CUBRIDGECubridge

Backdoor and orchestrator of the modular malware framework used in Operation FlashHole, a Lazarus Group espionage campaign against South Korean companies, reported by Kaspersky. Deployed by TechHub and redeployed in memory through ClientHub and LPEClient after persistence, it uses compromised legitimate South Korean websites as C2 with URLs generated from news-like word lists, an RSA and RC6 handshake and browser-like headers. It loads plugins (ADFinder, FileCollector), tools (browser stealer, process collector) and two modules: an action module for file, process and command operations and a function module re-implementing Windows commands such as ipconfig, net, netstat, reg, sc, schtasks and whoami, plus screen capture and Chrome key extraction. Naming: Kaspersky states that an earlier version of Cubridge is the malware Mandiant named SIDESHOW, and that ESET named one of its modules LightlessCan; Kaspersky believes the function module is based on LightlessCan. Earlier versions were seen in the Dream Job campaign in 2022-2023.