Operation FlashHole: Initial In-Memory Execution via CrossWeb EX and Post-Quantum Payload Protection

1. Basic Information

• Article Title: Operation FlashHole: Lazarus breaks security, defies control
• Publisher: Kaspersky Securelist
• Publication Date: 2026-10-21
• Source: Kaspersky Securelist
• Related Source: BleepingComputer
• Associated Malware: TechHub, Cubridge, TouchHub, TouchShift, ClientHub, LPEClient
• Threat Actor: Lazarus Group
• Associated CVEs: None specified
• Associated Products: INISAFE CrossWeb EX, fsquirt.exe, GitHub Pages, GitHub
• Severity: High

2. Quick Summary

Kaspersky has identified an attack chain involving shellcode injection into fsquirt.exe launched under the CrossWeb EX security software, with the initial stages executed entirely in memory. Email redirection to fake portfolio or resume sites is evaluated as medium-to-high confidence, while the exact trigger mechanism for launch remains unconfirmed. TechHub uses a private GitHub repository, and the later-stage LPEClient uses C2 communication via ClientHub with payload encryption protection using ML-KEM-1024 and other algorithms.

3. Attack Flow

Inferred Delivery and Confirmed Memory-Only Execution and Subsequent Deployment

Initial infection delivery is Kaspersky's assessment, while actions from the injection into fsquirt.exe onward are confirmed behaviors observed during analysis. Memory-only execution was limited to the initial phase, whereas the persistence phase also utilizes files and services on disk.

Attack Stage	Actions and Techniques	Tools and Processes	Evidence and Scope
Initial contact and luring (assessed)	Direct targets to fake portfolio or resume sites	Spearphishing email, GitHub Pages, external JavaScript	Kaspersky's medium-to-high-confidence assessment; email delivery was not directly confirmed
Initial execution and memory injection	Launch a legitimate binary via CrossWeb EX and inject shellcode	INISAFE CrossWeb EX, fsquirt.exe	Confirmed by analysis; the initial chain executes in memory
Payload retrieval and deployment	Retrieve payloads from a private GitHub repository	TechHub, Cubridge, GitHub	Legitimate SaaS is abused as delivery infrastructure
Persistence and later protected payload delivery	Establish persistence using files and services, then deliver encrypted payloads	TouchHub, TouchShift, ClientHub, LPEClient	LPEClient protects payload delivery using ML-KEM-1024, GOST, and Threefish; this is distinct from TechHub's GitHub delivery

1. Kaspersky assesses with medium-to-high confidence that emails directing targets to customized fake portfolio or resume sites were sent, though email delivery itself was not directly confirmed.
2. References to external JavaScript existed on fake GitHub Pages, and visiting them likely initiated the infection flow, including CrossWeb EX. The exact exploitation path from JavaScript to the software remains unconfirmed.
3. Windows built-in fsquirt.exe is launched via CrossWeb EX, loading shellcode into memory.
4. TechHub retrieves payloads from a private GitHub repository. Aside from initial Cubridge, subsequent chains involving persistence via TouchHub/TouchShift and transition from another TechHub to ClientHub/LPEClient were confirmed.
5. The attack proceeds to endpoint profiling and execution of additional payloads. Payload delivery in LPEClient using ML-KEM-1024 and other mechanisms occurs via C2 communication through ClientHub, which is a separate path from TechHub's GitHub delivery.

4. Attacker Position and Execution Location

• Threat actors abuse attacker-controlled sites, GitHub Pages, and private GitHub repositories as delivery infrastructure.
• On endpoints, code executes within the processes of legitimate CrossWeb EX and fsquirt.exe.

5. Victim and Administrator Perspective

Victims

• Appears as a browsing page for work-related portfolios or resumes.

Administrators

• Observed as the launch of legitimate security software or signed Windows built-in binaries, as well as legitimate communication with GitHub, making it difficult to distinguish in standalone logs.

6. Success and Failure Conditions

Success Conditions

• Target users access the fake site.
• The execution path of CrossWeb EX is in an exploitable state.
• Communication from the endpoint to GitHub and code execution in memory are permitted.

Failure Conditions and Mitigations

• Block access to fake sites and external script loads.
• Verify the necessity of CrossWeb EX and vendor guidance, and apply application control and detection of abnormal parent-child process relationships (a patched version for this attack cannot be determined from the source).
• Monitor communications to external destinations, including private GitHub, in conjunction with execution contexts.

7. What Happens Upon Success

• Multi-stage malware executing code in memory.
• Endpoint profiling, delivery of additional payloads, and deployment of browser-saved credential theft capabilities (the presence of functionality and actual credential theft are distinct).
• Potential for internal espionage and data exfiltration.

8. Observable Logs

Inference: The following are candidate logs to check within your organization. They depend on collection settings, retention periods, and monitoring scope, and are distinct from the source's actual observation of each event. Audit logs for attacker-controlled private GitHub repositories are generally not directly accessible to victims.

• Email: Targeted emails containing portfolio or resume links
• Proxy / SWG / DNS: Communications from GitHub Pages to external scripts, access to private GitHub, and communications with known IOCs
• Endpoint / EDR: Launch of fsquirt.exe from CrossWeb EX, process injection, and memory artifacts related to TechHub/Cubridge
• Identity / IdP: Unauthorized use of stolen credentials
• SaaS / Cloud: Suspicious API access to private GitHub repositories
• Network: Encrypted C2 traffic and repetitive communications to unknown external hosts

9. Attack Success Determination

• User Action Confirmed (user_action): Criteria: When access to the fake portfolio or resume page is confirmed.
• Malware Execution or Authentication Success Confirmed (malware_or_authentication_success): Criteria: When the launch of fsquirt.exe from CrossWeb EX, memory injection, and C2 communication via TechHub are confirmed, the initial chain is judged to have succeeded.
• Data Theft or Session Compromise Confirmed (data_or_session_compromise): Criteria: When browser credential access, data archive creation, and external transfer are confirmed, it is judged as data compromise.

10. Investigation Playbook

• Trigger: Detection of access to fake sites, fsquirt.exe launch from CrossWeb EX, or communication with known IOCs
• Initial Verification: Integrate and preserve timelines for email, browser history, process execution, and network traffic
• Endpoint: Scan memory space, registered services, loaded modules, and credential access history
• Authentication / Cloud: Investigate suspected stolen browser sessions, distinguishing between GitHub traffic using attacker PATs and compromised organization tokens
• Subsequent Activity: Verify operational status of Cubridge/TouchHub/LPEClient and presence of staged data
• Containment: Isolate affected endpoints, revoke credentials, block IOCs, and handle affected middleware according to vendor guidance (patched versions are not identified in this report; consider discontinuing use if unnecessary)
• Determination Stages: Contact / Initial Execution / Malware Establishment / Data Theft

11. Defense and Detection Ideas

• Single Event: fsquirt.exe launched under CrossWeb EX, or communication with fingerprinted IOCs
• Timeline Correlation: Email receipt -> GitHub Pages access -> External JS load -> fsquirt.exe launch -> Private GitHub communication
• Hunting Perspective: Searching for rare process pairs where signed Windows built-in binaries are launched from legitimate security software
• Log Gaps: Memory-only execution logs and lack of visibility into content within private GitHub repositories
• Priority Mitigations: Process lineage monitoring, memory telemetry collection, and revocation/rotation of suspected compromised credentials

12. Facts, Inference, and Hypothesis

Facts

• Fake portfolio and resume pages were customized for targeted organizations and referenced external JavaScript from GitHub Pages. Email redirection is assessed by Kaspersky with medium-to-high confidence.
• The execution path of CrossWeb EX launched fsquirt.exe, and shellcode was loaded into memory.
• TechHub retrieved subsequent payloads from a private GitHub repository and deployed Cubridge and other components.
• LPEClient implemented advanced payload protection technologies combining ML-KEM-1024, GOST, and Threefish.
• Kaspersky confirmed victims in at least three organizations in South Korea across software, construction, and wired communication equipment manufacturing.

Inference

• Rather than focusing solely on encryption schemes, correlating multi-layered processes and networks—legitimate software -> signed binary -> memory-only execution -> trusted SaaS—is critical for detection.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in "Uncertainties and Further Investigation".

13. MITRE ATT&CK Mapping

ID	Technique	Confidence	Basis
T1566.002	Phishing: Spearphishing Link	medium	Kaspersky assesses with medium-to-high confidence that emails redirecting via links were used; distinct from direct delivery confirmation.
T1055	Process Injection	high	Kaspersky confirmed shellcode injection into fsquirt.exe launched under CrossWeb EX. Launch of a signed binary alone is not judged as proxy execution.
T1105	Ingress Tool Transfer	high	Payloads are retrieved from a private GitHub repository.

14. Uncertainties and Further Investigation

• The exact delivery vector of the initial spearphishing emails and the full scope of all victim organizations are not finalized.
• The overall exploitation conditions and patch statuses for vulnerabilities on the CrossWeb EX side remain unclear from publicly available information.

15. Impact on SOCs and Organizations

The campaign abuses security software historically required for online banking and government services in South Korea. Organizations that rely on trusted middleware, digital-signature components, or legitimate update software should assess the corresponding execution paths and trust boundaries. Avoid relying on allowlisting for legitimate binaries alone; instead, correlate parent-child processes and network destinations.

16. Summary by Target Audience

• For SOCs: Correlate inferred GitHub Pages and external script access with confirmed process injection from CrossWeb EX to fsquirt.exe and private GitHub communications.
• For Administrators: Inventory internal middleware, including CrossWeb EX, verify vendor guidance, and apply application control and egress controls.
• For Users: Even for portfolio or resume links, immediately stop operations and report if unexpected security software launches or downloads occur.