Lazarus routes malware through South Korea’s CrossWeb EX
Kaspersky says Lazarus’s Operation FlashHole used South Korea’s CrossWeb EX financial-security software in a campaign affecting at least three organizations. The affected organizations span software, construction, and wired-communication equipment manufacturing; Kaspersky’s earliest evidence dates to July 2025. The campaign follows Operation SyncHole, which abused related Cross EX software.
Lazarus sent tailored links to fabricated résumé and portfolio pages, while compromised sites offered another route into the campaign. CrossWeb EX is required for access to widely used South Korean banking and government sites. Kaspersky says the exact abuse method remains unclear, but the chain ended in malware executing in memory.
For South Korean organizations that rely on CrossWeb EX for those services, a trusted background component is part of the attack surface. The report does not establish which other installations may be exposed, leaving the scale beyond the three identified organizations uncertain.
Dissecting Operation FlashHole, a complex attack by Lazarus
Kaspersky researchers analyze Operation FlashHole – a recent complex attack by Lazarus, involving a sophisticated malware set, watering-hole technique and abuse of CrossWeb EX financial security software.