North Korea's Lazarus Hackers Broke In Through the Security Software South Korea Forces Everyone to Install

In South Korea, you cannot use many online banking and government websites without first installing a piece of security software. North Korea's Lazarus Group has turned that requirement into a way in, again. Kaspersky says the hackers broke into South Korean companies through CrossWeb EX, a mandatory financial security program, in a campaign it calls Operation FlashHole.

The program exists to protect people. It encrypts traffic between the browser and the server using public key infrastructure. Instead, it became the front door.

Same vendor, same trick

Kaspersky responded to the campaign in January 2026, but the earliest evidence goes back to July 2025, shortly after the group's previous operation, SyncHole, wound down. SyncHole abused Cross EX. FlashHole abused CrossWeb EX. Both are financial security products from the same vendor, and Lazarus has abused this kind of software before, in 2021, 2022 and 2023.

The malicious process spawned from INISAFE CrossWeb EX V3 3.4.1.2, a 2023 version released after a KrCERT advisory. Kaspersky could not determine exactly how the software was abused or precisely what triggered it. A 2025 USENIX Security paper had already argued that South Korea's mandatory security software creates a massive attack surface, and in July 2026 the government and local vendors issued a joint advisory on Lazarus techniques, including abuse of exactly this kind of software.

Fake resumes on GitHub

The lures were personal. Kaspersky assesses with medium-to-high confidence that targets received spear-phishing emails linking to fabricated websites tailored to each victim and hosted on GitHub Pages.

One site posed as the resume of a senior network appliance developer. The photo appears AI-generated, with no EXIF data and an unnatural texture, and the name resembles a Korean "John Doe." In January the same page was swapped for an interior design showcase. The first likely victim worked at a wired communication equipment maker; the second was in construction.

GitHub did more than host the bait. A downloader Kaspersky calls TechHub talks to a private GitHub repository through the GitHub API using a personal access token, even using GitHub issues as a handshake. The accounts were likely created with hijacked email addresses. Other command servers ran on compromised legitimate South Korean media and interior design websites.

From there, the chain runs mostly in memory. An orchestrator called Cubridge and a long-running backdoor called LPEClient, seen since 2019, load tools that steal saved passwords, cookies and history from Chrome, Edge and Brave, query Active Directory, collect files and wipe them by overwriting and deleting.

Post-quantum malware

The most surprising detail is the cryptography. LPEClient now uses ML-KEM-1024, NIST's post-quantum key encapsulation standard, alongside Russia's GOST cipher. "Ironically, the group seems to have adopted more secure post-quantum cryptography faster than many legitimate security products," Kaspersky wrote, a point BleepingComputer also highlighted.

At least three victims are confirmed, in software, construction and wired communication equipment manufacturing. Kaspersky believes there are many more. FlashHole looks focused on espionage, and the software sector was targeted in both operations, which suggests an interest in stealing source code. A separate cluster Kaspersky tracks as COPPERHEDGE appears to handle the money side, with ransomware and a dark web leak site. Pyongyang has other money machines running in parallel, including the laptop farms that hid North Korean IT workers inside US companies.

A door that stays open

In October 2025, Seoul unveiled a plan to phase out mandatory security software installation beginning in 2026. Until that software is actually gone from people's machines, Kaspersky expects operations abusing it to stay highly active.

Some offers on this page may be paid placements or contain affiliate links.