Loading malware…
TouchHub is a Windows malware installer used by the North Korea-linked Lazarus Group in Operation FlashHole, a cyberespionage campaign active since at least July 2025. The campaign affected South Korean organizations in software development, construction, and wired communications equipment manufacturing. TouchHub serves as the parent installer for TouchShift and establishes a persistent execution chain for additional malware.
Deployed by TechHub through a private GitHub repository, TouchHub copies a legitimate Windows executable, places the TouchShift DLL alongside it for DLL sideloading, and writes configuration data for TechHub. It creates and immediately starts a Windows service configured to execute with SYSTEM privileges. TouchShift subsequently loads another TechHub instance into memory, enabling deployment of later campaign components. TouchHub disguises its service using a modified legitimate service name and a Microsoft-like description, and manipulates file timestamps to hinder forensic analysis.
TouchHub's established role is payload installation and persistence; broader espionage functions are provided by other components in the FlashHole framework.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.