North Korea's Lazarus Group Uses Post‑Quantum Encryption in New ‘Operation FlashHole’ Campaigns

Security analysts are warning that the Lazarus cyber‑espionage outfit of North Korea has begun combining artificial‑intelligence methods with post‑quantum cryptography to protect its newest malware payloads. This advancement signifies a substantial rise in the group’s operational complexity and may make defending against it harder for the organizations it targets.

Kaspersky Lab traced the campaign—named Operation FlashHole—to activity dating back to at least July 2025. Their probe connected the effort to a minimum of three South Korean companies working in software development, construction, and telecommunications equipment. According to reports, the compromised entities were infected by malicious payloads that employed the newly seen encryption techniques.

At the core of the intrusion lies a revised LPEClient utility, now featuring four distinct ML‑KEM‑1024 key exchanges. ML‑KEM‑1024, a lattice‑based key‑encapsulation scheme, is thought to withstand assaults from forthcoming quantum computers. Incorporating four simultaneous exchanges allows the malware to keep its command‑and‑control communications hidden, even when conventional decryption is attempted.

Check Point Research confirmed Kaspersky’s observations, pointing out that the utility’s design seems intentionally built to merge AI‑guided payload selection with a post‑quantum protective layer. Although the team withheld further technical specifics, they stressed that pairing machine‑learning heuristics with quantum‑resistant encryption is a first among documented state‑sponsored threat groups.

Specialists caution that employing post‑quantum algorithms may extend the period needed for incident responders to reverse‑engineer malicious code, possibly letting breaches remain hidden for a longer span. In addition, the AI component could let the malware modify its actions on the fly, customizing exploits to the particular environment of each target. Combined, these features increase the risk for firms that depend on traditional security solutions.

Analysts advise organizations hit by the campaign to focus on threat‑intel exchange, refresh detection signatures to recognize the new cryptographic signatures, and look into network‑level monitoring capable of spotting irregular key‑exchange traffic. As quantum‑resistant techniques become more widespread, security teams will have to revise their defensive playbooks to confront this emerging class of fortified malware.