Operation SyncHole: Lazarus APT goes back to the well

Kaspersky describes “Operation SyncHole”, a Lazarus-led APT campaign (Nov 2024–Feb 2025) targeting South Korean organizations via watering‑hole redirects and exploitation of local software (Cross EX and Innorix Agent) to deploy modular backdoors and loaders (ThreatNeedle variants, SIGNBT, wAgent, COPPERHEDGE, Agamemnon). The actors leveraged supply‑chain and zero‑day/one‑day vulnerabilities for initial access and lateral movement, used compromised Korean websites as C2, and the report provides detailed TTPs, IOCs, and vendor/agency disclosures and patches.