Kaspersky describes Operation FlashHole, a Lazarus espionage campaign against South Korean orgs (software, construction, wired-comms manufacturing) with earliest evidence from July 2025. Initial access abuses mandatory financial-security software INISAFE CrossWeb EX (parent INISAFECrossWebEXSvc.exe) to run malware in memory at high integrity, plus spear-phish to AI-tailored GitHub Pages résumé/portfolio lures.

1. Process: unusual child processes / reflective loads from CrossWeb EX / INISAFE services.
2. Files: mscoree.dll sideloads under C:\ProgramData\ paths (Dell, Apple, ssh, RasConv, qorestor) and C:\Windows\System32\RasConv|DrvConh\; temps like Dell1.tmp/Dell3.tmp, Package.txt, ActivationStore.dat.
3. C2 hosts (defang): javadevhouse[.]co[.]kr, pythonapischool[.]com, cubedesign[.]co[.]kr, fp-news[.]co[.]kr, k-wbc[.]co[.]kr, rcsh[.]co[.]kr, www[.]ksog[.]org.
4. Crypto: LPEClient obtains four ML-KEM-1024 public keys from C2 for post-quantum key exchange (Kaspersky notes faster PQ adoption than many defenders).
5. Detections (Kaspersky): MEM:Trojan.Win64.Shellcode.gen, Trojan.Win64.DLLhijack.*, Trojan.Win64.Lazarus.*.