Threat feed

Lazarus FlashHole

Lazarus Operation FlashHole: CrossWeb EX abuse with mscoree sideload persistence, masqueraded services and GitHub-repo C2 delivering post-quantum-protected payloads

Posted · Updated · Spectrum Delta Research Team

Summary

Kaspersky GReAT (Securelist, Oct 21) documents Operation FlashHole, a Lazarus espionage campaign against at least three South Korean firms with evidence since July 2025: spearphish links to fabricated GitHub Pages sites are the assessed lure, and a suspicious execution chain originated from INISAFE CrossWeb EX (mandatory South Korean financial-security software) — though the exact infection trigger and abuse mechanism could not be determined. The nearly disk-less chain (Securelist) runs TechHub, TouchHub/TouchShift mscoree.dll side-loading, a masqueraded service from a copied system binary, and LPEClient delivering Cubridge in memory with ML-KEM-1024 post-quantum key establishment.

Breakdown

Adversary

Lazarus Group

Procedures (6)

  1. CrossWeb EX service spawns fsquirt.exe with shellcode

    CrossWeb EX spawns fsquirt.exe with injected shellcode

    Logs

    • Sysmon / EDR · EID 1 (fsquirt under CrossWeb EX), EID 7 (mscoree.dll), EID 11, EID 2, EID 8

    Detectors

    No known detector

Click to expand remaining (5) procedures

  1. mscoree.dll side-loading persistence (TouchHub/TouchShift)

    mscoree.dll side-loading (TouchHub/TouchShift persistence)

    Logs

    • Sysmon / EDR · EID 1 (fsquirt under CrossWeb EX), EID 7 (mscoree.dll), EID 11, EID 2, EID 8

    Detectors

    No known detector

  2. Masqueraded service from copied system binary

    • T1543.003Create or Modify System Process: Windows Service

    Logs

    • Windows System/Security event logs · Service installs (7045) for ImeBroker.exe and masqueraded service names
    • Sysmon / EDR · EID 1 (fsquirt under CrossWeb EX), EID 7 (mscoree.dll), EID 11, EID 2, EID 8

    Detectors

    No known detector

  3. TouchHub file-timestamp synchronization

    • T1070.006Indicator Removal: Timestomp

    Logs

    • Sysmon / EDR · EID 1 (fsquirt under CrossWeb EX), EID 7 (mscoree.dll), EID 11, EID 2, EID 8

    Detectors

    No known detector

  4. GitHub private-repository C2 via API with access token

    GitHub private-repository C2 via API

    • T1071.001Application Layer Protocol: Web Protocols

    Logs

    • Network / proxy / firewall · Connections to named C2 domains (DNS/flow; endpoint correlation)
    • Sysmon / EDR · EID 1 (fsquirt under CrossWeb EX), EID 7 (mscoree.dll), EID 11, EID 2, EID 8

    Detectors

    No known detector

  5. LPEClient reflectively loads Cubridge in memory

    LPEClient reflective in-memory payload loading

    • T1620Reflective Code Loading

    Logs

    • Sysmon / EDR · EID 1 (fsquirt under CrossWeb EX), EID 7 (mscoree.dll), EID 11, EID 2, EID 8

    Detectors

    No known detector

Indicators of compromise

Hunt only

7 MD5s (6 TouchShift mscoree.dll samples, 1 ClientHub loader liblzma.dll); drops in System32\RasConv, System32\DrvConh and ProgramData paths; Cubridge/ClientHub C2 on compromised legitimate South Korean sites (cubedesign[.]co[.]kr, fp-news[.]co[.]kr, k-wbc[.]co[.]kr, rcsh[.]co[.]kr, ksog[.]org) plus javadevhouse[.]co[.]kr and pythonapischool[.]com; private GitHub-repo C2 (names unpublished); masqueraded service-name pattern (netsvcs name + two random letters). Single-origin (Kaspersky); full detail in thread; the compromised sites are legitimate businesses — assessed 2026-10-24, hunt-only.

Detailed

Full IOC detail (single-origin, Kaspersky): 7 MD5s — TouchShift mscoree.dll: ec84d6cb2ae7974767aedac246b50a3e, a28cba214058fcae2883d8cffc883abd, c105d6b16f544582772de0159f24c00a, 2f8475a90a25624ed02f1d18d4e6d65d, 676fabe30a28b53925fba98e34b35986, b4a7eff35f048f06fb0a2d7631f23a7d; ClientHub loader liblzma.dll: ff07641dc56914dd90ee0bd7404d7ad7. Paths: C:\Windows\System32\RasConv\ (ImeBroker.exe, mscoree.dll, ActivationStore.dat), C:\Windows\System32\DrvConh\, C:\ProgramData\Dell\, C:\ProgramData\Apple\, C:\ProgramData\ssh\, C:\ProgramData\qorestor\, C:\ProgramData\Package.txt, C:\Program Files\Common Files\System\msadc\msadc.inc, C:\ProgramData\desktops.ini. C2: cubedesign[.]co[.]kr/news and /mobile/fashion, fp-news[.]co[.]kr/shop/cart (Cubridge); k-wbc[.]co[.]kr, rcsh[.]co[.]kr, www[.]ksog[.]org (ClientHub); javadevhouse[.]co[.]kr and pythonapischool[.]com (embedded malicious JavaScript links); private GitHub repositories (names/accounts not published); one Dropbox-API ClientHub variant (account details not published). Service name pattern: netsvcs-derived name plus two random letters, description 'Microsoft Service', command line ImeBroker.exe -TimeBroker. Compromised sites are legitimate businesses — false-positive prone.

Sources

Grades are source reliability (A–F) and information credibility (1–6).

Questions, detections or sightings of Lazarus FlashHole? Bring them to the community.

Discuss in the Tradecraft Slack