HIGH: Lazarus Abuses CrossWeb EX in Post-Quantum FlashHole Campaign

Lazarus has never needed a new playbook. It just keeps finding new pages to staple into the old one. Kaspersky's Global Research and Analysis Team (GReAT) has published details on Operation FlashHole, a North Korean espionage campaign that has been quietly working its way through South Korean companies since at least July 2025. It combines three things defenders enjoy about as much as a 2 a.m. pager alert. There is a trusted, government-adjacent security plugin turned into a launch pad, an in-memory execution chain staged out of GitHub, and command-and-control traffic wrapped in ML-KEM-1024, the NIST-standardized post-quantum key encapsulation mechanism.

Kaspersky presented the research at its Security Analyst Summit in Bali on October 21, and fresh reporting has continued through October 27. The company has confirmed at least three victims spanning construction, software development, and wire-communication equipment manufacturing, and its researchers believe the real count is higher. Attribution to Lazarus is rated at medium to high confidence. Kaspersky frames FlashHole as the latest wave of a broader effort it calls Cascade Hole, picking up where Operation SyncHole left off after that campaign was documented in April 2025.

How the intrusion starts

Like most Lazarus operations, FlashHole begins with a person rather than a packet. Targets received spear-phishing emails pointing to portfolio and résumé sites tailored to each recipient. Kaspersky believes AI helped build those sites, and one lure hosted on GitHub Pages presented a "senior network-appliance developer" complete with a profile photo that was almost certainly generated. The GitHub account behind it was created in September 2025 and doubled as command-and-control infrastructure. If that sounds familiar, it should. Fake recruiters and fake candidates have been the backbone of Operation DreamJob for years, and the only thing that has really changed is that the headshots got cheaper to produce.

The interesting part is what happens after the click. Visiting the malicious page appears to have triggered an infection sequence running through INISAFE CrossWeb EX, Initech's certificate-based authentication and e-signature plugin. For readers outside South Korea, the context matters. For years, online banking and many government portals in the country have required users to install this class of "financial security" software, which means it sits on an enormous number of corporate and personal Windows machines with a local service running and a browser that is expected to talk to it. Kaspersky has not pinned down the exact mechanism. It says a possible vulnerability in CrossWeb EX may have provided the entry point, and Gridinsoft traced the suspicious parent process to INISAFECrossWebEXSvc.exe. No CVE has been assigned for this activity, and none of the reporting so far mentions a fix from Initech.

This is not the first time CrossWeb EX has been on the menu. Lazarus used it to push the Racket downloader during the DeathNote campaign in the third quarter of 2021, and AhnLab documented watering hole attacks in 2022 and 2023 that abused the INISAFECrossWebEXSvc.exe service in vulnerable CrossWeb EX V6 builds to distribute SCSKAppLink.dll. SyncHole leaned on iniLINE's Cross EX along with a one-day flaw in Innorix Agent, and a joint KISA advisory in July 2026 described Lazarus abusing AnySign4PC. The pattern is consistent, and it is a little embarrassing for everyone involved. Software installed specifically to make online transactions safer keeps turning out to be the most reliable way into the network.

The in-memory chain

Once CrossWeb EX is in play, its process launches fsquirt.exe, the legitimate Windows Bluetooth file transfer wizard, which executes shellcode and sideloads a malicious DLL called TechHub. Kaspersky says TechHub evolved from the CLOUDBURST and NickelLoader downloaders, and it profiles the device and its running processes before pulling the next stage from private GitHub repositories. That next stage, TouchHub, uses a second DLL sideload to start TouchShift, a rogue mscoree.dll that establishes persistence by spinning up another TechHub instance in memory. The second TechHub fetches ClientHub, a previously undocumented backdoor with both HTTPS and Dropbox API variants, which in turn loads LPEClient. LPEClient has been in the Lazarus kit since 2019 and serves as the profiling and delivery tool for Cubridge, the modular orchestrator at the end of the chain. Cubridge descends from SIDESHOW, LightlessCan, and CookiePlus and handles file management, command execution, reconnaissance, screenshots, and plugin loading. Browser stealers aimed at Chromium credentials, cookies, and history round out the toolset.

Kaspersky notes that during initial infiltration the execution chain lives only in memory. Persistence leaves a few artifacts on disk, but anyone hoping to find a nice fat executable sitting in a temp folder is going to be disappointed. The updated LPEClient also tries to blind endpoint tooling by changing memory protections and disabling a security monitoring hook, and it catalogs installed security products before reporting home.

Why the post-quantum part matters, and why it mostly does not

The headline grabber here is ML-KEM-1024. According to Kaspersky's analysis, LPEClient receives a byte array from its C2 server containing four 1,568-byte ML-KEM-1024 public keys. It generates four shared secrets and ciphertexts, encrypts the ciphertexts with GOST, and ships them back through ClientHub. The shared secrets feed Threefish, which decrypts the server's response containing configuration parameters and the executable payload that is then reflectively loaded into memory. Sojun Ryu, senior security researcher at Kaspersky GReAT, said "What deserves closer attention is Lazarus's adoption of cryptography designed to withstand future quantum threats," and noted that the group's use of this cryptography traces back to at least September 2024.

Let's be honest about what that buys the attacker. Nobody is breaking classical key exchange on live malware traffic today, so the post-quantum layer is not defeating some quantum-equipped SOC that showed up early. What it does do is make retrospective analysis of captured traffic harder, and it signals that the operators treat payload confidentiality as a long-term investment. For defenders, the practical effect is the same as with any well-built encrypted channel. You are not going to decrypt your way to a detection on the wire. You will catch this at the endpoint, in process lineage, or in cloud service logs, or you will not catch it at all.

Who should worry

The direct targets are South Korean organizations, but any company with Korean operations, Korean subsidiaries, or employees who use Korean banking and government services from work machines should treat this as relevant. That covers more Western firms than you might expect, particularly in manufacturing, telecom equipment, and software supply chains. The broader lesson travels further still. Lazarus is going after companies that build things other companies trust, network appliance developers and communications hardware makers among them, and that is exactly where an espionage foothold turns into somebody else's supply chain problem later. Kaspersky also flagged a parallel wave using the COPPERHEDGE backdoor in which data stolen from at least one victim surfaced on a dark web leak site named ULOSE. That blurs the line between espionage and extortion in a way that should make everybody uncomfortable.

What to do about it

Start with inventory. Find every endpoint running INISAFE CrossWeb EX, Cross EX, AnySign4PC, Innorix, and the rest of the Korean security plugin family, and ask whether each one actually needs it. On machines that do, keep the software on the latest vendor build and get rid of legacy V6 installations, which have a documented history of abuse. If a workstation never needs to log into Korean banking or government portals, uninstall the plugin outright. The safest local service is the one that is not running.

For detection, process lineage is your friend. INISAFECrossWebEXSvc.exe or the CrossWeb EX process spawning fsquirt.exe is a strong signal on its own, because there is no good reason for an authentication plugin to launch the Bluetooth file transfer wizard. Hunt for fsquirt.exe running from unusual paths or loading unexpected DLLs, and for mscoree.dll loaded from anywhere other than the system directory. Watch for workstations making calls to private GitHub repositories, raw.githubusercontent.com, or the Dropbox API when nobody on that machine is a developer or a Dropbox user. Memory scanning and EDR telemetry around reflective loading and memory protection changes will matter far more than file hashes here. Pull the indicators from Kaspersky's Securelist report into your SIEM and EDR block lists while you are at it.

On the human side, the lure is a job application or a portfolio, so HR, recruiting, and engineering managers are the front door. Tell them that a polished résumé site on GitHub Pages is not proof of a real candidate, and that a security plugin prompt appearing after visiting someone's portfolio is a reason to call the security team, not a reason to click "Allow." Limit local administrator rights, restrict which cloud storage and code hosting services endpoints can reach, and make sure your email security inspects links in messages that look like recruiting correspondence.

The MSP angle

Clients with Korean operations or supply chain ties are a natural audience for a third-party software audit that inventories and strips out unnecessary browser security plugins, paired with managed EDR and threat hunting that watches process lineage instead of file hashes. FlashHole also makes a clean story for recruiting-themed phishing simulations, because "fake candidate with an AI headshot" lands with HR leaders far better than yet another generic invoice lure.