Loading malware…
TechHub is a Windows downloader and host-profiling component used by the North Korea-linked Lazarus Group. Related to malware previously named CLOUDBURST and NickelLoader, it retrieves additional payloads, collects device and running-process information, executes shellcode in memory, and terminates processes. Variants support memory-only execution, DLL sideloading, and service-backed operation.
TechHub communicates through private GitHub repositories using personal access tokens and the GitHub API. It uses repository issues for session coordination and repository files for encrypted tasking and payload exchange. Its communication protocol combines RSA key exchange with AES-encrypted transfers and XOR-based initialization-vector handling.
TechHub plays an early-stage delivery role in Operation FlashHole, a Lazarus cyberespionage campaign observed since at least July 2025 against South Korean organizations in software development, construction, and wired communications equipment manufacturing. The infection chain abuses INISAFE CrossWeb EX to initiate execution through legitimate Windows software. TechHub downloads TouchHub, which installs TouchShift; TouchShift subsequently loads another TechHub instance into memory to retrieve ClientHub. This chain ultimately deploys LPEClient and the Cubridge orchestration component. Earlier TechHub variants also appeared in Lazarus Dream Job activity.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
TechHub downloads TouchHub from GitHub; a second TechHub instance retrieves ClientHub.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.