Lazarus targeted at least three South Korean organizations in Operation FlashHole, using tailored phishing sites and the mandatory CrossWeb EX financial-security software as the likely initial infection path. The memory-focused chain deployed TechHub, TouchHub, TouchShift, ClientHub, LPEClient, and Cubridge, with GitHub repositories and compromised websites serving as command channels. New components introduced SNOW 1.0 encryption, while LPEClient used ML-KEM-1024 and Threefish to protect payload delivery and evade defensive instrumentation. Kaspersky links the campaign to SyncHole, Cascade Hole, and earlier Dream Job activity with medium-to-high confidence.