![Lazarus Malware Uses 4 ML-KEM-1024 Keys [2026]](https://shattered.io/wp-content/uploads/2026/10/lazarus-operation-flashhole-ml-kem-1024-post-quantum-malware-2026-gen.webp)
North Korea’s Lazarus Group has started wrapping its malware downloads in post-quantum cryptography, and security researchers say the same campaign leans on lures that may have been polished with AI. The finding comes from Kaspersky’s Global Research and Analysis Team (GReAT), which named the activity Operation FlashHole, and the report as published on Yahoo Tech carries the headline that Lazarus is not just using AI but also “post-quantum” encryption. Today, October 30, 2026, that story is spreading fast across the security press.
The core facts are narrow and specific. The campaign has been active since at least July 2025. It hit at least three South Korean organizations in software, construction and wired communication equipment manufacturing. And an updated version of LPEClient, a long-running Lazarus tool, now uses ML-KEM-1024 to set up a protected channel before it pulls down more malware.
That detail matters because ML-KEM-1024 is a key-encapsulation scheme built to survive attacks from future quantum computers, the same class of algorithms that standards bodies are steering the world toward. Our earlier explainer on NIST IR 8547 and the 2035 cutoff for RSA and ECDSA covers why defenders are migrating. Now an espionage crew has adopted the same math for a very different job, which is hiding payload delivery from the people trying to catch it.
This analysis separates what the sources confirm from what the headlines imply. It walks through the cryptographic handshake, the infection chain, the AI evidence, the history behind the group, and what security teams should change this quarter. Note that the “AI” half of the headline is thinner than the “post-quantum” half, and the sections below show exactly how thin.
Don't miss new tech stories on Google
Add Shattered once in the Google app and our stories show up in your news suggestions.
What Kaspersky Found in Operation FlashHole #
Kaspersky’s GReAT team attributed Operation FlashHole to the Lazarus Group, the North Korea-linked threat actor that has run financially motivated and espionage operations for years. The team’s technical write-up, published on Securelist, is titled “Lazarus breaks security, defies control.” Kaspersky also issued a press release that frames the campaign as one that uses both AI and post-quantum encryption.
The campaign has run since at least July 2025, so the activity predates the public disclosure by well over a year. Kaspersky counted at least three South Korean organizations as targets. The victims sit in three sectors: software, construction, and wired communication equipment manufacturing. That mix suggests the operators care about supply-chain reach and access to engineering environments rather than a single industry, though Kaspersky’s public material does not state the group’s motive in those terms.
SC Media ran a short brief under the headline Lazarus Group adopts post-quantum encryption in new cyberattacks, and the framing there matches Kaspersky’s own. The common thread across outlets is the cryptography. Almost every write-up leads with ML-KEM-1024 because it is the first time this particular crew has been publicly tied to a NIST-standardized post-quantum primitive.
The tooling is not new. LPEClient is described in the reporting as a tool associated with the Lazarus Group, and the update changes how it talks to its command-and-control (C2) server, not what it fundamentally does. Earlier versions profiled infected machines and fetched more malware. The refresh keeps that job and swaps in a modern key exchange to protect the download.
Fact Check: What Is Confirmed and What Is Not #
Headlines about this story compress a lot of nuance. The table below sorts each major claim by how well the available reporting supports it. We rely on Kaspersky’s findings as relayed by the outlets named in each row.
| Claim | Status | What the reporting supports |
|---|---|---|
| Lazarus Group is behind Operation FlashHole | Attributed by Kaspersky | Kaspersky GReAT made the attribution, per Kaspersky and SC Media |
| Active since at least July 2025 | Confirmed in reporting | Earliest known evidence dates to July 2025, per Cybersecurity News |
| At least 3 South Korean organizations targeted | Confirmed in reporting | Software, construction and wired communication equipment sectors |
| LPEClient uses ML-KEM-1024 | Confirmed | Kaspersky reported post-quantum cryptography in the malware’s communications |
| Four ML-KEM-1024 public keys, four shared secrets, one 128-byte Threefish key | Confirmed | Technical detail from Kaspersky’s analysis |
| An image on one résumé page may be AI-generated | Confirmed as a possibility | Researchers noted signs of AI generation, not proof |
| North Korean hackers broadly use AI in new campaigns | Unconfirmed as stated | Reporting confirms suspected AI use in specific campaign material only |
| The entire campaign or all Lazarus operations use post-quantum encryption | Unconfirmed | The cryptography appears in the LPEClient delivery step, not everywhere |
Two rows deserve emphasis. First, the AI evidence is limited to indications on one résumé page, and the researchers themselves framed it as possible. Second, the post-quantum layer protects one stage of the chain. Readers should not picture every Lazarus payload shielded by lattice-based math.
How LPEClient Uses ML-KEM-1024 Post-Quantum Encryption #
ML-KEM is a key-encapsulation mechanism. It lets two parties agree on a shared secret over a public channel, and that secret then feeds ordinary symmetric encryption. According to Cybersecurity News, NIST standardized the method in FIPS 203 and lists ML-KEM-1024 as one of its parameter sets. The same outlet stresses an important point: using it does not mean the attackers hold a quantum computer. The scheme is designed to resist attacks from future quantum machines, and that is all.
Four keys, four secrets, one 128-byte key
The handshake in the updated LPEClient runs in a specific order. The C2 server sends the implant four ML-KEM-1024 public keys. LPEClient derives four shared secrets from them. It then combines those four secrets into a single 128-byte key. That key drives Threefish, which decrypts the next payload. Cybersecurity News adds that LPEClient sends related ciphertexts back through ClientHub and that the decrypted payload loads into memory.
| Step | Component | Action |
|---|---|---|
| 1 | C2 server | Sends four ML-KEM-1024 public keys to LPEClient |
| 2 | LPEClient | Derives four shared secrets from the keys |
| 3 | LPEClient | Combines the secrets into one 128-byte key |
| 4 | Threefish | Uses that key to decrypt the next payload |
| 5 | Payload | Loads into memory, which limits file-based traces |
Using four keys instead of one is an unusual design choice. The reporting does not explain the reasoning, so any theory is speculation. One plausible reading is that the operators want the final symmetric key to depend on several independent exchanges, which raises the cost of reconstructing it from partial captures. Treat that as an analyst’s guess, not a Kaspersky finding.
Why Threefish sits at the end of the chain
Threefish is a tweakable block cipher originally developed for the Skein hash function. It is a niche choice, since mainstream software far more often reaches for AES, and that rarity may make the cipher harder to match against common detection rules (an analyst’s inference, not a Kaspersky finding). Kaspersky’s work shows a pattern of mixing a standardized post-quantum front end with older or unusual symmetric pieces. Our primer on encryption versus encoding versus hashing explains why the symmetric layer is where the actual bulk protection happens.
The Infection Chain: Phishing, Résumés and Trusted Software #
The post-quantum handshake is only one link. According to Cybersecurity News, the campaign likely began with targeted phishing emails that pointed victims to tailored websites, including fake résumé pages and interior-design pages. Securelist found malicious links embedded in those sites and assessed that a visit may have started the infection. The researchers could not confirm every step of the initial compromise, so the role of each lure remains an assessment.
Reporting on Kaspersky’s findings also describes phishing material that involved purported employee identities and links to fake résumés. That fits a well-worn North Korean playbook of posing as job seekers or colleagues. What changes is the polish. A believable face on a believable page lowers the odds that a recipient hesitates before clicking.
After initial access, Cybersecurity News says the chain used legitimate Windows software and memory-based execution to limit traces on disk. The malware set included TechHub, TouchHub, TouchShift, ClientHub, LPEClient and Cubridge. TechHub helped deliver later components. Cubridge acted as a central operator that can load separate modules and plugins instead of shipping one large backdoor. That modular design lets attackers deploy only the capabilities a given device needs.
Securelist also reported that Lazarus abused CrossWeb EX, a financial security program used to access some South Korean banking and government websites. Securelist could not confirm exactly how the software was abused, only that malicious code ran under its process. Some components talked to their operators through legitimate platforms such as GitHub, while others used compromised websites or Dropbox. South Korean security teams have seen similar tactics before. Our coverage of the Bithumb, Daishin and Mirae Asset breaches shows how heavily regional financial firms are already under pressure.
The AI Angle: What the Evidence Actually Supports #
The AI claim is where headline and evidence diverge most. Cybersecurity News reports that researchers saw signs an image on one résumé page may have been generated with AI. Other reporting describes AI-tailored lure material. None of the available coverage shows AI writing the malware, choosing targets, or driving the C2 logic.
Kaspersky’s Sojun Ryu, a senior security researcher at GReAT, put the broader assessment this way in the company’s press release: “Our analysis of Operation FlashHole, along with evidence from previous investigations, suggests that the group is also bringing AI into its long-established playbook, a shift we have observed among other threat actors aligned with Lazarus.” The wording is careful. It says suggests, and it says the group is bringing AI into an established playbook, not rebuilding it.
So the supportable reading is modest. AI appears to help with the social-engineering surface, meaning images, personas and page content. That is consistent with how many threat actors use generative tools today, because the technology cuts the cost of producing convincing fakes at scale. It does not yet show a step change in Lazarus’s technical capability.
Defenders should still take the trend seriously. If the lures get better while the underlying chain stays the same, then user training that relies on spotting sloppy pages loses value. Controls that work regardless of lure quality, such as blocking risky downloads, isolating browsers, and monitoring child processes, gain value instead.
What Kaspersky’s Researchers Say #
Ryu framed the group’s overall trajectory in a quote carried by BackendNews: “Lazarus continues to expand its operations, launching new campaigns while introducing new tools and reworking familiar ones to meet its needs.” The sentence captures the FlashHole story well. LPEClient is a familiar tool that got reworked, not a brand-new implant.
On the cryptography, Ryu told readers in Kaspersky’s press release: “What deserves closer attention is Lazarus’s adoption of cryptography designed to withstand future quantum threats.” That is the sentence most outlets built their headlines on. It points to adoption of a defensive primitive by an offensive team as the thing worth watching, rather than any single stolen file or victim.
The Securelist report title itself, “Lazarus breaks security, defies control,” plays on the abuse of security software in the chain. Together the three statements give a consistent message from the vendor. The group evolves steadily, borrows from the defensive toolbox, and uses AI at the edges of its operations. We could not find additional named expert commentary in the verified material for this story, so this article does not add any.
Historical Context: From SyncHole to FlashHole #
Securelist assesses with medium-to-high confidence that Operation FlashHole connects to the earlier Operation SyncHole campaign, based on similarities in targeting and malware, according to Cybersecurity News. That link places FlashHole inside a longer run of Lazarus activity aimed at South Korean organizations and their software supply chains.
Cybersecurity News also points to earlier Lazarus activity involving South Korean security software and software vendor compromises. The pattern is consistent. The group finds software that many local organizations trust, then rides that trust to reach victims who would not open a random attachment. CrossWeb EX in this campaign fits the template.
What is new is the cryptographic layer. The FlashHole reporting also mentions other schemes in parts of the communications, including GOST and the SNOW algorithm, according to research notes compiled from Kaspersky’s reporting. The overall approach looks like layering. Different stages use different primitives, so a defender who breaks or bypasses one layer still faces another.
The July 2025 start date also tells a story about detection lag. A campaign that ran for more than a year before public disclosure means defenders in the affected sectors had little warning. Memory-resident payloads and trusted-process abuse made it harder for standard endpoint tools to flag the chain.
Classical vs Post-Quantum Channels for Malware #
To see what ML-KEM changes for an attacker, compare it with the classical key exchange most malware has used. The comparison below is qualitative and reflects general properties of each approach, not measurements from the FlashHole samples.
| Property | Classical key exchange (for example elliptic curve) | ML-KEM-1024 |
|---|---|---|
| Designed to resist quantum attack | No, a large quantum computer could break it in theory | Yes, that is its purpose |
| Standardization | Long established | NIST FIPS 203, per Cybersecurity News |
| Value to a malware operator today | Hides traffic from current analysts | Hides traffic and resists later decryption of captured data |
| Effect on network detection | Payload content invisible in transit | Same, plus unusual key sizes that can serve as a fingerprint |
| Implementation burden | Libraries widely available | Newer libraries, larger key material |
The practical edge for the attacker is the third row. If a defender records the C2 traffic today and hopes to break it years from now, a classical exchange might eventually fall. A post-quantum exchange closes that door. Whether Lazarus actually reasoned that way is unknown. The reporting does not say, and it is just as plausible that the team adopted ML-KEM because the libraries are now easy to get and because the novelty slows analysts.
Why Post-Quantum Encryption Alone Is Not a Threat Signal #
A reasonable worry is that defenders will start treating post-quantum traffic as suspicious. That would be a mistake, and coverage from eWeek includes a section arguing that post-quantum encryption alone is not a threat indicator. Cybersecurity News makes the same point: the concern is the use of the technique inside a broader chain that combines stealth, trusted software and staged delivery.
Legitimate software is adopting post-quantum key exchange too, as standards bodies push organizations to migrate before quantum computers arrive. If a network team flagged every ML-KEM handshake, it would drown in false positives and punish the organizations that are migrating on schedule.
The better signal is context. A process that has no business making outbound connections, a trusted application spawning an unexpected child, or a workstation reaching GitHub or Dropbox when it never has before are all stronger clues than the cipher suite. Behavior beats algorithm.
There is a second lesson. Encryption in transit blinds network inspection, so detection has to move to the endpoint, where the decrypted payload finally has to exist in memory. That is where memory scanning, behavioral rules and process lineage checks earn their keep.
Market and Industry Impact #
No loss figures, ransom demands or stock moves have been tied to Operation FlashHole in the sources we reviewed, so there is no dollar impact to report. The industry effect is about posture and vendor messaging. Security vendors that sell post-quantum readiness now have a concrete case study showing that adversaries adopt the same standards, which sharpens the argument that migration is a present-day concern and not a distant one.
For South Korean organizations in software, construction and communications equipment, the impact is direct. These sectors hold source code, build systems, design documents and supplier relationships that make them stepping stones to larger targets. Endpoint detection vendors will likely add detections for the LPEClient behaviors and the abused-process patterns, and managed detection providers will push hunts for the indicators Kaspersky published.
For the wider market, the story reinforces a trend that our [security coverage](https://shattered.io/security/) keeps returning to: attackers adopt defensive technology quickly. Cryptographic agility, meaning the ability to swap algorithms without rebuilding systems, matters to both sides. Defenders who lack an inventory of where they use cryptography will struggle to migrate, while attackers carry no such legacy and can adopt new primitives in a single release.
The takeaway for buyers is simple. Ask vendors how their products detect memory-resident payloads, how they handle abuse of trusted processes, and whether their analytics rely on inspecting encrypted traffic content, since that content is exactly what this technique hides.
What Defenders Should Do Now #
The following actions come from the defensive suggestions in the reporting plus our own analysis. Cybersecurity News advises South Korean organizations to review the use and exposure of financial security software, keep it updated, and investigate unusual child processes or unexpected memory activity from trusted applications. It also suggests looking for suspicious use of GitHub or Dropbox on systems that do not normally need them.
| Priority | Action | Why it matters |
|---|---|---|
| 1 | Inventory and patch financial and security plug-ins such as CrossWeb EX | Securelist saw malicious code running under that program’s process |
| 2 | Alert on unusual child processes from trusted apps | The chain abuses legitimate software and runs mainly in memory |
| 3 | Flag GitHub and Dropbox traffic from hosts that never use them | Some components used these services for communications |
| 4 | Hunt published indicators and suspicious domains | Securelist listed hashes, domains and C2 URLs |
| 5 | Add memory scanning to endpoint policy | Decrypted payloads load directly into memory |
| 6 | Re-train staff on résumé and identity-based lures | Phishing used purported employee identities and fake résumé links |
Fold it into routine vulnerability work
None of this requires a new program. Teams already tracking exploited flaws can add these hunts to existing cycles, and our walkthrough on vulnerability management with KEV, EPSS and OSV shows how to automate the prioritization step. The goal is steady coverage of trusted-software abuse, since that is the weak point this crew keeps probing.
Predictions: Five Calls for the Next 12 Months #
These are our analyst judgments, not claims from Kaspersky or any quoted source.
- More groups will copy the pattern. Once one espionage crew ships ML-KEM in a , others tend to follow, because the libraries are public and the cost is low.
- Vendors will publish post-quantum handshake detections. Expect rules that fingerprint unusual key-block sizes and handshake sequences, paired with endpoint behavior checks.
- AI-assisted lures will improve faster than the malware. The social-engineering layer is the cheapest place to apply generative tools, so expect more polished fake personas.
- South Korean sector advisories will follow. Regional agencies and industry groups often respond to Lazarus findings with guidance on trusted-software hygiene.
- Zero trust will extend to automation. As attackers blend into trusted processes, identity and process-level controls become the main line of defense, a theme in our piece onzero trust for AI agents .
Limits of the Reporting #
Several gaps remain. The public material does not name the three victim organizations. It does not say how much data, if any, left their networks. It does not quantify how many machines ran the updated LPEClient, and it does not provide independent attribution beyond Kaspersky’s own assessment, though the outlets we reviewed relay that attribution consistently.
The AI evidence is the weakest link, as covered above. The statement that an image may be AI-generated is a possibility the researchers flagged, so any article that says Lazarus conclusively used AI for its whole campaign overstates the record. The same caution applies to quantum claims. Nothing in the reporting suggests the group has quantum capabilities.
We also did not find named expert commentary beyond Kaspersky’s own researchers. Independent analysts will likely weigh in over the coming days, and this article will need updating if they contradict any detail.
FAQ: Lazarus, Operation FlashHole and Post-Quantum Malware #
What is Operation FlashHole?
It is the name Kaspersky’s GReAT team gave to a campaign it attributes to the Lazarus Group. The campaign has been active since at least July 2025 and hit at least three South Korean organizations in software, construction and wired communication equipment manufacturing.
What is ML-KEM-1024 and why does it matter here?
ML-KEM-1024 is a post-quantum key-encapsulation mechanism designed to resist attacks from future quantum computers. Updated LPEClient uses it to establish a protected channel before down more malware, which means network defenders cannot read the payload in transit.
Does this mean North Korea has a quantum computer?
No. Cybersecurity News states plainly that using the method does not mean the attackers have a quantum computer. They are using a defensive standard to protect their own traffic.
How did the attackers use AI?
The confirmed evidence is limited. Researchers noted signs that an image on one fake résumé page may have been generated with AI. Kaspersky’s Sojun Ryu said the group appears to be bringing AI into its established playbook, but the sources do not show AI writing malware or running the operation.
How does the encryption handshake work?
The C2 server sends LPEClient four ML-KEM-1024 public keys. The implant derives four shared secrets and merges them into a 128-byte key. That key powers Threefish, which decrypts the next payload before it loads into memory.
Should I block all post-quantum traffic?
No. Legitimate browsers and services are adopting post-quantum key exchange, and eWeek’s coverage argues the encryption alone is not a threat indicator. Focus on suspicious process behavior, unexpected GitHub or Dropbox use, and memory-resident payloads.
Who is at risk right now?
Based on the reporting, organizations in South Korea’s software, construction and communications equipment sectors face the most direct exposure, especially those using the financial security software abused in the chain. Other organizations should treat the techniques as a preview of where nation-state tooling is heading.