Analysis of Operation FlashHole, a complex Lazarus Group campaign

The report

An analysis of Operation FlashHole, a recent Lazarus Group campaign that uses a complex malware chain, the watering hole technique and abuse of CrossWeb EX, software used to protect financial transactions.

Read the full analysis: Analysis of Operation FlashHole, a complex Lazarus Group campaign (Securelist, in Russian).

The report is published in Russian; its title and summary here are an English translation.

Indicators

Malware C

• cubedesign[.]co[.]kr

Defanged so they cannot be clicked by mistake: replace [.] with a dot. Shared hosting and CDN addresses named in the report are left out on purpose, so blocking these does not break legitimate sites.

How this is tracked

EncryptLayer intelligence, A.R.P. Syndicate’s open threat feed, reviews each indicator against the published report before adding it (#24). This page is generated from that record and the report’s own title and summary; nothing is rewritten.