Lazarus deploys post-quantum encryption in South Korean cyberattacks

North Korean hackers have incorporated post-quantum cryptography into a cyberespionage campaign targeting South Korean organizations, as disclosed by cybersecurity researchers at Kaspersky's Security Analyst Summit in Bali. The operation, named Operation FlashHole, affected at least three organizations in software development, construction, and wired communications equipment manufacturing.

The earliest evidence of the campaign dates back to July 2025, although the extent remains unknown. Lazarus Group, responsible for the activity, employed ML-KEM-1024, a post-quantum key encapsulation mechanism, to encrypt malware deliveries and obscure malicious payloads. The distinct feature of the operation is the use of post-quantum cryptography, which is typically designed to resist attacks by powerful quantum computers, in the Lazarus malware LPEClient.

The malware obtained four public keys from an attacker-controlled server and generated shared secrets to encrypt further instructions and an executable payload. The final malware, Cubridge, a modular backdoor, was loaded directly into computer memory. The researchers traced Lazarus's incorporation of post-quantum cryptography capabilities back to at least September 2024, predating the public disclosure of FlashHole by more than two years.