Lazarus wraps malware delivery in post-quantum encryption

North Korea’s Lazarus Group has been caught using a post-quantum key exchange to deliver malware to South Korean companies. Kaspersky’s researchers call the campaign Operation FlashHole and say it has been active since at least July 2025.¹²

The affected organizations include at least three firms in software, construction and wired communication equipment manufacturing, though Kaspersky suspects many more were hit.³²

How the encryption works. An updated version of the LPEClient tool asks its command server for four ML-KEM-1024 public keys. ML-KEM is the key exchange scheme NIST standardized to resist future quantum computers. LPEClient uses those keys to generate shared secrets, which then feed another cipher, Threefish, that unlocks the payload the server sends back.³ The payload is Cubridge, a modular backdoor that handles file management, command execution and reconnaissance, and it is loaded straight into memory.³

The same trick has turned up elsewhere. Check Point documented Lazarus malware negotiating its command channel with ML-KEM before pulling down a Windows zero-day exploit in a separate campaign against defense and aerospace firms.⁴ Two vendors seeing the same design suggests it is a deliberate habit, not a one-off experiment.

What this means for defenders. Less than the phrase “post-quantum” implies. The point of ML-KEM is to defeat “hack now, decrypt later” collection, where someone records encrypted traffic today and cracks it once quantum machines exist.³ That protects the channel. It does not make the malware invisible on the endpoint, and it does not change how an infection starts.¹

The start, as far as anyone can tell, was ordinary. Targets received spear-phishing emails linking to fake résumé and portfolio pages hosted on GitHub Pages, and those pages loaded JavaScript from attacker-controlled domains.¹² The chain then abused INISAFE CrossWeb EX, a security tool popular in South Korea, to run code in memory.³ Kaspersky could not pin down exactly what triggered the infection.¹

So the defensive playbook has not been rewritten. Watch for odd child processes spawned by trusted security software, scrutinize links to personalized pages from strangers, and hunt for in-memory activity. Kaspersky notes that persistence mechanisms still leave some files on disk, which gives hunters something to find.³ An encrypted download channel makes network inspection harder, but the endpoint still sees the payload run.

Seen it before: the lock on the delivery truck got better, and the delivery still arrives through the front door.

Kaspersky’s own read is that the encryption shows the group intends to hide subsequent payloads, and it places FlashHole within the broader Cascade Hole activity, linked to the earlier Operation SyncHole with medium-to-high confidence.³² The report also describes new tooling, including the ClientHub loader, which supports Dropbox communications and direct data exchange with LPEClient.³

Our read: The encryption is a good headline and a modest change. Attackers adopting standardized cryptography is predictable, since the schemes are public and well documented. What matters for a security team is that the early links in the chain, the phishing page and the abused local software, are still where this campaign can be caught. Hiding the delivery does not help much if the delivery was noisy to begin with. Watch whether further reports show more Lazarus tooling adopting ML-KEM, because that would make network-level detection steadily less useful.

Footnotes

1. TechRadar, “Security experts warn North Korean hackers aren’t just using AI in their new campaigns, but also ‘post-quantum’ encryption”. Retrieved October 30, 2026. ↩ ↩² ↩³ ↩⁴

2. Securelist, “Dissecting Operation FlashHole, a complex attack by Lazarus”. Retrieved October 30, 2026. ↩ ↩² ↩³ ↩⁴

3. BleepingComputer, “Lazarus hackers use post-quantum cryptography for malware delivery”. Retrieved October 30, 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸

4. Infosecurity Magazine, “Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day”. Retrieved October 30, 2026. ↩