Kaspersky’s analysis of Operation FlashHole shows Lazarus pairing a watering-hole with abuse of CrossWeb EX, the financial client Korean banks still force onto employee and customer PCs. That plugin sits in the same trust bucket as antivirus and PAM agents. It is signed. It is required. It often holds scanning exemptions your cybersecurity stack will never question. If your threat detection still treats “bank security software” as a known-good process, FlashHole is your problem set.

Watering-Hole Traffic Passed as Normal Banking HTTPS

You already allow this traffic. That’s the point of a watering-hole. Lazarus waited on a destination your users visit because finance, payroll, or a local brokerage requires it. No spray of credential lures. No brute-force run against your VPN concentrator. Just a site that already sits on the allow list.

A firewall that permits 443 to a bank portal, a brokerage login, or a tax authority is doing its job. Your proxy logs will look boring. TLS inspection, if you even intercept those domains, often excludes them because the plugin pins certificates or the session dies when you break TLS. Defense in depth that starts with “block the bad URL” has nothing to argue with. The URL was legitimate. The content on it was not.

You’ve seen watering-holes before. Compromise a high-traffic, high-trust property. Serve the payload to a filtered audience. Pull the kit. FlashHole aims that playbook at machines that already run financial security clients. Those clients chatter constantly. They check for updates. They inject into browsers. They request local admin because a bank PDF said so in 2014 and the ticket never came back for review.

Call it what it is. Required vendor software is privileged software. Privileged software is a loader with a helpdesk exemption. This is a bad look for any program that still scores “the bank made us install it” as inherently safer than random freeware.

CrossWeb EX Became the Cybersecurity Loader

CrossWeb EX exists to satisfy Korean online-banking rules. It drops helpers, drivers, and browser components that live under the OS and over the user’s ability to say no. Vendors have spent years telling you to lock down random EXE files. Far fewer programs ask what happens when the mandated cyber security client loads the next stage.

Lazarus has hunted this sector for years. FlashHole’s useful detail is operational. After the watering-hole delivers, abuse of CrossWeb EX gives the operator a signed, expected parent process. Your EDR publisher allowlists, your application-control exceptions, your “known banking module” folders, all of that becomes cover. Threat protection that keys on unsigned droppers in %TEMP% will shrug at a bank helper spawning work from its own install tree.

Don’t file this under “Korea problem, ignore.” Any shop with staff in Seoul, a captive finance team on local brokerages, or a travel laptop that completed “install these four programs to get paid” is running a privileged client you probably never inventoried. Put it on the same diagram as your VPN client and your DLP driver. Same blast radius. Less scrutiny.

The same week, AOMEI Backupper’s download path was hijacked in short bursts to push a ShinyRoad modular backdoor. Different product class. Same trust failure. Attackers need a trusted installer to blink for a few hours. People who hit Download during those windows got malware. People who hit it the next day got the real binary. An incident response plan that hunts a Trojanized installer present for weeks will miss a window measured in hours.

If your mental model of supply chain is still a months-long build-system implant, you’ll ticket the wrong evidence. Short-burst compromise is cheaper, quieter, and aimed at people who click Download on a site they’ve used for years.

Shrink Plugin Trust Before the Next FlashHole Drop

Stop arguing about awareness mail. CrossWeb EX and its cousins are local privileged software. Treat them like remote support agents: inventory, constrain, watch, and keep a kill path.

Do this now, on the actual endpoints, not in a policy draft:

• Inventory every financial, tax, and “security” browser helper, including CrossWeb EX, on laptops and VDI; record publisher, path, service name, and whether AV or EDR excludes it.
• Delete those exclusions unless you can name the breakage in writing. If the bank plugin cannot survive being scanned, that’s a vendor defect you document, not a permanent hole you bless.
• Pin the plugin updater to a vendor allowlist, log every new hash, and block the rest of the internet from that process.
• Uninstall it from machines that don’t process Korean banking or brokerage work. Required for a subset of users is not required for the fleet.

Ongoing security hardening is dull on purpose. Run application control in publisher-plus-path mode so a stolen cert on an unexpected path still trips. Alert when a financial client spawns cmd, PowerShell, rundll32, mshta, or a working directory outside its install tree. Capture parent-child for those processes in your threat detection rules the same way you do for Office. If you inspect TLS, stop carving out the entire bank domain class. Inspect what you can. Park what you can’t in a separate browser or VM.

Defense in depth here means a dedicated, non-admin Windows profile or VM for mandated finance clients. No SSO tokens. No cached cloud-drive credentials. No local admin. When FlashHole-style code runs, it should steal a useless island, not the user’s mailbox and your jump host.

Add two hunts this week. First, endpoints that loaded CrossWeb EX or similar helpers, then made new outbound connections to non-bank infrastructure. Second, installer downloads for backup and finance tools that don’t match the hash you pinned, especially if the timestamp falls in a short window. Correlate with proxy 200s to vendor CDNs, not just malware detonations. The AOMEI campaign is your reminder that a clean scan yesterday is not a clean scan during the burst.

Sources

• Operation FlashHole: Lazarus breaks security, defies control
• AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign