Malware

TOUCHSHIFT

Indicators of Compromise 19

Domain cubedesign[.]co[.]kr Domain fp-news[.]co[.]kr Domain javadevhouse[.]co[.]kr Domain k-wbc[.]co[.]kr Domain ksog[.]org Domain pythonapischool[.]com Domain rcsh[.]co[.]kr Filename ActivationStore.dat Filename msadc.inc Filename mscoree.dll GitHub Repo <username>/github.io GitHub User <username> SHA-256 2f8475a90a25624ed02f1d18d4e6d65d SHA-256 676fabe30a28b53925fba98e34b35986 SHA-256 a28cba214058fcae2883d8cffc883abd SHA-256 b4a7eff35f048f06fb0a2d7631f23a7d SHA-256 c105d6b16f544582772de0159f24c00a SHA-256 ec84d6cb2ae7974767aedac246b50a3e SHA-256 ff07641dc56914dd90ee0bd7404d7ad7

MITRE ATT&CK TTPs 4

T1053.008
T1053.008
 T1055
Process Injection
Defense Evasion
 T1071.001
Web Protocols
Command And Control
 T1071.004
DNS
Command And Control

Source Articles

Operation FlashHole: Lazarus breaks security, defies control
The Lazarus Group has launched a new attack campaign, dubbed Operation FlashHole, targeting organizations in South Korea's software, construction, and wired communication equipment manufacturing sectors. The campaign uses a multi-stage infection chain beginning with malicious websites hosted on GitHub Pages, which deliver a JavaScript-based initial payload that exploits the legitimate CrossWeb EX security software to execute malware in memory. The attackers deploy an updated set of known and newly identified malware variants—including TechHub, Cubridge, TouchHub, TouchShift, ClientHub, and LPEClient—to establish persistence, conduct reconnaissance, and load further payloads. The infrastructure leverages abused legitimate websites, GitHub repositories, and Dropbox for command and control, with post-quantum cryptography used in later stages to secure communications.
securelist ·2w ago