Dissection of Operation FlashHole, a complex attack by Lazarus

Reported 21 Oct 2026 by otx · Severity: medium

In January, Lazarus Group launched Operation FlashHole against South Korea, exploiting mandatory security software CrossWeb EX through watering hole strategies and targeted spear-phishing emails with fake portfolio and resume sites. The campaign began in July the previous year, t