Lazarus-linked Operation FlashHole targets South Korean organizations

Kaspersky’s Global Research and Analysis Team presented its Operation FlashHole findings at the Security Analyst Summit in Bali, Indonesia.[1] Kaspersky attributes the campaign to the Lazarus APT group and says it has been active since at least July 2025.[1] The campaign has affected at least three organizations in South Korea.[1] Those organizations span construction, software and wire-communication equipment manufacturing.[1] Kaspersky says the attackers deployed updated malware, including tools that had not previously been documented.[1] The supplied findings do not specify how many organizations were affected in each sector.[1]

Kaspersky says the campaign used spear-phishing and abused legitimate CrossWeb EX software.[1] The Hacker News reports that spear-phishing emails linked to fabricated portfolio and résumé pages tailored to each target.[3] Mezha.net reported that the phishing sites were suspected to be AI-made, which is a suspicion rather than a confirmed account of how they were produced.[2] Mezha also reported that the malware uses post-quantum cryptography to protect its communications.[2] The available facts identify that protection method but do not specify an algorithm or describe how it affects defenders’ ability to inspect traffic.[2]

The Hacker News identifies the abused software as Initech’s INISAFE CrossWeb EX, a financial-security solution needed to access online banking and government portals in South Korea.[3] Initech markets CrossWeb as a certificate-based authentication and electronic-signature solution.[3] The Hacker News says a company entered a strategic alliance with Initech in 2010 to develop CrossWeb.[3] This is not the same product name as the iniLINE Cross EX software discussed in reporting on Operation SyncHole.[3] That earlier campaign exploited a security flaw in iniLINE Cross EX to deliver malware.[3]

The Hacker News assesses Operation FlashHole as picking up where Operation SyncHole left off.[3] Kaspersky first documented SyncHole in April 2025, and reporting says it had targeted South Korean industries since November 2024.[3] The earlier attack chain could install Lazarus malware when a browser visited a site using a vulnerable version of INISAFE CrossWeb EX V6.[3] The Hacker News also reports that the group first hacks Korean websites and modifies content provided from them.[3] Separately, it reports that the software was used in Q3 2021 to deploy Racket in connection with DeathNote, and that AhnLab disclosed attacks between 2022 and 2023 exploiting a software flaw to distribute DLL malware.[3]