Loading malware…
TOUCHSHIFT is a Windows malware loader associated with the North Korea-linked Lazarus Group and documented in UNC2970 operations. It is used across multiple infection chains to execute additional payloads and support persistent access. Payloads delivered through TOUCHSHIFT include keyloggers, screenshot utilities, backdoors, and other loaders.
In Operation FlashHole, TOUCHSHIFT forms part of a service-backed persistence chain. TouchHub installs it alongside a legitimate Windows executable and registers a service that causes the executable to load TOUCHSHIFT through DLL sideloading. TOUCHSHIFT derives an AES key from its launch argument, a hardcoded XOR key, and the hosting executable's name. It then decrypts an embedded TechHub payload using AES-CBC-128 and loads it into memory. This restores a multistage chain that subsequently deploys ClientHub, LPEClient, and the Cubridge orchestration component. Encrypted payload storage and in-memory execution help conceal the later-stage malware.
Operation FlashHole targeted South Korean organizations in software development, construction, and wired communications equipment manufacturing, with activity traced to July 2025. Earlier TOUCHSHIFT variants also appeared in Lazarus Dream Job activity during 2022–2023.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
TouchHub launches TOUCHSHIFT, identified as "mscoree.dll," to establish persistence through another in-memory TechHub instance.
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.