Threats Tagged 'touchshift'

Operation FlashHole is a sophisticated cyberattack campaign launched by the Lazarus Group targeting South Korea. It exploits mandatory security software CrossWeb EX using watering hole attacks and spear-phishing with fake portfolio and resume websites. The campaign, active since July prior to January, targets sectors including software, construction, and cable equipment manufacturing. It employs a modular malware framework combining multiple malware families such as TechHub, Cubridge, TouchShift, TouchHub, ClientHub, and LPEClient. Techniques used include in-memory execution, DLL side-loading, and command-and-control infrastructure leveraging GitHub and Dropbox. The attackers also incorporate advanced cryptographic methods like post-quantum cryptography (ML-KEM-1024) and GOST encryption. This campaign demonstrates Lazarus Group's evolving tactics specifically tailored for South Korean targets.