Kaspersky found a NIST-supported post-quantum cryptographic algorithm employed in a cyberespionage campaign targeting software, construction, and communications equipment companies in South Korea.
Its use was identified in malware deployed by the North Korea-linked Lazarus hacking group, with attackers adopting quantum-resistant key establishment to protect the delivery of further malicious payloads.
The findings form part of Operation FlashHole, a cyberespionage campaign Kaspersky attributes to the group. Active since at least July 2025, it has affected at least three South Korean organizations, including a wired communications equipment manufacturer, according to the researchers. Kaspersky disclosed the findings on October 21.
The updated LPEClient malware uses ML-KEM-1024, a parameter set of the NIST-standardized post-quantum key encapsulation mechanism. Its role is to establish shared secrets used to protect subsequent payloads, rather than to encrypt those payloads directly.
Quantum-resistant keys in the delivery chain #
Kaspersky’s technical analysis describes LPEClient receiving four ML-KEM-1024 public keys from its command-and-control infrastructure. It generates shared secrets and corresponding ciphertexts, then returns the ciphertexts through another component, ClientHub.
The shared secrets provide key material for Threefish, the symmetric cipher used to decrypt a response containing parameters and an executable payload. The payload is then loaded directly into memory. Kaspersky identified the final payload as Cubridge, a modular backdoor.
“What deserves closer attention is Lazarus’s adoption of cryptography designed to withstand future quantum threats,” said Sojun Ryu, senior security researcher at Kaspersky’s Global Research and Analysis Team.
Kaspersky said it traced the group’s use of the technology to at least September 2024, showing that the capability predates the newly disclosed campaign.
Familiar lures, updated tools #
FlashHole combines the cryptographic update with targeted recruitment lures and abuse of legitimate software and cloud services.
Kaspersky described spear-phishing emails directing targets to fabricated portfolio and resume websites. One GitHub Pages site presented a purported senior network-appliance developer and included what researchers identified as an AI-generated photograph. They also suspect AI was used to tailor fraudulent websites to individual targets.
The suspected infection path involved CrossWeb Ex, security and web authentication software widely used in South Korea. Kaspersky said a potential vulnerability in the software could have provided an entry point, but did not confirm the initial infection mechanism.
Once running, LPEClient collects system and security information and receives further payloads through ClientHub. The technical report describes additional evasion attempts, including modifying memory protections and disabling a security-monitoring hook.
The attack chain also uses legitimate services to relay malicious activity. ClientHub includes a variant that communicates through Dropbox, adding another layer between the malware and its operators.