- Kaspersky says Lazarus's Operation FlashHole, active since at least July 2025, hit at least three South Korean software, construction, and telecom equipment firms
- An updated LPEClient tool uses four ML-KEM-1024 key exchanges to protect payload delivery, a design Check Point also documented
- The post-quantum layer guards traffic against future decryption, not endpoint detection, and the most likely way in for the hackers was still phishing
North Korea's most notorious hacking group has been caught protecting its malware with the same post-quantum cryptography that governments and tech firms are still rolling out to safeguard their own data.
In its analysis of a campaign dubbed Operation FlashHole, Kaspersky's Global Research and Analysis Team (GReAT) says an updated version of LPEClient, a Lazarus Group tool, now uses ML-KEM-1024, a key exchange mechanism designed to resist attacks from future quantum computers, to secure the channel it uses to download more malware.
The findings describe a campaign active since at least July 2025 that has hit at least three South Korean organizations in the software, construction, and wired communication equipment manufacturing sectors.
A fake AI-tailored résumé, a mandatory plugin, and quantum-resistant encryption
The way in was familiar: Kaspersky found a GitHub Pages site tied to a GitHub account, created in September 2025, that the attackers used for command and control. The site first showed the résumé of a supposed senior network appliance developer, likely seen by an employee of the communications equipment maker, before the attackers swapped it in January 2026for an interior design showcase that probably targeted the construction firm.
Kaspersky assesses with medium-to-high confidence that targets received spear-phishing emails linking to these sites, which loaded JavaScript from attacker-controlled domains, though it could not determine exactly what triggered the infection.
From there, the chain ran through INISAFE CrossWeb EX, financial security software South Koreans need in order to use many online banking and government websites. How it was abused is unclear, but the malware ended up running in memory with elevated privileges, spawned by a CrossWeb EX build released in 2023 after a public advisory from South Korea's KrCERT.
That is a well-trodden route; Kaspersky says Lazarus abused CrossWeb EX in 2021, 2022, and 2023, and in Operation SyncHole, disclosed in April 2025, it used Cross EX, a related program, to compromise at least six organizations, and we also reported on the group exploiting a zero-day in MagicLine4NX, another South Korean authentication tool.
Kaspersky believes the photo on the résumé site was AI-generated, citing missing EXIF metadata and an unnatural texture, and that AI most likely built the site too, given a candidate name resembling Korea's equivalent of "John Doe" and a portfolio stuffed with filler details and unrelated companies.
ojun Ryu, senior security researcher at Kaspersky GReAT, said the findings suggest Lazarus is "bringing AI into its long-established playbook," a shift Kaspersky has also seen among other Lazarus-aligned groups. That fits a broader pattern, from Kimsuky using ChatGPT to forge a South Korean military ID to North Korean IT workers using generative AI to get hired at Western firms.
The more striking change is inside LPEClient, a profiling and payload delivery tool that first appeared in 2019. The new version no longer stores its own server address; instead, it relays traffic through ClientHub, a newly discovered loader with a variant that talks to its operators via Dropbox. It profiles installed security products and the Windows patch level, now also checks whether protections such as Shadow Stack are enabled, and encrypts that report with GOST, Russia's national cipher standard.
A security-conscious hacker group?
Then comes the post-quantum part of the equation. The server sends four ML-KEM-1024 public keys, LPEClient derives four shared secrets from them, and those are combined into a single 128-byte key for Threefish, a tweakable block cipher originally built for the Skein hash function. That key decrypts the next payload, which is loaded straight into memory.
ML-KEM-1024 is the strongest of three parameter sets in NIST's FIPS 203 standard, and the one the NSA specifies for key establishment under CNSA 2.0, its algorithm suite for US national security systems. Kaspersky's report notes, with some irony, that the group seems to have "adopted more secure post-quantum cryptography faster than many legitimate security products."
Ryu said the part that "deserves closer attention" is the group's "adoption of cryptography designed to withstand future quantum threats," which Kaspersky traces back to at least September 2024. If that holds, Lazarus was using the technology within weeks of NIST finalizing its first post-quantum standards on August 13, 2024, and more than two years before this month's disclosure.
Kaspersky is not the first to spot this, either. In August 2026, Check Point Research described a module in a separate Dream Job wave against defense companies that fetched four public keys from its server and used Kyber/ML-KEM to agree on a key to download FudModule, a rootkit that exploited the since-patched Windows zero-day CVE-2026-68820. Kaspersky identifies the module as LPEClient, and the campaign received widespread coverage at the time.
No publicly known quantum computer can yet break the classical key exchanges that protect most internet traffic, so ML-KEM only gives Lazarus an edge if someone records its traffic today and decrypts it once such a machine exists- the "harvest now, decrypt later" scenario driving the civilian migration.
For a state espionage operation whose opponents include well-funded intelligence agencies, keeping its tooling sealed against that possibility is a rational, if forward-looking, choice. Kaspersky's own reading is that the group wants to hide its later-stage payloads.
It does not, however, hide the malware where it runs; the post-quantum layer protects data in transit, and Kaspersky's analysis of the malware itself laid the whole exchange bare. Kaspersky says the work points to a dedicated developer, and the rest of the toolkit supports that view: ClientHub uses the SNOW stream cipher, a first for Lazarus according to Kaspersky, and copies headers sent by Chromium-based browsers to blend in.
Kaspersky believes the focus on software firms, the only sector hit in both SyncHole and FlashHole, reflects an appetite for source code that can be mined for new vulnerabilities. It also distinguishes FlashHole's espionage from a parallel cluster of attacks built on Lazarus's COPPERHEDGE backdoor that appears to be about making money.
For potential defenders, the lesson is the delivery rather than the cryptography: a convincing fake résumé and a trusted security plugin. Kaspersky's advice, which also promotes its own products, covers verifying unexpected links even when they lead to polished professional sites, patching quickly, removing unneeded components, restricting user privileges, and watching connections to cloud services such as GitHub and Dropbox that can double as command channels.
Since the post-quantum layer does nothing to hide what the malware does on the machine itself, capable endpoint protection software remains the realistic place to catch it. Whether its newly-found AI-assisted approach is a game changer, however, remains to be seen.
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.
