Security experts warn that North Korean hackers are not only using AI in their new campaigns, but also ‘post-quantum’ encryption
follow us
Add us as a preferred source on Google
- Kaspersky says Lazarus’ Operation FlashHole, active since at least July 2025, affected at least three South Korean software, construction and telecommunications equipment companies.
- An updated LPEClient tool uses four ML-KEM-1024 key exchanges to protect payload delivery, a design also documented by Check Point.
- The post-quantum layer protects traffic against future decryptions, not endpoint detection, and the most likely way for hackers was still phishing.
North Korea’s most notorious hacking group has been caught protecting its malware with the same post-quantum cryptography that governments and tech companies are still deploying to safeguard their own data.
In its analysis of a campaign called Operation FlashHole, Kaspersky’s Global Research and Analysis Team (GReAT) says that an updated version of LPEClient, a Lazarus Group tool, now uses ML-KEM-1024, a key exchange mechanism designed to resist attacks from future quantum computers, to secure the channel it uses to download more malware.
The findings describe a campaign active since at least July 2025 that has affected at least three South Korean organizations in the software manufacturing, construction and cable communications equipment sectors.
Latest videos ofTechnologyRadar
An AI-friendly fake resume, a mandatory add-on, and quantum-resistant encryption
The way in was familiar: Kaspersky found a GitHub Pages site linked to a GitHub account, created in September 2025, that the attackers used for command and control. The site first displayed the resume of a supposed senior network device developer, likely seen by an employee at the communications equipment maker, before attackers swapped it in January 2026 for an interior design showcase that likely targeted the construction company.
Kaspersky assesses with medium to high confidence that targets received phishing emails directed to these sites, which loaded JavaScript from domains controlled by the attacker, although it could not determine exactly what triggered the infection.
From there, the chain went through INISAFE CrossWeb EX, the financial security software that South Koreans need to use many online banking and government websites. It’s unclear how it was abused, but the malware ended up running in memory with elevated privileges, generated by a CrossWeb EX build released in 2023 after a public notice from South Korea’s KrCERT.
That’s a busy route; Kaspersky says Lazarus abused CrossWeb EX in 2021, 2022, and 2023, and in Operation SyncHole, revealed in April 2025, it used Cross EX, a related program, to compromise at least six organizations, and we also reported on the group exploiting a zero-day in MagicLine4NX, another South Korean authentication tool.
Kaspersky believes the photo on the resume site was generated by AI, citing missing EXIF metadata and an unnatural texture, and that AI most likely built the site as well, given a candidate name resembling the Korean equivalent of “John Doe” and a portfolio filled with filler details and unrelated companies.
Ojun Ryu, senior security researcher at Kaspersky GReAT, said the findings suggest Lazarus is “bringing AI to its traditional playbook,” a shift Kaspersky has also seen among other Lazarus-aligned groups. This fits a broader pattern, from Kimsuky using ChatGPT to spoof a South Korean military ID to North Korean IT workers using generative AI to get hired at Western companies.
The most surprising change is within LPEClient, a payload delivery and profiling tool that first appeared in 2019. The new version no longer stores its own server address; instead, it transmits traffic through ClientHub, a newly discovered uploader with a variant that communicates with its operators through Dropbox. It profiles installed security products and Windows patch level, now also checks whether protections like Shadow Stack are enabled, and encrypts that report with GOST, Russia’s national encryption standard.
A group of hackers concerned about security?
Next comes the post-quantum part of the equation. The server sends four ML-KEM-1024 public keys, LPEClient derives four shared secrets from them, and they are combined into a single 128-byte key for Threefish, a modifiable block cipher originally created for the Skein hash function. That key decrypts the next payload, which is loaded directly into memory.
ML-KEM-1024 is the strongest of the three parameter sets in NIST’s FIPS 203 standard and the one that the NSA specifies for key establishment under CNSA 2.0, its set of algorithms for US national security systems. Kaspersky’s report notes, somewhat ironically, that the group appears to have “adopted post-quantum cryptography that is more secure and faster than many legitimate security products.”
Ryu said the part that “deserves the most attention” is the group’s “adoption of cryptography designed to resist future quantum threats,” which Kaspersky dates back to at least September 2024. If that’s true, Lazarus was using the technology just weeks after NIST finalized its first post-quantum standards on Aug. 13, 2024, and more than two years before this month’s disclosure.
Kaspersky is not the first to realize this either. In August 2026, Check Point Research described a module in a separate Dream Job wave against defense companies that obtained four public keys from their server and used Kyber/ML-KEM to agree on a key to download FudModule, a rootkit that exploited the since-patched Windows zero-day CVE-2026-68820. Kaspersky identifies the module as LPEClient and the campaign received wide coverage at the time.
No publicly known quantum computer can yet break the classical key exchanges that protect most Internet traffic, so ML-KEM only gives Lazarus an advantage if someone logs its traffic today and decrypts it once said machine exists—the “harvest now, decrypt later” scenario that drives civil migration.
For a state espionage operation whose opponents include well-funded intelligence agencies, keeping its tools sealed against that possibility is a rational, if forward-thinking, choice. Kaspersky’s own interpretation is that the group wants to hide its payloads at later stages.
However, it does not hide the malware where it runs; the post-quantum layer protects data in transit, and Kaspersky’s analysis of the malware itself exposed the entire exchange. Kaspersky says the work targets a dedicated developer, and the rest of the toolkit supports that view: ClientHub uses SNOW stream encryption, a first for Lazarus according to Kaspersky, and copies headers sent by Chromium-based browsers to embed them.
Kaspersky believes the focus on software companies, the only sector affected in both SyncHole and FlashHole, reflects an appetite for source code that can be mined for new vulnerabilities. It also distinguishes FlashHole spying from a parallel group of attacks built into Lazarus’ COPPERHEDGE backdoor that appear to be aimed at making money.
For potential defenders, the lesson is delivery rather than cryptography: a convincing fake resume and a reliable security plugin. The advice from Kaspersky, which also promotes its own products, covers checking for unexpected links even when they lead to polished professional sites, applying patches quickly, removing unnecessary components, restricting user privileges, and monitoring connections to cloud services like GitHub and Dropbox that can function as command channels.
Since the post-quantum layer does nothing to hide what the malware does on the machine itself, capable endpoint protection software is still the realistic place to detect it. However, whether its new AI-assisted approach is a game-changer remains to be seen.
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment