---
title: Hunt: Lazarus Operation FlashHole — CrossWeb EX chain, LPEClient with ML-KEM-1024, Cubridge C2 | ctxsec
url: https://ctxsec.com/items/hunt-lazarus-operation-flashhole
description: ""
status: "hunt idea (Kaspersky GReAT Securelist, dated Oct 21)"
published: 2026-10-21
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-lazarus-operation-flashhole.md)

hunt idea (Kaspersky GReAT Securelist, dated Oct 21)

2026-10-21

### Hunt: Lazarus Operation FlashHole — CrossWeb EX chain, LPEClient with ML-KEM-1024, Cubridge C2

Kaspersky describes **Operation FlashHole**, a Lazarus espionage campaign against South Korean orgs (software, construction, wired-comms manufacturing) with earliest evidence from July 2025. Initial access abuses mandatory financial-security software **INISAFE CrossWeb EX** (parent `INISAFECrossWebEXSvc.exe`) to run malware in memory at high integrity, plus spear-phish to AI-tailored GitHub Pages résumé/portfolio lures.

1. Process: unusual child processes / reflective loads from CrossWeb EX / INISAFE services.
2. Files: `mscoree.dll` sideloads under `C:\ProgramData\` paths (Dell, Apple, ssh, RasConv, qorestor) and `C:\Windows\System32\RasConv|DrvConh\`; temps like `Dell1.tmp`/`Dell3.tmp`, `Package.txt`, `ActivationStore.dat`.
3. C2 hosts (defang): javadevhouse[.]co[.]kr, pythonapischool[.]com, cubedesign[.]co[.]kr, fp-news[.]co[.]kr, k-wbc[.]co[.]kr, rcsh[.]co[.]kr, www[.]ksog[.]org.
4. Crypto: LPEClient obtains four ML-KEM-1024 public keys from C2 for post-quantum key exchange (Kaspersky notes faster PQ adoption than many defenders).
5. Detections (Kaspersky): MEM:Trojan.Win64.Shellcode.gen, Trojan.Win64.DLLhijack.*, Trojan.Win64.Lazarus.*.

Sources: [Kaspersky Securelist: Dissecting Operation FlashHole](https://securelist.com/lazarus-operation-flashhole/121541/) · [Kaspersky press release](https://www.kaspersky.com/about/press-releases/kaspersky-identifies-new-lazarus-apt-campaign-utilizing-ai-and-post-quantum-encryption)