Executive Summary

Last week’s reporting covered two different routes into exposed systems. Kaspersky attributed Operation FlashHole to Lazarus Group and traced a tailored phishing chain through a mandatory South Korean security product. CYFIRMA assessed that a Korean-speaking team linked to the Lazarus ecosystem was preparing to exploit two critical PHP flaws against internet-facing servers.

Developer environments remained a second point of entry. Researchers documented malware that modifies VS Code, Cursor, Discord, GitHub Desktop, and npm for persistence, while Contagious Interview operators used private repositories and alternate npm registries to limit delivery to selected targets. Separate reporting covered multilingual Kimsuky shortcuts, PolinRider activity in compromised repositories, and $260,000 in losses across five DPRK-related cases.

Key Trends

1. FlashHole turned required security software into an infection path

Kaspersky attributed Operation FlashHole to Lazarus Group and identified at least three affected South Korean organizations in software, construction, and wired communications equipment manufacturing. Operators sent links to GitHub Pages sites tailored as a developer resume or an interior design portfolio. Kaspersky assessed with medium-to-high confidence that visiting the sites initiated a chain involving INISAFE CrossWeb EX, software required for access to widely used South Korean banking and government services.¹

The legitimate CrossWeb EX service launched fsquirt.exe, which received injected shellcode containing TechHub. A largely memory-resident framework then deployed Cubridge, TouchHub, TouchShift, ClientHub, and LPEClient. The components supported host profiling, credential theft, injection, file collection, and cleanup. GitHub repositories, compromised websites, and Dropbox divided command and control across several channels.¹

Kaspersky linked FlashHole to the earlier Cascade Hole and SyncHole activity through malware, infrastructure, and infection-chain overlap. The initial route differed in its use of CrossWeb EX, but the operation retained a selective approach built around sites prepared for individual targets rather than broad distribution.¹

2. A suspected campaign moved from PHP reconnaissance to active scanning

CYFIRMA reported that Korean-speaking operators had assembled a list of 216 internet-facing PHP hosts that appeared unpatched or only partly mitigated against CVE-2026-109618 and CVE-2026-109619. The operators said they were running low-volume checks from 21 compromised nodes and had touched about one third of the target set by October 24. Government, finance, logistics, aviation, manufacturing, and online transaction systems were among the priorities.²

CYFIRMA assessed a Lazarus ecosystem affiliation with moderate confidence based on language, operational patterns, targeting, and historical web-shell tradecraft. Its reporting placed the activity in preparation and active scanning rather than confirmed mass compromise. The operators separated staging, collection, and scanning infrastructure, rotated nodes, and dropped addresses that encountered filtering or rate limits.²

For exposed PHP systems, the immediate task is to patch to a fixed branch and restart workers, then review traffic back to October 17. Low request volume weakens rate-based detections, so investigations should also look for contact with the reported nodes, unusual multipart requests, PHP worker crashes, and shells spawned by web processes.

3. Developer tools became both delivery and persistence mechanisms

An analyst examining a North Korea-linked JavaScript chain found an updated DEV#POPPER variant that modifies files used by VS Code, Cursor, Discord, GitHub Desktop, and the global npm CLI. The implant appends code after long whitespace padding and keeps backup copies of altered files. Once npm is modified, routine commands such as npm install or npm run can relaunch the implant. Its socket.io channel supports shell execution, file transfer, clipboard theft, and collection of process environment variables.³

OpenSourceMalware described a more selective Contagious Interview delivery method. A private lure repository carries an .npmrc file that redirects npm to an alternate registry. The malicious dependency named in package.json is absent from the public registry and resolves only when the invited target installs the project with that repository configuration. Public package scanning therefore does not see the delivered package.⁴

Wiz found a separate form of overlap while investigating Gheist, an automated campaign that abused stolen GitHub tokens to plant secret-dumping Actions workflows. On October 19 and 20, three affected accounts re-pushed Gheist-modified commits with PolinRider loaders appended to build files. Wiz traced the wider token pool to infostealer logs and earlier supply-chain compromises, documenting how the same stolen credentials circulated across distinct campaigns.⁵

The Gheist workflows attempted to Base32-encode repository and environment secrets in Actions logs before retrieving the logs through GitHub’s API and deleting the runs. GitHub’s approval hold blocked execution in the public repositories Wiz checked, but workflows ran successfully in private and enterprise environments. Defenders can hunt for ci-sync-* branches, the gheist user agent, deleted workflow runs, and cloud role assumptions whose subject references an attacker-created branch.⁵

4. Kimsuky and fake-interview activity kept shortcuts, tests, and meetings in play

Nextron Systems analyzed nine multilingual LNK files associated with APT-C-55, or Kimsuky. The lures used Korean, Japanese, Vietnamese, German, and English filenames themed around contracts, insurance, invoices, and financial documents. Batch and PowerShell chains copied and renamed certutil and curl, opened decoy documents, established scheduled tasks, and collected host, account, process, network, and file-listing data.⁶

The same report documented a Windows-only path in a cloned pybroker repository. Running pytest loaded malicious code from tests/conftest.py, decrypted a hidden .env payload, and retrieved a later stage from GitHub. This route placed execution in test infrastructure rather than in an obvious installer or application entry point.⁶

Security Alliance handled five DPRK-related cases with $260,000 in reported losses. Three Contagious Interview victims lost a combined $86,000, while an unidentified wallet-compromise campaign caused a $174,000 loss. Investigators also found PolinRider in 13 of 928 repositories from an open-source bounty program and published new infrastructure associated with UNC1069, Contagious Interview, and SINT-69.⁷

South Korean police were also investigating what MBC described as the first identified case of a North Korean IT worker employed by a South Korean company. The worker allegedly used another person’s identity to obtain software development work through a staffing platform. Investigators were examining whether domestic facilitators or additional organizations were involved.⁸

What to Watch

South Korean organizations should monitor required browser and financial-security components as possible parent processes for unexpected Windows utilities or injected code. Internet-facing PHP operators need to combine patch verification with historical log review because quiet scanning may not trigger volume thresholds.

Development teams should inspect repository-level npm configuration, test hooks, editor startup files, and the installed files of Electron applications. GitHub investigations should connect token use, branch creation, workflow execution, cloud role assumptions, and force-pushed build files. A removed workflow or branch does not recover secrets already exposed in logs or clear persistence added to developer tools.

Reports Reviewed