WORLD WATCH · October 21, 2026 · RESEARCH
Lazarus runs Operation FlashHole
Lazarus runs Operation FlashHole to attack financial systems with a complex malware set.
- Reported by
- Securelist
- Outlets reporting
- 1
- Category
- RESEARCH
- Newest report
- October 21, 2026
Plain-English brief. Written for readers who work in a second language.
Key takeaways
- Lazarus uses a watering-hole technique
- Lazarus abuses CrossWeb EX software
- Lazarus deploys a complex malware set
- Lazarus targets financial systems
What happened
The report comes from Securelist. Lazarus uses a watering-hole technique to direct specific users to malicious pages. Lazarus abuses CrossWeb EX financial security software to gain initial access to target systems. Kaspersky researchers identify several parts of a complex malware set in the same attack. Lazarus uses those parts to maintain access to affected systems.
Why it matters
The watering-hole technique allows Lazarus to reach specific users with little direct contact. The abuse of CrossWeb EX allows Lazarus to bypass some security controls on protected systems. The complex malware set allows Lazarus to move laterally on affected networks. These actions put financial systems at direct risk.
What to do
- Verify the current version of CrossWeb EX on all affected systems.
- Block access to known watering-hole pages on secure networks.
- Scan all affected systems for traces of the identified malware set.
SOURCE: INTEL128 WORLD WATCH (UPDATED OCT 21, 2026). This brief summarizes reporting by Securelist. Intel128 writes the summary and credits the outlet. Read the summary as a starting point, not as a substitute for the original reporting.