean Firms in Operation FlashHole
The Lazarus Group, associated with North Korea, has been linked to a cyber espionage campaign known as Operation FlashHole. This operation has targeted at least three organizations in South Korea, including those in the construction, software, and wire-communication equipment sectors. According to Kaspersky, a Russian cybersecurity firm, the campaign has been active since at least July 2025 and is seen as a continuation of previous efforts, particularly following Operation SyncHole.
Kaspersky's analysis indicates that the Lazarus Group has adopted a more selective approach in its targeting, utilizing spear-phishing emails that contain links to fabricated websites relevant to the victims, such as portfolio and résumé pages. This tactic reflects a shift from earlier campaigns documented by Kaspersky, which began in November 2024 and targeted various sectors including software, IT, and telecommunications.
The attacks leverage a security flaw in iniLINE Cross EX, a mandatory financial security software used by South Korean internet users for online banking and government services. The exploit allows the attackers to launch the legitimate SyncHost.exe process and inject malicious code to install the ThreatNeedle backdoor. Additionally, the campaign has utilized a vulnerability in the Innorix Agent file transfer solution for lateral movement within networks.
Operation FlashHole continues the trend of targeting South Korean software to breach security measures. While SyncHole exploited Cross EX, FlashHole has been found to abuse Initech's INISAFE CrossWeb EX, another essential financial security solution. iniLINE and Initech have collaborated since 2010 to develop CrossWeb, which is marketed as a certificate-based authentication and electronic-signature solution.
The Lazarus Group has a history of exploiting vulnerabilities in financial security software. In 2021, it used similar software to deploy a downloader named Racket as part of a campaign called DeathNote. Between 2022 and 2023, AhnLab reported attacks where the group exploited a flaw in the software to distribute DLL malware through watering hole attacks.
Ongoing Exploitation of Security Vulnerabilities
The recent findings coincide with a joint advisory from the Korea Internet and Security Agency (KISA) and local cybersecurity vendors, which highlighted the group's ongoing exploitation of vulnerabilities in financial security programs to distribute backdoors like Struggle and Brandoor. The attackers have employed various methods, including spear-phishing and watering hole techniques, to induce targets to access malicious URLs.
The precise initial access vector for FlashHole remains unclear, but it is suspected that malicious websites hosted on GitHub pages are involved. One such site reportedly contained a résumé of a senior network appliance developer, potentially generated using AI. Targets are believed to receive spear-phishing emails with links to these sites, triggering an infection sequence involving CrossWeb EX.
The infection chain is complex, showcasing the Lazarus Group's advanced operational techniques. The group employs sophisticated methods to conceal their malicious payloads and intentions. The malware used in this operation, including TechHub, downloads additional malware from GitHub, establishing encrypted connections using a post-quantum cryptographic algorithm.
Intelligence Reviewed
Operation FlashHole is part of a broader campaign, Cascade Hole, which utilizes South Korean software as an entry point for malware targeting the country. Kaspersky noted that this latest wave of attacks coincided with a resurgence of the COPPERHEDGE backdoor, which has led to data exfiltration incidents similar to those seen in Gunra ransomware attacks.
The Lazarus Group continues to evolve its tactics, launching new campaigns and refining its tools to achieve its objectives. The group's adoption of advanced cryptographic techniques to secure its communications indicates a significant shift in its operational capabilities, with implications for future cybersecurity efforts.
