How Lazarus Used South Korean Banking Software in Operation FlashHole

Kaspersky researchers report that the Lazarus Group executed a targeted campaign against South Korean organizations, leveraging mandatory financial security software to install malicious code. The group, known for state-sponsored cyber operations, used a sophisticated malware chain that included both legacy and new tools. This activity, dubbed Operation FlashHole, involved the abuse of CrossWeb EX as part of the infection chain.

What is Operation FlashHole?

According to Kaspersky Securelist, Operation FlashHole is a recent attack campaign by the Lazarus Group that targets South Korean entities. The operation began with spear-phishing emails containing links to fabricated websites, such as portfolio or résumé pages tailored to individual victims. This selective targeting marks a shift from broader attacks, focusing on specific individuals within selected organizations.

The campaign represents an evolution from the previous Operation SyncHole. Kaspersky notes that the earliest evidence of this new operation dates back to July 2025, suggesting preparation started shortly after the previous campaign ended. The group employed an updated malware chain, integrating older components with new development to maintain persistence and evade detection.

Which sectors were targeted?

Kaspersky identified a minimum of three organizations impacted by the campaign. These victims operated in the software, construction, and wired communication equipment manufacturing sectors. This selection differs from the sectors affected during Operation SyncHole, indicating that the group has expanded its target scope over time. The shift reflects a change in the types of organizations being pursued by the threat actors.

The targeting method involved sending phishing emails with links to relevant but fake sites. By tailoring the content to the victim’s professional context, the attackers increased the likelihood of engagement. This social engineering component was crucial for initiating the infection chain that ultimately led to the abuse of mandatory security software.

How did the malware execute?

The attackers abused CrossWeb EX, a financial security solution required to access online banking and government websites in South Korea. Kaspersky explains that this software encrypts communications between the user’s browser and web servers using public key infrastructure. The group had previously abused similar software, including Cross EX in Operation SyncHole and CrossWeb EX in earlier campaigns between 2021 and 2023.

In this instance, the infection chain led to the execution of malware in memory. The spawned process ran with a high integrity level, originating from the installation bundle of INISAFE CrossWeb EX V3 version 3.4.1.2. This version was released in 2023 following a public advisory from KrCERT. The exact method of abuse remains unclear, but the result was successful code execution.

What malware was involved?

The campaign utilized a prevalent loader named TouchShift, which was employed across multiple infection chains. Kaspersky disclosed the full malware set used in this operation, highlighting the group’s reliance on both old and new tools. TouchShift was a key component in the infection chain, facilitating the delivery of malicious payloads to compromised systems.

Additionally, the analysis uncovered a suspicious website hosted on GitHub Pages. This site was associated with the GitHub account used as the command-and-control channel for the malware. The presence of this infrastructure links the campaign to specific online resources used by the attackers for coordination.

What comes next for victims?

No patch or fix for this specific abuse vector has been confirmed yet. Kaspersky notes that the exact method by which CrossWeb EX was abused remains unclear, complicating immediate remediation efforts. Organizations in the affected sectors should monitor for signs of compromise, particularly those related to memory-resident processes.

The South Korean government and local security vendors published a joint advisory in July 2026 covering typical Lazarus techniques. While this advisory overlaps with findings from Operation FlashHole, it does not provide specific mitigation steps for the CrossWeb EX abuse detailed by Kaspersky. Users must rely on general security hygiene until vendor-specific guidance emerges.

What analysts watch for

Teams usually examine process trees to identify high-integrity executions spawned from unexpected parent processes. Analysts should check whether mandatory financial security tools are initiating network connections to unfamiliar domains. Investigating memory-resident code is critical, as this malware avoids file system artifacts. Reviewing browser extensions and PKI certificate usage can reveal unauthorized encryption activities. Monitoring for command-and-control traffic linked to known threat actor infrastructure helps detect ongoing compromises.

Background: Browser extension vulnerabilities

Browser extensions operate with elevated permissions that can read your browsing data, modify web pages, and communicate with external servers. A compromised or malicious extension can steal credentials, inject ads, or track your behavior without your direct interaction. Review installed add-ons regularly and remove unused tools to reduce exposure.

Read the full guide: Browser Extension Vulnerabilities Explained: Risks and Safety Habits

What to do and how to stay safe: Lazarus Group

• Monitor system processes for high-integrity executions originating from financial security software.
• Inspect network logs for connections to GitHub Pages or other unexpected command-and-control channels.
• Verify the integrity of installed mandatory security applications against known good versions.
• Review email logs for phishing attempts containing links to fabricated professional profiles.

Step-by-step guide: What Is Cyber Threat Intelligence: Definition and Practical Use

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CrossWeb EX?

CrossWeb EX is a mandatory financial security solution in South Korea that encrypts browser-to-server communications using public key infrastructure.

When did Operation FlashHole start?

The earliest evidence of Operation FlashHole dates back to July 2025, according to Kaspersky researchers.

Which sectors were targeted?

The campaign targeted organizations in the software, construction, and wired communication equipment manufacturing sectors.