The Lazarus Group, linked to North Korea, has launched Operation FlashHole, targeting at least three South Korean organizations in the construction, software, and wire-communication equipment manufacturing sectors.
The vulnerability or weakness
The attack leverages the abuse of Initech's INISAFE CrossWeb EX, a mandatory financial security solution, to deploy malware.
Earlier attacks and coverage
- Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware (2026-10-26)
- 10 Software Security Practices Built for the Next 250 Years (2026-10-26)
- China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors (2026-10-21)
- The Key to AI Software Security Isn’t Speed, It’s Maturity (2026-10-20)
- ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan (2026-10-20)
Business impact
This campaign could lead to significant financial losses and operational disruptions for affected organizations, as well as potential legal and reputational damage.
Industries affected
Construction, software, and wire-communication equipment manufacturing sectors are targeted.
Users affected
South Korean internet users, particularly those accessing online banking and government services, are affected.
