Operation FlashHole is a sophisticated cyberattack campaign launched by the Lazarus Group targeting South Korea. It exploits mandatory security software CrossWeb EX using watering hole attacks and spear-phishing with fake portfolio and resume websites. The campaign, active since July prior to January, targets sectors including software, construction, and cable equipment manufacturing. It employs a modular malware framework combining multiple malware families such as TechHub, Cubridge, TouchShift, TouchHub, ClientHub, and LPEClient. Techniques used include in-memory execution, DLL side-loading, and command-and-control infrastructure leveraging GitHub and Dropbox. The attackers also incorporate advanced cryptographic methods like post-quantum cryptography (ML-KEM-1024) and GOST encryption. This campaign demonstrates Lazarus Group's evolving tactics specifically tailored for South Korean targets.
An Iranian state-aligned threat actor, CL-STA-1178, has been conducting the Blinder Tunnel campaign since November 2025, targeting Iraqi critical infrastructure by impersonating the Dubai Airports IT department. The campaign delivers trojanized coding challenges that deploy ShelbyLoader V2 malware through a multi-stage attack chain involving AppDomainManager hijacking and DLL sideloading. The attackers use GitHub API infrastructure for command-and-control communications, including repositories and issues as fallback channels. Operational security errors revealed links to a separate credential harvesting campaign targeting Israeli entities with conflict-themed Google Drive lures in mid-2026.
C2Looper is a Rust-based backdoor malware identified in mid-2026, associated with ransomware threat actors. It provides remote shell execution, reconnaissance, and payload deployment capabilities. Initial versions communicate via plaintext HTTP, while later versions use GitHub repositories for command-and-control, storing commands and exfiltrated data in JSON files. Version 2 adds features such as drive enumeration, shellcode injection, and file listing. Delivery is assessed with low to medium confidence to occur through multi-stage ClickFix infection chains. The malware is actively developed and likely used by initial access brokers to facilitate ransomware and data theft operations.
On March 12, 2026, a sophisticated attack campaign was identified targeting Chinese-speaking individuals using military-themed document lures distributed through a malicious ZIP archive. The operation employed a trojanized SumatraPDF binary as the initial vector to deploy an AdaptixC2 Beacon and Visual Studio Code on victim systems. The shellcode loader demonstrated significant similarities to the TOSHIS loader previously linked to TAOTH campaigns. Attackers established a custom AdaptixC2 Beacon listener utilizing GitHub for command-and-control infrastructure. The staging server infrastructure additionally hosted CobaltStrike Beacon and EntryShell backdoor, both previously associated with this threat group. The campaign infrastructure included multiple compromised domains and IP addresses for malware distribution and C2 communications.
