Severity: High | Priority: 1
Operation FlashHole targets South Korean organisations in software, construction and communications equipment manufacturing. Victims receive spear-phishing emails linking to fake résumé or portfolio websites, apparently built with AI-generated content. These sites load malicious JavaScript that is believed to abuse INISAFE CrossWeb EX, a security program that South Korean financial and government websites require.
The infection installs a chain of tools:
- TechHub: a downloader that uses a private GitHub repository for commands.
- TouchHub and TouchShift: these install a service and side-load the next stage.
- Cubridge: a modular backdoor that steals browser passwords and cookies, queries Active Directory, injects into processes and runs commands.
- ClientHub and LPEClient: backdoors that communicate through compromised legitimate websites or Dropbox.
To reduce exposure:
- Make sure INISAFE CrossWeb EX and other browser-facing security plugins are updated or removed where they aren’t needed.
- Warn staff about unsolicited job applications and portfolio links.
- Restrict GitHub and Dropbox API access from machines that don’t need it.
