Lazarus Uses ML-KEM-1024 to Protect Malware Delivery

Kaspersky says the North Korean hacking group Lazarus has added post-quantum encryption to a malware delivery tool used in a campaign targeting South Korean organizations.

In its analysis of Operation FlashHole, Kaspersky's Global Research and Analysis Team (GReAT) says an updated version of LPEClient uses ML-KEM-1024 to protect the channel through which it downloads additional malware. The campaign has been active since at least July 2025 and targeted at least three organizations in software, construction, and wired communications equipment manufacturing.

Kaspersky says attackers used GitHub Pages sites for command and control. The researchers assess with medium-to-high confidence that spear-phishing emails directed targets to the sites, but could not determine exactly what triggered infection. The attack chain involved INISAFE CrossWeb EX, South Korean financial security software. How the software was abused remains unclear.

The updated LPEClient also routes traffic through a newly discovered loader called ClientHub, checks security products and Windows patch levels, and encrypts its report with GOST. It combines four ML-KEM-1024 shared secrets into a 128-byte key used by Threefish to decrypt another payload in memory. Kaspersky says the encryption protects data in transit; it does not conceal malware running on an infected system.

Kaspersky believes the campaign's résumé photo and website may have been generated with AI. The researchers say Lazarus's use of post-quantum cryptography appears to date back to at least September 2024.