(securelist.com) Operation FlashHole: Lazarus Group's Evolved Malware Arsenal Targets South Korean Sectors In brief - This article details 'Operation FlashHole,' a targeted cyber espionage campaign by the Lazarus Group against South Korean organizations in the software, construction, and communications sectors. The operation leverages a sophisticated, multi-stage malware chain and abuses mandatory South Korean security software to gain initial access. Technically - This article describes a complex infection chain starting with AI-generated lure sites on GitHub Pages that exploit CrossWeb EX security software to execute shellcode in memory via fsquirt.exe. The malware framework consists of several modular components: TechHub (a downloader using GitHub API for C2), Cubridge (a central orchestrator with extensive plugin/module support), and ClientHub (which utilizes the SNOW 1.0 stream cipher and mimics Chromium browser headers). A notable technical highlight is the use of LPEClient, which employs post-quantum cryptography (ML-KEM-1024), the GOST encryption algorithm, and the Threefish block cipher to protect payloads. The group also utilizes DLL side-loading (mscoree.dll), PPID spoofing, and custom syscall stubs to bypass user-mode instrumentation hooks and security products. Source: https://securelist.com/lazarus-operation-flashhole/121541/ #Cybersecurity