TECHHUBTechHub

Downloader reported by Kaspersky as the first payload of Operation FlashHole, a Lazarus Group espionage campaign against South Korean software, construction and wired communication equipment manufacturing companies active since at least July 2025. It is injected as shellcode into the legitimate fsquirt.exe spawned by the INISAFE CrossWeb EX financial security software, and also exists as a plain DLL side-loading variant and as a side-loaded variant registered as a Windows service, launched by TOUCHSHIFT. It uses private GitHub repositories as C2 through the GitHub API with a personal access token, handshaking through issues and exchanging RSA/AES-protected files, profiles the host, and supports four commands, including in-memory execution of received shellcode; in FlashHole it deploys TouchHub, ClientHub, LPEClient and Cubridge. Naming: Kaspersky describes TechHub as a more advanced version of the malware Mandiant named CLOUDBURST and ESET named NickelLoader, which used HTTP(S) C2 instead of GitHub; earlier versions were seen in the Dream Job campaign in 2022-2023.