Security experts warn North Korean hackers aren't just using AI in their new campaigns, but also 'post-quantum' encryption
North Korea's Lazarus is wrapping malware delivery in ML-KEM-1024, the NSA's pick for national security systems, but it won't hide the malware itself.
Kaspersky reports that North Korean hacking group Lazarus has incorporated post-quantum encryption into its latest cyber campaign, dubbed Operation FlashHole, which has targeted South Korean software, construction, and telecommunications firms since at least July 2025. The attackers use an updated LPEClient tool that employs ML-KEM-1024, a key exchange mechanism designed to withstand future quantum computer attacks, to secure the channel for downloading additional malware.
The group's decision to incorporate post-quantum cryptography appears to be a forward-looking strategy, as no quantum computer currently exists that can break classical key exchanges used for internet traffic. This move allows Lazarus to keep its tooling secure against potential future decryption attempts from more powerful adversaries.
Written by urgent.news from TechRadar's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
