Lazarus encrypts malware delivery with post-quantum ML-KEM
On October 21, 2026, Kaspersky revealed operation FlashHole: North Korea’s Lazarus Group uses ML-KEM-1024, the NIST-approved post-quantum standard, to encrypt C2 traffic and hide the final payload. Cryptography designed to survive quantum computers is now being used to blind today’s analysts: revisit your network detection if your threat model includes North Korea.
July 2025. Phishing pages begin redirecting South Korean targets to specially crafted GitHub pages, setting off a “rather complex” infection chain. October 21, 2026. Kaspersky publishes its analysis and names the operation FlashHole, attributing it to the Lazarus Group. Why it matters: the attacker uses ML-KEM-1024, the post-quantum key-encapsulation mechanism standardized by NIST, to encrypt C2 traffic and hide the final payload. Cryptography built to survive quantum computers is now being used to blind today’s analysts.
A defensive standard turned into an evasion tool
ML-KEM (formerly Kyber) is one of the public-key algorithms selected by NIST in its FIPS 203 standard, designed to withstand quantum computers capable of breaking RSA and ECDSA. Its adoption is universally framed as a defense against “hack now, decrypt later”: encrypt today with post-quantum cryptography so that, tomorrow, quantum decryption cannot reveal already-intercepted data. Chrome adopted it, Signal adopted it, Linux distributions ship it in OpenSSH.
Lazarus uses it for the opposite reason. The group is not trying to protect long-term data: it is using the mechanism to hide the final payload of its attacks. Kaspersky is explicit — “the use of post-quantum cryptography shows that the group intends to hide subsequent payloads.” The distinction is critical: an algorithm designed for confidentiality becomes an evasion tool, because the encrypted traffic it produces looks like nothing analysts know how to recognize.
The infection chain: from phishing to an in-memory payload
The mechanics deserve detail, because they explain why conventional detection fails. LPEClient, malware previously associated with Lazarus, receives from the C2 “a byte array comprising four 1,568-byte blocks,” each holding an ML-KEM-1024 public key. From those blocks, LPEClient generates four distinct pairs of shared keys and ciphertexts, encrypts the ciphertexts with the GOST algorithm, and transmits them to the C2 through ClientHub.
The shared secrets then feed Threefish, another encryption algorithm, which decrypts the response containing the parameters and the executable payload. The final payload is Cubridge, a modular backdoor that handles files, runs commands, performs reconnaissance, captures screenshots and loads further payloads. Companion tools target Chromium-based browsers to harvest credentials, cookies and browsing history.
Upstream, the infection chain is just as methodical. Phishing pages steer victims to GitHub pages that load JavaScript from external domains, triggering in-memory execution through INISAFE CrossWeb EX, a security tool popular in South Korea. That tool’s process executes the legitimate Windows binary fsquirt.exe, which runs shellcode that installs TechHub, a downloader that retrieves additional malware from private GitHub repositories.
Kaspersky identified at least three South Korean companies — in software, construction and wired communication equipment manufacturing — but suspects many more organizations were affected. Most of the code runs in memory; only persistence mechanisms leave files on disk. Kaspersky places FlashHole within the broader Cascade Hole activity and links it to operation SyncHole with “medium-to-high” confidence.
Why ML-KEM changes the game for defenders
The choice of ML-KEM is not a cryptographic detail: it is a choice of posture. Classic RSA or ECC key exchange leaves recognizable signatures — handshakes, key lengths, patterns that inspection boxes and analysts have read for two decades. ML-KEM traffic runs on high-dimensional lattices; the exchanges are short, dense and, crucially, impossible to derive without the private key — a key that seizing a C2 will not reveal, since it is never stored server-side beyond the ephemeral secret.
This is the exact inversion of the scenario the community expected. Post-quantum cryptography was imagined as the answer to a future threat — the quantum computer that would decrypt archives. Lazarus deploys it against a present threat — the analyst trying to read traffic today. The result for the defender is the same: an encryption layer that network probes can neither decrypt nor, often, distinguish from legitimate flow.
The shift fits a broader trend this blog tracks. Lazarus was already documented exploiting an afd.sys driver zero-day to drop its FudModule rootkit, and North Korea-aligned tools like ROOFDECK sign their commands with the operator’s private key. FlashHole adds one more piece: protection of the delivery itself, not just execution or command control.
The SyncHole precedent and the lineage of the operation
Kaspersky does not treat FlashHole as an isolated campaign. It places the operation within Cascade Hole and links it to Operation SyncHole — watering-hole attacks that already let Lazarus compromise six companies — with “medium-to-high” confidence. The lineage matters: it signals that ML-KEM is not a one-off experiment, but the evolution of an arsenal that professionalizes with every campaign.
The South Korean focus is no accident either. Lazarus has long concentrated on the peninsula and its supply chains, from cryptocurrency theft to industrial espionage. The abuse of INISAFE CrossWeb EX, a local security tool, shows granular knowledge of the Korean ecosystem — the kind of detail that only comes from long preparation. For a defender, that means detection cannot rest on generic signatures: it must fold in the published indicators and the geographic context.
What to do
The response does not play out purely at the network layer, but that is where it begins.
- If your threat model includes North Korea-aligned actors, reassess your ability to see encrypted C2 traffic: classic TLS inspection will not read ML-KEM, and detection must shift to metadata and behavior, not content.
- Prioritize the already-targeted sectors. South Korean software, construction and communication equipment teams — and their partners — should treat FlashHole as an indicator of ongoing activity, not a historical report.
- Hunt the published markers. LPEClient, ClientHub, TechHub, Cubridge and the abuse of INISAFE CrossWeb EX via
fsquirt.exeare published indicators: fold them into your endpoint and memory detection. - Watch private GitHub repositories as a staging channel. The TechHub downloader pulls payloads from private repositories: monitor outbound requests to GitHub from machines with no business connecting there.
The watch item is blunt: post-quantum cryptography is no longer a planning topic for the day after tomorrow. It is already an operational tool in an APT’s hands. For inspection and EDR vendors, the implication is the same: treat post-quantum key exchange as a first-class detection signal that is already live in the wild, not a roadmap item.
Verdict
If you operate inside the South Korean perimeter or your threat model covers Lazarus, treat FlashHole as a posture change, not an anecdote: ML-KEM encryption of the final payload neutralizes content inspection, and your detection must move to metadata, behavior and endpoint indicators. If your North Korea exposure is low, take the underlying lesson — an encryption standard built for defense is already being recycled into an offensive tool, and this repurposing is only beginning.