Lazarus Group Targets South Korean Firms by Abusing Trusted Banking Security Software

The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign called Operation FlashHole. According to Kaspersky, it has targeted at least three organisations in South Korea across the construction, software and wire-communication equipment manufacturing sectors, and has been active since at least July 2025. Kaspersky assesses it as a continuation of an earlier campaign, Operation SyncHole.

Kaspersky researcher Sojun Ryu said the group was more selective this time. Victims received spear-phishing emails with links to fabricated but relevant websites, such as portfolio and résumé pages tailored to each target. FlashHole abuses Initech's INISAFE CrossWeb EX, a mandatory financial security tool needed to access online banking and government portals in South Korea. SyncHole, first documented in April 2025, exploited a different product, iniLINE Cross EX, and delivered malware including ThreatNeedle. It also used a one-day vulnerability in the Innorix Agent file transfer tool for lateral movement.

Lazarus has a long history of abusing CrossWeb software. In the third quarter of 2021 it was used to deploy a downloader called Racket as part of a long-running campaign known as DeathNote. The pattern shows how attackers return to software that users are required to install and trust.