Lazarus used software installed to protect South Korean banking sessions as part of a targeted espionage chain. In its October 21 investigation of Operation FlashHole, Kaspersky describes tailored résumé and portfolio websites, suspicious execution beneath CrossWeb EX, and malware that initially operated in memory. At least three organizations in software, construction and wired communications equipment manufacturing were affected.
The disclosure is new; the operation is older. Researchers place its earliest evidence in July 2025 and say they responded in January. They associate FlashHole with Lazarus with medium-to-high confidence. Crucially, they could not establish the exact way CrossWeb EX was abused. The report does not prove that every installation is compromised or that any GitHub Pages visit can infect a computer.[1]
One site became two different professional introductions
The researchers found a GitHub Pages site linked to an account also used for command and control. Its earlier version presented the résumé of a senior network-appliance developer. In January, it changed into an interior-design portfolio. Kaspersky links the two presentations to likely targets in communications equipment and construction: the page was made relevant to the person expected to open it.
The published images show the contrast: a technical candidate on one side, a room-design showcase on the other. These are different professional reasons to follow a link. Kaspersky assesses with medium-to-high confidence that targeted emails brought recipients to the site; the complete original email text is not published.
A constructed recognition example, not a recovered FlashHole message, might read: sender Candidate <portfolio [at] example [dot] invalid>; subject Network engineer portfolio; body: “Hello, Please review my portfolio for the role. View portfolio. Thank you.” No password request, attachment or deadline is needed for that example: the requested action is simply opening the portfolio. The actual wording used in the campaign remains unknown.
The résumé photograph and implausible portfolio details led researchers to suspect AI assistance. That is an assessment about how the lure was made, not evidence that an autonomous AI conducted the entire intrusion. Lazarus has previously used job-related approaches against security specialists; this case adds a different software-execution chain.
The revealing clue was a Windows process under a banking-security service
CrossWeb EX encrypts browser-to-server communications and is required by widely used South Korean banking and government sites. Kaspersky traced the suspicious parent process to INISAFECrossWebEXSvc.exe from the CrossWeb EX V3 3.4.1.2 installation bundle. It is different software from Cross EX, which featured in the earlier SyncHole campaign.
After the initial compromise, the legitimate Windows Bluetooth file-transfer program fsquirt.exe ran beneath that security-software process and received injected shellcode containing TechHub. The useful signal is the relationship and injected code—not the filename alone. Deleting the genuine Windows executable would neither explain nor resolve the intrusion.
The fabricated sites loaded external JavaScript. The investigators consider a site visit a likely start to the chain involving CrossWeb EX, while explicitly leaving the initial abuse mechanism unresolved. There is therefore no verified universal “install this version and the case is closed” instruction in this account.
GitHub delivered stages; a service provided a way back
TechHub used a GitHub personal access token to communicate with private repositories and retrieve further material. GitHub supplied a legitimate hosting and API channel; that does not mean the platform’s ordinary repositories or users were compromised. The relevant question for defenders is which process contacted which repository, when, and in connection with what execution.
TechHub led to Cubridge, the orchestrator that can retrieve plugins and tools. The initial execution chain existed in memory, limiting the files an investigator might find on disk. Later, TouchHub and TouchShift established service-backed execution using DLL side-loading: a legitimate program loads an attacker-controlled library. A second TechHub instance then brought in ClientHub and LPEClient, extending the chain beyond the first in-memory foothold.
Those stages matter more than a list of malware names. A reboot can remove a transient memory instance without removing the service or loader that starts another one. Equally, one quarantined payload does not establish that every component, credential or collected file has been accounted for. The report describes espionage capabilities and affected organizations, not a quantified public total of stolen data.
Investigate the sequence, not a familiar filename
For an organization using CrossWeb EX, the concrete response is to preserve and correlate the suspicious service’s child processes, injected modules, newly installed services and outbound repository activity. A GitHub connection by itself is weak evidence; the security-service-to-fsquirt.exe execution relationship is a much more specific lead from this investigation. Responders should preserve available memory and endpoint records before destroying the traces they need to reconstruct.
The scope stays targeted: this report does not establish a mass infection of all South Korean banking users, a new flaw in Windows Bluetooth transfer, or a ransomware outcome for FlashHole. Its lesson is narrower and useful: software installed for trust still needs its behavior examined, especially when a plausible professional introduction is followed by an implausible process chain.
References
- Sojun Ryu. “Operation FlashHole: Lazarus breaks security, defies control.” Kaspersky Securelist, October 21, 2026; accessed October 22, 2026. Technical investigation, figures and indicators.
