GoKawiilLazarus Group deploys post-quantum encryption in new malware campaign against South Korea
Kaspersky researchers identified a Lazarus Group operation, dubbed FlashHole, that uses the ML-KEM-1024 post-quantum cryptographic standard to secure communications between malware and its command-and-control servers. The campaign, active since July 2025, uses phishing pages linked to crafted GitHub sites to trigger a multi-stage infection chain involving tools like LPEClient, TechHub, and ClientHub, with at least three South Korean firms in software, construction, and telecom equipment confirmed as targets.
GoKawiil's interpretation of the reporting above, not reported fact.
The use of standardized post-quantum cryptography by a state-linked threat actor suggests nation-state hackers are adopting next-generation encryption to future-proof their command-and-control infrastructure against eventual quantum decryption capabilities. This could complicate detection and analysis efforts for defenders who rely on breaking weaker encryption to intercept malicious traffic, and may signal a broader shift among advanced persistent threat groups toward quantum-resistant tradecraft.
- Lazarus Group's FlashHole campaign uses ML-KEM-1024 post-quantum encryption to secure malware-to-C2 communications.
- The attack chain combines phishing, GitHub-hosted payloads, and a legitimate South Korean security tool to execute malware in memory.
- At least three South Korean organizations across software, construction, and telecom sectors have been confirmed as targets since July 2025.
Source: bleepingcomputer.com, 2026-10-21
Published there as: “Lazarus hackers use post-quantum cryptography for malware delivery”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.