North Korean Hackers Use Post-Quantum Encryption to Hide New Malware From Security Tools

North Korean-linked Lazarus hackers are using post-quantum cryptography in a malware delivery chain designed to conceal later-stage payloads from security tools.

The technique appeared in Operation FlashHole, a campaign targeting organizations in South Korea. Instead of relying on encryption alone to hide files on disk, the malware uses a modern key-establishment method to protect payloads sent from its command-and-control infrastructure.

The campaign’s infection chain combines phishing, trusted South Korean software, several malware families and code that runs mainly in memory.

At least three organizations in the software, construction and wired communications equipment sectors were affected, according to Kaspersky’s investigation. The researchers say the operation’s earliest known evidence dates to July 2025.

Analysts from Securelist identified the malware and named the activity Operation FlashHole. Their report describes Lazarus abusing CrossWeb EX, a financial security program used to access some South Korean banking and government websites.

Securelist could not confirm exactly how the software was abused, but traced the chain to malicious code running under its process.

This echoes earlier Lazarus activity involving South Korean security software and software supply chains. For more background, see this report on Lazarus malware in supply chains.

North Korean Hackers Use Post-Quantum Encryption

The campaign likely began with targeted phishing emails that directed victims to tailored websites, including fake résumé or interior-design pages.

Securelist found malicious links embedded in these sites and assessed that visiting them may have started the infection process. The researchers also noted signs that an image on one résumé page may have been generated using AI.

They could not confirm every step of the initial compromise, so the precise role of each lure remains an assessment rather than a proven account.

After initial access, the chain used legitimate Windows software and memory-based execution to limit the traces left on disk. The malware set included TechHub, TouchHub, TouchShift, ClientHub, LPEClient and Cubridge.

TechHub helped deliver later components, while other tools supported persistence, system profiling and payload delivery. Cubridge acted as a central operator, able to load separate modules and plugins instead of relying on one large backdoor.

This modular design matters because it can let attackers deploy only the capabilities needed on a particular device. Securelist describes tools that can collect system and process details, search files, and steal browser data such as stored passwords, cookies, bookmarks and browsing history.

Researchers also found that some components communicated through legitimate platforms such as GitHub, while others used compromised websites or Dropbox.

A previous Lazarus software vendor compromise shows why campaigns involving trusted software and supply chains can affect organizations beyond the first victim.

How the post-quantum encryption fits

The most notable change is in LPEClient, a Lazarus malware family used to profile infected computers and deliver further payloads. In this campaign, LPEClient obtains four ML-KEM-1024 public-key blocks from its command-and-control server.

It uses them to establish shared keys, then sends related ciphertexts back through ClientHub. The resulting keys help protect the next payload during delivery and decryption.

ML-KEM is a key-encapsulation mechanism: it lets two parties establish a shared secret over a public channel, which can then be used with symmetric encryption. NIST standardized the method in FIPS 203 and lists ML-KEM-1024 as one of its parameter sets.

Its use does not mean the attackers have a quantum computer; the method is designed to resist attacks from future quantum computers.

Securelist reports that the malware uses the established keys with Threefish to decrypt a later payload, which is then loaded into memory. The report also describes techniques intended to interfere with security monitoring before that payload runs.

These details show why defenders should not treat post-quantum cryptography as a threat by itself: the concern is its use inside a broader chain that combines stealth, trusted software and staged malware delivery.

Organizations in South Korea should review the use and exposure of financial security software, keep it updated, and investigate unusual child processes or unexpected memory activity from trusted applications.

Security teams can also look for suspicious use of GitHub or Dropbox by systems that do not normally need those services, and correlate endpoint alerts with unusual web traffic. These checks are especially useful when malware runs largely in memory and leaves few files behind.

The wider lesson is that malware defenses need to examine behavior and context, not just known file signatures. Lazarus has combined targeted lures, legitimate software, browser-like network traffic and several layers of encryption.

Earlier reporting on Lazarus targeting drone companies offers another example of how the group uses tailored approaches against different sectors.

Securelist assesses with medium-to-high confidence that FlashHole is connected to the earlier Operation SyncHole campaign, based on similarities in targeting and malware.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.