Loading malware…
Cubridge is a modular Windows backdoor associated with the North Korea-linked Lazarus Group. It acts as the central orchestrator of a malware framework, retrieving and executing reusable plugins, additional modules, and standalone utilities. It has been deployed in Operation FlashHole, an espionage campaign with activity dating to at least July 2025 that affected South Korean organizations in software development, construction, and wired communications equipment manufacturing. Earlier variants were also used in Lazarus Dream Job activity.
Cubridge supports reflective DLL loading, DLL injection, and section-mapping injection. Its modules and associated tools provide command execution, system and process discovery, Active Directory reconnaissance, process manipulation, screenshot capture, file enumeration and collection, archiving, and file deletion. Browser-stealing functionality collects passwords, cookies, browsing history, bookmarks, settings, and other browser data from Google Chrome, Microsoft Edge, and Brave. Additional capabilities include Chromium encryption-key extraction, parent-process spoofing, session impersonation, and timestamp manipulation.
In the FlashHole infection chain, ClientHub and LPEClient deliver Cubridge for reflective execution in memory. LPEClient protects this delivery using ML-KEM-1024 key establishment and Threefish encryption; these mechanisms belong to the delivery component rather than Cubridge itself. Cubridge uses RSA and RC6 cryptography and browser-like HTTP headers for command-and-control communications, including communications through compromised legitimate websites. FlashHole used tailored résumé and portfolio lures in targeted phishing activity and abused INISAFE CrossWeb EX, although the precise initial compromise mechanism was not established.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Cubridge is the orchestration component of the malware framework, fetching plugins, modules, and tools.
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.