Loading malware…
ClientHub is a modular Windows backdoor and payload-loading component used by the North Korea-linked Lazarus Group in Operation FlashHole, a cyberespionage campaign active since at least July 2025. Identified victims include South Korean organizations in software development, construction, and wired communications equipment manufacturing. ClientHub is deployed by TechHub within a multistage infection chain and provides communications and payload-delivery services for LPEClient.
ClientHub has variants that communicate over HTTP(S) with attacker-controlled infrastructure or through the Dropbox API. It uses SNOW 1.0 encryption, RSA-protected session material, and Chromium-like request headers. Its command interface supports reflective payload loading, invocation, unloading, and shared-buffer communication with loaded components. Associated plugins support file collection, metadata enumeration, ZIP archiving, file deletion, and monitoring of drive and remote-session changes.
LPEClient uses ClientHub as a communications intermediary to transmit victim-profiling information and receive additional payloads. ClientHub also relays ciphertexts generated during LPEClient's ML-KEM-1024 key establishment; the post-quantum key-establishment implementation belongs to LPEClient rather than ClientHub itself. This separation allows payload components to communicate without embedding their own command-server addresses.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
ClientHub is a previously undocumented backdoor with HTTPS-based and Dropbox API-based communication variants.
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.