Kaspersky GReAT has attributed a cyber-espionage campaign dubbed Operation FlashHole to North Korea's Lazarus Group, identifying at least three affected South Korean organisations across construction, software and wire-communication equipment manufacturing, with the earliest evidence dating to July 2025. Victims were sent spear-phishing emails linking to fabricated, individually tailored résumé and portfolio sites — hosted on GitHub Pages and featuring AI-generated profile photos. Visiting the site triggered an infection chain abusing INISAFE CrossWeb EX, the mandatory financial-security plug-in required for South Korean online banking and government portals, which launched the legitimate Windows binary fsquirt.exe with injected shellcode. In-memory components TechHub, TouchHub and TouchShift establish persistence via DLL sideloading before ClientHub (with HTTP or Dropbox C2) delivers the LPEClient profiling agent, which now conducts an ML-KEM-1024 post-quantum key exchange — new for the group, traced back to September 2024 — prior to loading the Cubridge framework that steals Chromium credentials and queries Active Directory. No CVE has been published and the exact abuse method remains under analysis; the campaign follows Operation SyncHole, disclosed in April 2025.

• Source article