Lazarus encrypts malware delivery with post-quantum ML-KEM

On October 21, 2026, Kaspersky revealed operation FlashHole: North Korea’s Lazarus Group uses ML-KEM-1024, the NIST-approved post-quantum standard, to encrypt C2 traffic and hide the final payload. Cryptography designed to survive quantum computers is now being used to blind today’s analysts: revisit your network detection if your threat model includes North Korea.