North Korean hackers hide malware in South Korea's bank security software

A hacking group tied to North Korea has been breaking into South Korean companies by abusing security software that many people there are required to install. Kaspersky calls the campaign Operation FlashHole. It says the campaign has run since at least July 2025 and hit at least three organizations.

What happened

The group is called Lazarus. Kaspersky says it targeted firms in construction, software and wire-communication equipment manufacturing. The attackers sent targeted phishing emails, meaning messages written for a specific victim. The emails linked to fake but believable portfolio and résumé pages.

Signs point to websites hosted on GitHub. One of them showed the résumé of a senior network appliance developer, with a profile photo that was likely made with artificial intelligence.

The security software angle

South Korean internet users must install financial security programs to use online banking and government services. FlashHole abuses one of them, Initech's INISAFE CrossWeb EX. An earlier campaign, Operation SyncHole, abused a similar program called Cross EX.

This is not new for Lazarus. Kaspersky says the group used CrossWeb EX in 2021. AhnLab, another security firm, reported attacks through the same software in 2022 and 2023. In July 2026, a Korean government agency and local security vendors warned about flaws in another such program, AnySign4PC.

How the malware hides

Kaspersky says the early steps of the attack exist only in memory. That means they leave little behind on the computer, which makes the break-in harder to spot. The newest version also uses ML-KEM-1024, a post-quantum encryption method, to set up a protected link to the attackers' server. It then downloads and runs more malware in memory.

Check Point reported in August 2026 that a related tool, LPEClient, was deployed after attackers used a previously unknown Windows flaw, CVE-2026-68820, to install a rootkit. A rootkit is software that hides deep in a system.

What is not known

The exact first step of the attack is unclear. Kaspersky suspects the phishing emails, but the material does not confirm it. It also names only three victim organizations by industry, not by company.

What to do

• Keep required security software and Windows fully updated.
• Be wary of unexpected résumé or portfolio links, even if the page looks real.
• Do not assume a profile photo proves a real person.
• Businesses that hire remotely should open outside links on a protected device.