GoKawiilLazarus Group deploys post-quantum encryption in new malware campaign against South Korea
Kaspersky researchers identified a Lazarus Group operation, dubbed FlashHole, that uses the ML-KEM-1024 post-quantum cryptographic standard to secure communications between malware and its command-and-control servers. The campaign, active since July 2025, uses phishing pages linked to crafted GitHub sites to trigger a multi-stage infection chain involving tools like LPEClient, TechHub, and ClientHub, with at least three South Korean firms in software, construction, and telecom equipment confirmed as targets.