CrossEX is South Korean security software deployed in environments such as online banking and government services. During Operation SyncHole, Lazarus used a watering-hole chain with suspected CrossEX exploitation to launch a legitimate process, inject a ThreatNeedle variant, and compromise organizations in South Korea.