CLIENTHUBClientHub

Modular downloader reported and named by Kaspersky in Operation FlashHole, a Lazarus Group espionage campaign against South Korean companies, deployed by TechHub to load LPEClient and relay its C2 traffic through a shared buffer. Two versions exist, one using HTTP(S) to compromised legitimate South Korean websites and one using the Dropbox API; its configuration and C2 addresses are protected with the SNOW 1.0 stream cipher, a first for Lazarus according to Kaspersky, and its requests imitate Chromium browser headers. Commands are encoded as a bitmask to reflectively load, invoke and unload DLLs and plugins (file archiver, file collector, file cleaner, drive and session monitor). Kaspersky assesses with medium-high confidence that ClientHub is an advanced version of CookiePlus.