Lazarus Group Targets South Korean Firms in Operation FlashHole Campaign
Kaspersky researchers detail how the Lazarus Group abused mandatory financial security software to compromise organizations in South Korea through a new watering-hole attack.
Key points
- Kaspersky Securelist identified Operation FlashHole, a campaign by the Lazarus Group targeting South Korean firms using CrossWeb EX software.
- The attack chain involved spear-phishing emails with tailored links, leading to malware execution via the mandatory financial security tool.
- At least three organizations in software, construction, and communication sectors were impacted, marking an expansion from previous targets.
Kaspersky Securelist researchers have disclosed details of Operation FlashHole, a sophisticated cyberattack campaign conducted by the Lazarus Group against organizations in South Korea. The analysis reveals that the threat actors employed a watering-hole technique combined with the abuse of mandatory financial security software to compromise victims. This operation follows the group’s previous campaign, Operation SyncHole, and indicates a continued focus on exploiting local infrastructure requirements.
The earliest evidence of Operation FlashHole dates back to July 2025, suggesting the group began preparations shortly after concluding its earlier efforts. Kaspersky identified at least three impacted organizations operating within South Korea’s software, construction, and wired communication equipment manufacturing sectors. These industries differ from those targeted in Operation SyncHole, indicating that the Lazarus Group has broadened its scope of interest over time. The attackers used spear-phishing emails containing links to fabricated portfolio and résumé pages tailored specifically to each target.
Technical Execution and Software Abuse
The attack chain relied heavily on the abuse of CrossWeb EX, a financial security solution required for accessing online banking and government websites in South Korea. This software encrypts communications between browsers and servers using public key infrastructure. In previous operations, Lazarus abused Cross EX; however, Operation FlashHole utilized CrossWeb EX instead. Both applications are maintained by the same developer and are integral to the country’s digital security landscape.
The spawned malware process ran with a high integrity level. The parent process, INISAFECrossWebEXSvc.exe, originated from the installation bundle of INISAFE CrossWeb EX V3 version 3.4.1.2. This version was released in 2023 following a public advisory from KrCERT. Although the exact method of abuse remains unclear, the attack chain ultimately led to the execution of malware in memory. This mirrors the group’s long-standing strategy of leveraging mandatory background software as a critical attack vector.
Broader Context and Attribution
Lazarus has previously abused CrossWeb EX in 2021 to deploy the Racket downloader, and again in 2022 and 2023. A paper presented at the USENIX Security Symposium in 2025 investigated vulnerabilities in such mandatory security software, demonstrating how it can unintentionally create a massive attack surface. In July 2026, the South Korean government and local security vendors published a joint advisory covering typical Lazarus techniques, including the exploitation of financial security software.
While this government advisory overlaps with Kaspersky’s findings, the researchers conducted a more granular classification based on tactics, techniques, and procedures. AhnLab’s detailed analysis report, Operation Double Barrel, also covers recent Lazarus activities. Kaspersky noted a suspicious website hosted on GitHub Pages associated with the GitHub account used as the command and control channel for the campaign.
What should you do?
Security teams should monitor for unusual execution chains originating from legitimate local security software, particularly those running with high integrity levels. Organizations should review network traffic for connections to unexpected GitHub Pages domains or other unverified hosting services. Administrators should ensure that mandatory financial security applications are updated to the latest versions provided by their vendors.
What to do and how to stay safe: Lazarus Group
- Monitor endpoint logs for high-integrity processes spawned by financial security software that deviate from standard behavior.
- Inspect inbound email traffic for spear-phishing attempts containing links to fabricated professional profiles or résumé pages.
- Verify that all mandatory local security applications are updated to the latest vendor-released versions to mitigate known abuse vectors.
- Review network connections for communication with GitHub Pages domains, which may be used as command and control infrastructure.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is Operation FlashHole?
Operation FlashHole is a cyberattack campaign by the Lazarus Group that uses watering-hole techniques and abuses CrossWeb EX financial security software to compromise South Korean organizations.
Which sectors were targeted in this campaign?
The campaign targeted organizations in South Korea’s software, construction, and wired communication equipment manufacturing sectors.
Is there a patch for the CrossWeb EX abuse?
The source material does not confirm a specific patch for the abuse method used in Operation FlashHole, though the software version involved was released in 2023.
