Lazarus Hackers Use Post-Quantum Cryptography to Deliver Malware

North Korean hacking group Lazarus is using advanced post-quantum cryptography to protect malware communications in a cyberespionage campaign targeting organizations in South Korea. According to cybersecurity researchers at Kaspersky, the campaign, tracked as Operation FlashHole, combines targeted phishing, malicious websites, legitimate software abuse, and sophisticated malware delivery techniques.

The discovery highlights how threat actors are adopting modern cryptographic technologies to make their malicious operations harder to monitor and investigate.

What Is Operation FlashHole?

Kaspersky researchers reported that Operation FlashHole has been active since at least July 2025. The campaign has affected at least three South Korean organizations operating in the software, construction, and wired communication equipment sectors.

The attackers reportedly used targeted phishing emails containing links to fake portfolio and résumé websites. These pages were designed to appear legitimate and potentially tailored to specific recipients.

Researchers also identified malicious activity involving GitHub Pages and private GitHub repositories. These services were abused to help host deceptive content and support communications used in the attack.

How Lazarus Used ML-KEM-1024

One of the most notable findings was the use of ML-KEM-1024, a post-quantum key encapsulation mechanism standardized by the US National Institute of Standards and Technology (NIST).

Unlike conventional encryption algorithms that directly encrypt large amounts of data, ML-KEM helps two parties establish shared secret keys over a communication channel. Those keys can then be used with encryption algorithms to protect data.

In the FlashHole campaign, an updated version of the LPEClient malware used ML-KEM-1024 to establish protected communications with the attackers’ command-and-control (C2) infrastructure before receiving additional malicious payloads.

Researchers also identified the use of GOST and Threefish cryptographic algorithms in different stages of the malware communication and payload-protection process.

Post-quantum cryptography is designed to resist attacks from sufficiently capable future quantum computers. However, its use by Lazarus does not mean the group has broken existing encryption or that quantum computers were involved in the attacks. Instead, the technology appears to be part of the group’s effort to protect its malware communications.

Phishing and Legitimate Software Abuse

The campaign reportedly used South Korea’s INISAFE CrossWeb EX software as part of its infection chain. The software is used for web authentication, and researchers suspect that a potential vulnerability or abuse of the software may have helped the attackers gain an initial foothold.

The exact infection process can vary, but the investigation identified a combination of deceptive websites, phishing, and malicious components designed to deliver additional payloads.

This approach is particularly concerning because attackers may exploit familiar software and trusted online services to make malicious activity blend in with normal business operations.

Malware Tools Identified by Researchers

Kaspersky documented several known and newly identified malware components associated with the campaign, including:

- LPEClient: Collects information about a compromised system and helps deliver additional malware.

- TechHub: A component involved in the multistage malware delivery process.

- ClientHub: Supports communication and coordination between components and the attackers’ infrastructure.

- TouchHub and TouchShift: Components associated with deploying additional malicious functionality.

- Cubridge: A modular backdoor used within the broader malware framework.

Some components were designed to execute primarily in system memory, reducing the number of files left on disk and potentially complicating forensic investigations.

The campaign’s ultimate objective was assessed as cyberespionage, including collecting information from targeted systems and maintaining communication with the operators.

Why Post-Quantum Cryptography Matters

The adoption of ML-KEM illustrates an important shift in cybersecurity: technologies developed to strengthen legitimate digital communications can also be adopted by malicious actors.

Post-quantum cryptography is not inherently dangerous. It is an important part of preparing digital infrastructure for future cryptographic threats. The risk comes from how attackers use these technologies alongside phishing, malware, and compromised systems.

Kaspersky also reported evidence suggesting Lazarus had used post-quantum cryptography in its operations as early as September 2024, indicating that the technique may not be limited to the latest campaign.

Nevertheless, cryptography does not make malware undetectable. Security teams can still investigate suspicious processes, unusual network connections, unauthorized software behavior, and other indicators of compromise.

How Organizations Can Protect Themselves

Organizations can reduce their exposure to campaigns like FlashHole by following several security practices:

1. Train employees to recognize phishing: Treat unexpected résumé, portfolio, document, and login links with caution.

2. Patch critical software: Keep operating systems, authentication tools, browsers, and business applications updated.

3. Monitor endpoint activity: Investigate unusual processes, suspicious memory activity, and unexpected outbound connections.

4. Restrict privileges: Give applications and user accounts only the access they need.

5. Review cloud-service usage: Monitor GitHub and other legitimate services for suspicious activity that could indicate command-and-control communications.

6. Maintain an incident response plan: Ensure security teams can investigate potential compromises and contain affected systems quickly.

Final Thoughts

Lazarus’s reported use of ML-KEM-1024 in Operation FlashHole demonstrates how sophisticated cyberespionage groups continue to evolve their techniques. By combining targeted phishing, legitimate software abuse, modular malware, and modern cryptography, attackers can make their operations more difficult to detect and analyze.

For defenders, the key lesson is to focus not only on encryption technologies but also on the broader signs of compromise, including suspicious links, unexpected software behavior, and unusual network communications.

Source: "Kaspersky’s analysis of Operation FlashHole" (https://securelist.com/lazarus-operation-flashhole/121541/) | "BleepingComputer report" (https://www.bleepingcomputer.com/news/security/lazarus-hackers-use-post-quantum-cryptography-for-malware-delivery/)