Lazarus Turns a Korean Banking Plug-In Into a Spy’s Front Door

North Korea’s Lazarus Group is back inside South Korean companies through a familiar door: the security plug-ins the country’s banking and government sites made mandatory. Kaspersky says the campaign it calls Operation FlashHole hit at least three firms in software, construction and wired communication equipment manufacturing, with the earliest evidence dating to July 2025. Targets got spear-phishing links to a fake résumé site and a fake interior-design portfolio on GitHub Pages, and then the INISAFE CrossWeb EX service on their PCs launched a Windows process loaded with Lazarus shellcode. Kaspersky says one of the tools in the chain now swaps keys with post-quantum ML-KEM-1024, which is new for the group.

javadevhouse[.]co[.]kr (lure script)
pythonapischool[.]com (lure script)
hxxps://cubedesign[.]co[.]kr/news (Cubridge C2)
hxxps://cubedesign[.]co[.]kr/mobile/fashion (Cubridge C2)
hxxps://fp-news[.]co[.]kr/shop/cart (Cubridge C2)
hxxps://k-wbc[.]co[.]kr/skin/social/social_view.php (ClientHub C2)
hxxps://rcsh[.]co[.]kr/modules/bbs/tiles/bbs_div/inputForm.php (ClientHub C2)
hxxps://www[.]ksog[.]org/insert_file/handle.php (ClientHub C2)

ec84d6cb2ae7974767aedac246b50a3e (TouchShift, mscoree.dll)
a28cba214058fcae2883d8cffc883abd (TouchShift, mscoree.dll)
c105d6b16f544582772de0159f24c00a (TouchShift, mscoree.dll)
2f8475a90a25624ed02f1d18d4e6d65d (TouchShift, mscoree.dll)
676fabe30a28b53925fba98e34b35986 (TouchShift, mscoree.dll)
b4a7eff35f048f06fb0a2d7631f23a7d (TouchShift, mscoree.dll)
ff07641dc56914dd90ee0bd7404d7ad7 (ClientHub loader, liblzma.dll)

Source article: Operation FlashHole: Lazarus breaks security, defies control
Publisher: Kaspersky Securelist (author: Sojun Ryu)
Published: October 21, 2026
URL: https://securelist.com/lazarus-operation-flashhole/121541/

Executive Summary

Operation FlashHole is a Lazarus Group espionage campaign against South Korean organizations that Kaspersky attributes, with medium-to-high confidence, to the same actor behind the earlier Operation SyncHole; Kaspersky notes its TechHub downloader is tracked by Mandiant as CLOUDBURST and by ESET as NickelLoader, its Cubridge framework as SIDESHOW (Mandiant) and LightlessCan (ESET), and it assesses ClientHub as an advanced version of CookiePlus. The earliest evidence dates to July 2025, and Kaspersky responded to the campaign in January 2026; at least three organizations in the software, construction and wired communication equipment manufacturing sectors were hit. Targets received spear-phishing links to GitHub Pages sites posing as a job seeker’s résumé and later an interior design portfolio, which loaded malicious external JavaScript; the INISAFE CrossWeb EX service process (INISAFECrossWebEXSvc.exe) then launched fsquirt.exe at high integrity, injected with shellcode carrying TechHub. Kaspersky says the exact abuse of CrossWeb EX remains unclear and no CVE has been published. TechHub takes commands through issues and files in a private GitHub repository via a Personal Access Token, and drops TouchHub, which copies the legitimate printfilterpipelinesvc.exe to C:\Windows\System32\RasConv\ImeBroker.exe, registers it as a SYSTEM service described as Microsoft Service with the argument -TimeBroker, side-loads the TouchShift loader as mscoree.dll, and timestomps its files from drivers\monitor.sys. TouchShift decrypts a further TechHub variant that reads ActivationStore.dat; later stages are the ClientHub C2 agent (SNOW 1.0 cipher, HTTP(S) to compromised Korean websites or the Dropbox API, plugin loading), LPEClient (host profiling, a patch to MD4Update in jscript9.dll used to disable user-mode syscall hooks, an ML-KEM-1024 post-quantum key exchange and Threefish-encrypted payload delivery), and the Cubridge orchestrator with modules for file, process and disk operations, Chromium credential decryption, Active Directory LDAP queries and password-protected ZipCrypto archiving. The objective is espionage and collection of credentials and documents; Kaspersky separately describes a monetization-focused COPPERHEDGE cluster linked to a Gunra ransomware infection running in parallel. The Hunt Leads below give detection logic, false-positive expectations and the published indicators; Kaspersky published no YARA or Sigma rules for this campaign.

ATT&CK chain: Initial Access → Execution → Persistence → Privilege Escalation → Stealth → Defense Impairment → Credential Access → Discovery → Collection → Command and Control

Hunt Lead Grid

FlashHole C2 Infrastructure Sweep

Kaspersky published two domains that served the malicious external JavaScript embedded in the GitHub Pages lures, hxxps://javadevhouse[.]co[.]kr/ajax/libs/jquery/1.7.3/jquery.min.js on the original résumé site and hxxps://pythonapischool[.]com/api/detach on the interior design site that replaced it in January 2026, plus six C2 URLs on what appear to be compromised Korean websites: Cubridge used hxxps://cubedesign[.]co[.]kr/news, hxxps://cubedesign[.]co[.]kr/mobile/fashion and hxxps://fp-news[.]co[.]kr/shop/cart, and ClientHub used hxxps://k-wbc[.]co[.]kr/skin/social/social_view.php, hxxps://rcsh[.]co[.]kr/modules/bbs/tiles/bbs_div/inputForm.php and hxxps://www[.]ksog[.]org/insert_file/handle.php. ClientHub sends its ciphertext in GET requests with Chromium client-hint headers (Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Mobile, Sec-Fetch-Mode, Sec-Fetch-Dest) so its traffic looks like a browser, and Cubridge appends random news-style sub-paths to its base URL. The detection logic is a retrospective sweep of DNS, proxy and firewall logs for any resolution of the two lure-script domains and any request to the six C2 base paths, followed by a check of which process on the host made each request.

Use DNS resolver logs, web proxy logs with full URL and user-agent, and EDR network telemetry that attributes connections to processes; sweep back to June 2025, a month before Kaspersky’s earliest evidence of July 2025, because the campaign ran for more than a year and implants may still beacon. Because the six C2 URLs sit on websites that may be legitimate businesses whose servers were compromised, blocking the whole domain can affect real users, and a single browser visit to the home page is not a hit; match the exact path, and treat requests from a non-browser process or at regular intervals as confirmed. The lure-script domains are a different case and can be blocked outright. Any process-attributed hit on a C2 path should be escalated to incident response, and the host should then be checked against the side-loading and service leads below. Infrastructure on compromised Korean sites rotates quickly in Lazarus operations, so this lead is a sweep for this campaign rather than a durable rule.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Command and Control → T1071.001 (Application Layer Protocol: Web Protocols); detection strategy DET0027 Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets

Sources: “Operation FlashHole: Lazarus breaks security, defies control”, Kaspersky Securelist, Oct. 21, 2026, https://securelist.com/lazarus-operation-flashhole/121541/ (source article)

RasConv and DrvConh Side-Loading Artifacts

TouchHub, the installer TechHub pulled from its private GitHub repository, copies the legitimate C:\Windows\System32\printfilterpipelinesvc.exe to C:\Windows\System32\RasConv\ImeBroker.exe and writes the TouchShift loader beside it as C:\Windows\System32\RasConv\mscoree.dll, padded with legitimate DLL content to inflate its size, plus the encrypted TechHub configuration C:\Windows\System32\RasConv\ActivationStore.dat. When ImeBroker.exe starts, it loads the local mscoree.dll, whose LockClrVersion export builds an AES-CBC-128 key by XORing the -TimeBroker argument with the hard-coded string x809G736iC3f8Wp8 and the file name ImeBroker.exe, then decrypts shellcode carrying a third TechHub variant. Kaspersky also lists C:\Windows\System32\DrvConh\mscoree.dll and DrvConh\ActivationStore.dat, and further mscoree.dll copies under C:\ProgramData\RasConv\, C:\ProgramData\Apple\, C:\ProgramData\ssh\, C:\ProgramData\qorestor\ and C:\ProgramData\Dell\, alongside C:\ProgramData\Dell\Dell1.tmp, Dell3.tmp, C:\ProgramData\Package.txt, C:\ProgramData\desktops.ini and the ClientHub configuration file C:\Program Files\Common Files\System\msadc\msadc.inc, without describing the role of each. The detection logic is a file sweep for every listed path, any mscoree.dll outside C:\Windows\System32, C:\Windows\SysWOW64 and the .NET framework directories, any ImeBroker.exe, and any image load of mscoree.dll from a non-standard directory by a signed Windows binary.

Run the sweep with EDR file search or an inventory script across all Windows endpoints and servers, and use EDR image-load telemetry for the behavioral half; there is no lookback limit for files on disk, but image-load history should be swept back to June 2025. Hash-matching the six TouchShift MD5s and the ClientHub loader hash is useful as a confirmation step, but do not rely on it alone because TouchShift is padded and rebuilt per victim. Do not block printfilterpipelinesvc.exe or the hash of ImeBroker.exe: it is an unmodified, Microsoft-signed Windows binary used under a deceptive name and location, so blocking its hash would break the Print Filter Pipeline host; detect the path, the name and the DLL it loads instead. A mscoree.dll in any of these folders is a confirmed compromise and goes to incident response, with the service lead below used to find the persistence that launches it. Signed-binary-plus-planted-DLL side-loading from a fake System32 subfolder is a long-running Lazarus pattern, so the “known DLL loaded from an unexpected directory” rule generalizes well beyond this campaign.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Stealth / Execution → T1574.001 (Hijack Execution Flow: DLL), detection strategy DET0201 Detection Strategy for Hijack Execution Flow for DLLs; Stealth → T1036.005 (Masquerading: Match Legitimate Resource Name or Location), detection strategy DET0347 Detection Strategy for Masquerading via Legitimate Resource Name or Location

Sources: “Operation FlashHole: Lazarus breaks security, defies control”, Kaspersky Securelist, Oct. 21, 2026, https://securelist.com/lazarus-operation-flashhole/121541/ (source article)

“Microsoft Service” Running ImeBroker.exe -TimeBroker

To run the side-loading chain with SYSTEM privileges, TouchHub registers a Windows service whose name is picked at random from up to 100 service names in the netsvcs group under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost with two random letters appended, so the name looks like a real Windows service with a small typo. The service’s binary path is C:\Windows\System32\RasConv\ImeBroker.exe -TimeBroker, its description is the generic string Microsoft Service, and TouchHub starts it immediately after creating it. Kaspersky describes this service-based variant as one of three TechHub deployment methods, alongside in-memory execution and plain DLL side-loading. The detection logic is a query of service configuration (HKLM\SYSTEM\CurrentControlSet\Services\* ImagePath and Description) and of service-installation events (System event ID 7045, Security event ID 4697) for any image path under System32\RasConv\ or System32\DrvConh\, any command line containing -TimeBroker, any service described simply as Microsoft Service, and any service name that matches a netsvcs name plus two extra letters.

Use EDR registry and service telemetry or a scripted sweep of service configuration across the estate, and forwarded Windows event logs for installation history back to June 2025. The randomized name is the wrong anchor on its own because it changes per host; the image path, argument and description are stable. Legitimate third-party services sometimes carry vague descriptions, so allowlist by signed image path and publisher rather than by description, and note that no legitimate Microsoft service runs from a RasConv folder. Disabling the service in place without imaging the host loses evidence; any hit should be escalated to incident response, and responders should collect ActivationStore.dat because it holds the TechHub configuration, including the GitHub repository credentials Kaspersky says TechHub can read from its configuration file. Watching for new services whose binaries live in unusual System32 subfolders is a durable rule that catches many loaders beyond this one.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Persistence / Privilege Escalation → T1543.003 (Create or Modify System Process: Windows Service); detection strategy DET0552 Detection of Windows Service Creation or Modification

Sources: “Operation FlashHole: Lazarus breaks security, defies control”, Kaspersky Securelist, Oct. 21, 2026, https://securelist.com/lazarus-operation-flashhole/121541/ (source article)

CrossWeb EX Spawning fsquirt.exe

After a target opened one of the GitHub Pages lures, the CrossWeb EX service process INISAFECrossWebEXSvc.exe launched fsquirt.exe, the legitimate Windows Bluetooth file transfer wizard, at high integrity, and that process was injected with shellcode containing the in-memory TechHub downloader. Kaspersky traced the abused component to the INISAFE CrossWeb EX V3 3.4.1.2 installer bundle, released in 2023 after a KrCERT public advisory, but says the exact abuse method remains unclear, and no CVE has been published. Kaspersky says the group began preparing this campaign shortly after ending SyncHole, its earlier operation against South Korea. The detection logic is a process-creation rule for INISAFECrossWebEXSvc.exe (or any CrossWeb EX process) as the parent of fsquirt.exe or of any other Windows binary outside the plug-in’s own install directory, raised to high severity when the child makes outbound network connections, loads DLLs from user-writable paths, or is followed by service creation or file writes under System32\RasConv\.

Build it on EDR process-creation and process-network telemetry, scoped to hosts where CrossWeb EX is installed (an inventory of the plug-in is a useful first step and also tells you where to update or remove it), and sweep back to June 2025. Baseline the plug-in’s legitimate child processes for a week before alerting, and allowlist by signed image path rather than by process name. Blocking fsquirt.exe by hash is the wrong control because it is an unmodified, Microsoft-signed binary that would break Bluetooth file transfer; detect the parentage instead. A hit should go to incident response, and because the child runs at high integrity, responders should assume the subsequent stages had administrator rights. Treating mandatory browser-security plug-ins as an attack surface and alerting on unusual children of their service processes generalizes to other Korean security software that Lazarus has abused.

Hunt Lead Level: 2 (Pro)

ATT&CK: Stealth / Privilege Escalation → T1055 (Process Injection); detection strategy DET0508 Behavioral Detection of Process Injection Across Platforms. The initial-access abuse of CrossWeb EX itself is not mapped to a separate exploitation technique because Kaspersky says the method remains unclear.

Sources: “Operation FlashHole: Lazarus breaks security, defies control”, Kaspersky Securelist, Oct. 21, 2026, https://securelist.com/lazarus-operation-flashhole/121541/ (source article)

Cubridge News-Style C2 URL Pattern

Cubridge builds each C2 request as [C2_URL]/[page1]/[page2]/[page3], where the hard-coded base in the analyzed sample (configuration version 5.1) was hxxps://cubedesign[.]co[.]kr/news, page1 is a random choice from economy, opinion, politics, national, international, medical, investment, sports, lifestyle, shopping and culture, page2 is one of article, list or story, and page3 is a random eight-digit number from 10000000 to 99999999, giving URLs like hxxps://cubedesign[.]co[.]kr/news/economy/article/12345678. The handshake is a POST with three key-value pairs whose keys come from random word lists and whose values are an 8-byte hex bot ID, the fixed token KW4Ofw982CNJjxd51AVqkGAop and a 16-byte hex session ID, and requests add X-CSRF-Token, X-Requested-With and Upgrade-Insecure-Requests headers to look like browser traffic. The detection logic is a proxy rule matching a URL path ending in /(economy|opinion|politics|national|international|medical|investment|sports|lifestyle|shopping|culture)/(article|list|story)/[0-9]{8} on hosts that are not news publishers, with priority on POST requests and on any request body containing the fixed token.

This needs proxy or secure web gateway logs with full URL, method and, ideally, decrypted request bodies; without TLS inspection, the path shape is only visible if the proxy terminates TLS, so on unproxied networks fall back to the infrastructure sweep. Sweep back to June 2025, then keep it as a standing rule. Allowlist categorized news domains at the proxy and look for the pattern behind non-news base paths such as /mobile/fashion or /shop/cart; repeated hits from one host to a single domain with eight-digit IDs that never repeat are a strong signal. Blocking only cubedesign[.]co[.]kr is the wrong control on its own because the base URL is configurable and Kaspersky lists two other Cubridge C2 paths. The fixed handshake token is the highest-confidence anchor where bodies are visible, and any match should go to incident response.

Hunt Lead Level: 2 (Pro)

ATT&CK: Command and Control → T1071.001 (Application Layer Protocol: Web Protocols); detection strategy DET0027 Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets

Sources: “Operation FlashHole: Lazarus breaks security, defies control”, Kaspersky Securelist, Oct. 21, 2026, https://securelist.com/lazarus-operation-flashhole/121541/ (source article)

Timestamps Cloned From monitor.sys

When TouchHub writes ImeBroker.exe, mscoree.dll and ActivationStore.dat into C:\Windows\System32\RasConv\, it synchronizes their modified, accessed and created timestamps to those of C:\Windows\System32\drivers\monitor.sys, so the new files look as old as the Windows installation in a directory listing or a timeline sorted by standard-information times. The detection logic is a forensic comparison on the NTFS master file table: for files under System32, look for entries whose $STANDARD_INFORMATION created and modified times exactly equal those of drivers\monitor.sys while their $FILE_NAME times, MFT record sequence or USN journal create entries show they were created much later, and for any file whose standard-information creation time is earlier than its file-name creation time.

Use EDR forensic collection or a triage tool that parses $MFT and $UsnJrnl on suspected hosts, and run it estate-wide only where tooling allows; on most endpoints the USN journal covers only days to weeks, so the MFT comparison is the durable artifact. Some installers and Windows servicing operations set times in bulk, so expect matches among Microsoft-signed system files with identical times; anchor on unsigned files, non-standard folders and the exact match to monitor.sys. Do not treat matching timestamps as proof on their own, and do not rely on Explorer or dir output, which shows only the forged standard-information times. Pair a hit with the side-loading and service leads to raise confidence, then escalate. Copying timestamps from a stable system file is a common anti-forensics trick, so the $SI-earlier-than-$FN check generalizes to many intrusions.

Hunt Lead Level: 2 (Pro)

ATT&CK: Stealth → T1070.006 (Indicator Removal: Timestomp); detection strategy DET0591 Cross-Platform Behavioral Detection of File Timestomping via Metadata Tampering

Sources: “Operation FlashHole: Lazarus breaks security, defies control”, Kaspersky Securelist, Oct. 21, 2026, https://securelist.com/lazarus-operation-flashhole/121541/ (source article)

Non-Browser Access to the Chromium Local State Key

Cubridge command 61 reads the encrypted_key value from %LOCALAPPDATA%\Google\Chrome\User Data\Local State and decrypts it with CryptUnprotectData, which yields the key that protects saved passwords and cookies, and Kaspersky also describes a separate browser stealer that is injected into Chromium browsers (Chrome, Edge and Brave) to take passwords, bookmarks, history, preferences and cookies. The detection logic has two parts: file-access telemetry showing a process other than the browser itself reading Local State, Login Data or Cookies in a Chromium profile, especially when followed by a DPAPI CryptUnprotectData call from the same process; and process-access or injection events in which an unexpected process opens a handle with write and thread-creation rights to chrome.exe, msedge.exe or brave.exe, or a remote thread appears in one of them.

This needs EDR with file-read auditing on browser profile paths (or object-access auditing via a SACL on those files) and process-access and DPAPI telemetry where the product exposes it; sweep back to June 2025 on hosts already flagged by the earlier leads, then deploy estate-wide as a standing rule. Password managers, backup agents, enterprise browser-management tools and some security products read these files, so allowlist by signed image path and publisher after a baseline period rather than by process name. Blocking the browser stealer’s hash is ineffective because it runs injected into the browser. A confirmed hit means every credential and session cookie saved in that browser profile must be treated as stolen: rotate passwords, revoke sessions and tokens, and escalate to incident response. Non-browser access to the Chromium key file is a generic infostealer signal that applies far beyond this campaign.

Hunt Lead Level: 2 (Pro)

ATT&CK: Credential Access → T1555.003 (Credentials from Password Stores: Credentials from Web Browsers); detection strategy DET0037 Detect Suspicious Access to Browser Credential Stores

Sources: “Operation FlashHole: Lazarus breaks security, defies control”, Kaspersky Securelist, Oct. 21, 2026, https://securelist.com/lazarus-operation-flashhole/121541/ (source article)

TechHub GitHub Issues C2 From Non-Developer Processes

TechHub uses a private GitHub repository as its command channel, authenticating to the GitHub API with a Personal Access Token that is hard-coded or read from its configuration. On start it lists issues with GET /issues?state=open or closed and removes traces of earlier sessions, creates an issue titled 1[ID] (a digit followed by a 4-byte hex host ID between 0x1000 and 0xFFFF) with the body hel via POST /issues, fetches a repository file whose name contains 2[ID] holding an RSA public key, uploads an RSA-encrypted 16-byte key, and after the handshake changes the issue body to hey via PATCH /issues/[number]. Data moves as files named [1|2][ID][16-byte key], with 1 meaning implant-to-repository and 2 repository-to-implant, AES-encrypted with the key in the name; commands are mqdrz (profile host), laeca (run shellcode), aqvxp (exit) and rtcya (beacon). The detection logic correlates process and network telemetry: connections to api.github[.]com from fsquirt.exe, service-hosted processes such as ImeBroker.exe, or any Windows system binary, and, where proxy TLS inspection is available, API calls creating or patching issues whose title matches ^[12][0-9a-fA-F]{4}$ or whose body is exactly hel or hey.

This needs EDR network events that name the process, joined to proxy logs with decrypted URL and body where policy permits, plus a per-host baseline of which processes legitimately talk to the GitHub API. Scope it away from developer workstations, build servers and CI runners, where GitHub API use is normal, and focus on office, finance and administrative endpoints and on servers that have no reason to call GitHub; sweep back to June 2025. Blocking GitHub is the wrong control because developers and many tools need it; anchor on the calling process and the issue pattern instead. A hit is an escalation to incident response, and if responders recover the PAT from memory or ActivationStore.dat, reporting it to GitHub lets the repository be taken down. Abuse of developer platforms for C2 is now routine across actors, so process-to-API attribution for GitHub, Dropbox and similar services generalizes beyond this campaign; ClientHub’s Dropbox API variant should be hunted the same way.

Hunt Lead Level: 3 (Elite)

ATT&CK: Command and Control → T1102.002 (Web Service: Bidirectional Communication); detection strategy DET0035 Detect Bidirectional Web Service C2 Channels via Process & Network Correlation

Sources: “Operation FlashHole: Lazarus breaks security, defies control”, Kaspersky Securelist, Oct. 21, 2026, https://securelist.com/lazarus-operation-flashhole/121541/ (source article)

LPEClient jscript9.dll MD4Update Patch

LPEClient, the profiling and payload-delivery stage that talks to ClientHub through a shared buffer, calls HeapPageAllocator::ProtectPages inside jscript9.dll to change page protection on the MD4Update function in that DLL, then overwrites the start of the function with a hard-coded opcode sequence that works as a direct syscall stub, which it uses to disable a user-mode syscall instrumentation hook such as those EDR products place. Kaspersky did not publish the opcodes. LPEClient then profiles the host (computer name, memory, CPU, OS and build revision from HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UBR, firmware table, domain, user, integrity level, Kernel VA Shadow and CET shadow-stack status, and installed antivirus read straight from C:\Windows\System32\wbem\Repository\OBJECTS.DATA), compresses and GOST-encrypts it, and completes an ML-KEM-1024 key exchange before receiving Threefish-encrypted Cubridge. The detection logic, which needs memory-level telemetry, is to flag jscript9.dll loaded into a process that is not a browser or script host, a change of protection to writable on the DLL’s code section in such a process, and, in memory scans, a mismatch between the in-memory bytes at MD4Update and the on-disk image; a secondary signal is a non-WMI process reading OBJECTS.DATA directly.

Implement this with EDR that reports image loads and memory-protection changes, and with periodic or triggered memory scanning (for example module-integrity checks that compare loaded code sections with disk) on hosts already flagged by other leads; this behavior leaves no disk artifact, so there is no retrospective sweep beyond what EDR retained. JIT engines and browsers change page protections constantly, so restrict the rule to processes that should never load jscript9.dll and to protection changes inside its code section rather than in heap. Expect your own EDR to lose some visibility on an affected host, which is the point of the patch, so do not treat a quiet EDR as proof of a clean host; corroborate with network and file leads. Hash blocking is not applicable because the modified code exists only in memory and jscript9.dll on disk is legitimate. A hit is an escalation to incident response with a memory capture before reboot. Integrity checks on code sections of loaded system DLLs catch hook-removal tricks in general, not only this one.

Hunt Lead Level: 3 (Elite)

ATT&CK: Defense Impairment → T1685 (Disable or Modify Tools); detection strategy DET0497 Detection of Defense Impairment through Disabled or Modified Tools across OS Platforms. Mapped at the parent level because no sub-technique covers removal of user-mode hooks; ATT&CK lists EDR unhooking as a procedure example for this technique, but its detection strategy focuses on process termination and lost telemetry rather than on unhooking.

Sources: “Operation FlashHole: Lazarus breaks security, defies control”, Kaspersky Securelist, Oct. 21, 2026, https://securelist.com/lazarus-operation-flashhole/121541/ (source article)

Hash Appendix

TouchShift loader (mscoree.dll)

The MD5s come from the source article, which published MD5 only; OTX AlienVault was checked for each MD5 and had no file analysis giving SHA1 or SHA256, and VirusTotal could not be queried without an authenticated account, so SHA1 and SHA256 are not available. The article lists the hashes without mapping each one to a specific path; known drop locations include C:\Windows\System32\RasConv\, C:\Windows\System32\DrvConh\ and several C:\ProgramData\ subfolders.

MD5s

ec84d6cb2ae7974767aedac246b50a3e  # mscoree.dll -> TouchShift loader, side-loaded by ImeBroker.exe (e.g. C:\Windows\System32\RasConv\)
a28cba214058fcae2883d8cffc883abd  # mscoree.dll -> TouchShift loader (drop path not mapped by source)
c105d6b16f544582772de0159f24c00a  # mscoree.dll -> TouchShift loader (drop path not mapped by source)
2f8475a90a25624ed02f1d18d4e6d65d  # mscoree.dll -> TouchShift loader (drop path not mapped by source)
676fabe30a28b53925fba98e34b35986  # mscoree.dll -> TouchShift loader (drop path not mapped by source)
b4a7eff35f048f06fb0a2d7631f23a7d  # mscoree.dll -> TouchShift loader (drop path not mapped by source)

SHA1s

(not available)  # mscoree.dll -> TouchShift loader (all six samples)

SHA256s

(not available)  # mscoree.dll -> TouchShift loader (all six samples)

ClientHub loader (liblzma.dll)

The MD5 comes from the source article; the SHA1 and SHA256 were sourced via OTX AlienVault, whose file analysis for this MD5 records the original file name liblzma.dll and a 64-bit Windows DLL of 578,560 bytes.

MD5s

ff07641dc56914dd90ee0bd7404d7ad7  # liblzma.dll -> ClientHub loader

SHA1s

0549eacd067f37f8b2df8b1bac68838ac1e70352  # liblzma.dll -> ClientHub loader (sourced via OTX)

SHA256s

0c6064255c63dcd447176c25f7cd6971f88f9992780e3b36509dd1be7684d4f6  # liblzma.dll -> ClientHub loader (sourced via OTX)

Legitimate binaries abused under deceptive names or as hosts

The source article publishes no hashes for these files, and none were looked up because they are unmodified, Microsoft-signed Windows binaries: ImeBroker.exe is a renamed copy of printfilterpipelinesvc.exe, and fsquirt.exe is the Bluetooth file transfer wizard used as an injection host. Blocking their hashes would break legitimate Windows features; detect the path, name and parentage instead.

MD5s

(not available)  # ImeBroker.exe -> C:\Windows\System32\RasConv\ImeBroker.exe (renamed legitimate printfilterpipelinesvc.exe; do not block by hash)
(not available)  # fsquirt.exe -> C:\Windows\System32\fsquirt.exe (legitimate binary used as injection host; do not block by hash)

SHA1s

(not available)  # ImeBroker.exe -> C:\Windows\System32\RasConv\ImeBroker.exe (renamed legitimate printfilterpipelinesvc.exe; do not block by hash)
(not available)  # fsquirt.exe -> C:\Windows\System32\fsquirt.exe (legitimate binary used as injection host; do not block by hash)

SHA256s

(not available)  # ImeBroker.exe -> C:\Windows\System32\RasConv\ImeBroker.exe (renamed legitimate printfilterpipelinesvc.exe; do not block by hash)
(not available)  # fsquirt.exe -> C:\Windows\System32\fsquirt.exe (legitimate binary used as injection host; do not block by hash)

References Appendix

• “Operation FlashHole: Lazarus breaks security, defies control”, Kaspersky Securelist (Sojun Ryu), Oct. 21, 2026, https://securelist.com/lazarus-operation-flashhole/121541/ (source article; infection chain, malware analysis, cryptography, attribution and alias mapping, IOCs)
• OTX AlienVault file indicator analysis for ff07641dc56914dd90ee0bd7404d7ad7, AT&T Alien Labs, accessed Oct. 22, 2026, https://otx.alienvault.com/indicator/file/ff07641dc56914dd90ee0bd7404d7ad7 (SHA1 and SHA256 for the ClientHub loader; the six TouchShift MD5s returned no analysis)
• MITRE ATT&CK Enterprise technique and detection-strategy pages linked above, MITRE, https://attack.mitre.org/