North Korean Hackers Employ Post-Quantum Encryption to Evade Detection in New Malware Campaign
North Korean Lazarus hackers are leveraging post-quantum cryptography (ML-KEM-1024) in Operation FlashHole to conceal malware payloads and communications from security tools, targeting South Korean organizations.
North Korean-linked Lazarus hackers have been observed employing post-quantum cryptography (PQC) in a sophisticated malware delivery chain known as Operation FlashHole, designed to evade detection by modern security tools. This campaign, which has targeted organizations in South Korea since at least July 2025, marks a significant advancement in threat actor tactics by integrating cutting-edge cryptographic methods to protect their command-and-control (C2) infrastructure and malware payloads.
The attack chain begins with targeted phishing emails, often leading victims to malicious websites that may feature AI-generated content, such as fake résumé or interior design pages. These sites contain malicious links that initiate the infection process. Researchers noted that the campaign leverages trusted South Korean software, specifically the financial security program CrossWeb EX, to gain initial access and execute malicious code within its legitimate process, a tactic reminiscent of previous Lazarus operations involving software supply chains.
Following initial compromise, Operation FlashHole employs a multi-stage attack flow that prioritizes in-memory execution to minimize its digital footprint on infected systems. The malware toolkit includes several custom-developed families such as TechHub, TouchHub, TouchShift, ClientHub, LPEClient, and Cubridge. TechHub is used for delivering subsequent components, while others facilitate persistence, system profiling, and payload deployment. Cubridge acts as a central orchestrator, enabling a modular approach where attackers can load specific capabilities as needed, enhancing flexibility and stealth.
Components within the malware suite are capable of gathering sensitive system and process information, searching for specific files, and exfiltrating browser data, including stored passwords, cookies, and browsing history. Communication between malware components and C2 servers is varied, with some utilizing legitimate platforms like GitHub, while others rely on compromised websites or cloud storage services like Dropbox, further complicating detection efforts.
The most striking innovation in Operation FlashHole is the use of ML-KEM-1024, a post-quantum cryptography algorithm standardized by NIST. The LPEClient malware component retrieves public-key blocks from its C2 server, establishes shared keys using ML-KEM-1024, and then uses these keys to protect subsequent payloads delivered via ClientHub. This PQC implementation is not indicative of attackers possessing quantum computers but rather a proactive measure to safeguard against future quantum decryption capabilities.
The established PQC keys are then used in conjunction with the Threefish cipher to decrypt and load the final payload directly into memory. This technique, combined with other anti-analysis measures designed to interfere with security monitoring, makes traditional signature-based detection highly ineffective. The modular design and in-memory execution further obscure the malware's presence, leaving minimal traces on disk.
Kaspersky researchers, who identified and named the operation, reported that at least three organizations across the software, construction, and wired communications equipment sectors were affected. The campaign's connection to earlier Lazarus activities, such as Operation SyncHole, is assessed with medium-to-high confidence due to similarities in targeting and malware techniques.
Security recommendations for organizations in South Korea include rigorously reviewing the usage and exposure of financial security software, ensuring it is kept updated, and monitoring for unusual child processes or unexpected memory activity from trusted applications. Additionally, security teams should watch for suspicious use of platforms like GitHub or Dropbox by systems not typically authorized to use them, and correlate endpoint alerts with unusual network traffic. The broader implication is the necessity for malware defenses to focus on behavioral analysis and contextual understanding rather than solely relying on file signatures, as threat actors continue to evolve their evasion tactics.