Kaspersky Finds Post-Quantum Cryptography in Lazarus Malware

Cryptography designed to withstand future quantum computers is already helping North Korean hackers protect malware delivery.

Kaspersky’s Global Research and Analysis Team (GReAT) disclosed Operation FlashHole on Oct. 21, attributing the cyberespionage campaign to the Lazarus group. Researchers identified at least three affected organizations in South Korea’s construction, software, and wired communication equipment manufacturing sectors.

According to Kaspersky’s technical report, the campaign dates back to at least July 2025. An updated Lazarus tool called LPEClient uses ML-KEM-1024, a post-quantum mechanism standardized by the US National Institute of Standards and Technology, to establish secret keys that protect additional malware delivered to infected systems.

For enterprise security teams, the implication extends beyond this campaign: stronger cryptography can protect attackers’ communications, too. Detecting the intrusion still depends on identifying suspicious activity around the encrypted exchange.

How FlashHole Uses Post-Quantum Key Exchange

Kaspersky describes the attack in stages:

• Lure: Kaspersky assesses that targets received spear-phishing emails linking to fabricated portfolio and CV websites tailored to them.
• Entry: Visiting a malicious site likely initiated an infection involving CrossWeb EX, financial security software widely used in South Korea. Researchers could not establish the exact trigger or how the software was abused.
• New tools: Two previously undocumented tools, TouchHub and ClientHub, install additional malware, execute commands on infected computers, and communicate with the attackers.
• Key exchange: The updated LPEClient receives four ML-KEM-1024 public keys and generates four shared secrets. These form the key used by the Threefish cipher to decrypt the next payload.

Referring to Lazarus’s broader use of post-quantum cryptography, Sojun Ryu, senior security researcher at Kaspersky GReAT, said: “Our findings trace its use back to at least September 2024, showing that these capabilities were already protecting the group’s malware communications more than a year before this disclosure.”

A Second Lazarus Campaign Using ML-KEM

FlashHole follows another Lazarus campaign that used the same standard. In August, Check Point Research reported that malware in an Operation Dream Job campaign it tied to Lazarus used Kyber/ML-KEM key exchange before downloading an exploit for a Windows zero-day, CVE-2026-68820. Microsoft patched the flaw on Aug. 11.

Both disclosures arrived as governments accelerated post-quantum migration. A June US executive order directs federal high-value assets and high-impact systems, excluding national security systems, to adopt post-quantum key establishment by Dec. 31, 2030, and digital signatures by Dec. 31, 2031.

Why Post-Quantum Encryption Alone Is Not a Threat Indicator

Post-quantum key exchange is now routine on legitimate networks. Cloudflare reported that the share of human-generated web traffic using post-quantum encryption on its network rose from 29% at the start of 2025 to 52% in early December. A post-quantum handshake alone tells a security team little.

Enterprise adoption varies by cryptographic function. MITRE’s September report, based on evidence collected in July 2026, found general-release post-quantum key-establishment support in five of six applicable technology categories, compared with two of eight for digital signatures. The signature figure measures a different capability from the key establishment used by Lazarus.

What eWeek Found: Stronger Encryption Still Leaves Evidence

FlashHole shows that stronger encryption and detectable intrusion activity can coexist. Kaspersky documented CrossWeb EX launching a legitimate Windows binary and malicious code executing in memory. Protecting payload delivery does not erase those surrounding activities.

Our assessment is that organizations should use the report to test their detection coverage. Can their security tools connect an unusual process launch with subsequent memory activity and suspicious communications? A useful test should examine the sequence, because neither encryption nor access to a legitimate cloud service establishes malicious intent by itself.

Post-quantum migration addresses a separate problem: protecting legitimate systems against future cryptographic attacks. A GAO audit publicly released in October found that only one of 24 major federal agencies had fully addressed its cryptography-inventory practice. However, the audit was completed in September 2025, so those findings should not be treated as a current readiness score.

For enterprise leaders, the practical implication is to pursue migration and intrusion detection together. Procurement teams should seek evidence that products provide the cryptographic functions they need, while security teams validate visibility into the systems using them. FlashHole does not demonstrate that post-quantum encryption makes malware undetectable; it illustrates why adopting stronger cryptography cannot substitute for detecting a compromised endpoint.

Read more: As attackers adopt post-quantum cryptography, Germany’s migration guidance sets out steps for organizations to inventory their cryptography and prioritize high-risk systems.