North Korean Hackers Adopt Post-Quantum Encryption to Hide Malware

Upgrading LPEClient with post-quantum cryptography

Lazarus deployed quantum-resistant math to protect command-and-control pipelines rather than endpoints.

Kaspersky's Global Research and Analysis Team uncovered the implementation inside an updated variant of LPEClient, a profiling utility Lazarus has maintained since 2019. The operation, tracked as Operation FlashHole, has hit at least three South Korean companies across the software, construction, and telecommunications sectors since July 2025.

Instead of relying on standard RSA or basic elliptic-curve key exchanges, the LPEClient framework fetches four public keys to perform an ML-KEM-1024 key establishment. From there, the tool derives four shared secrets, bundles them into a 128-byte key, and uses the Threefish block cipher to decrypt incoming payloads straight into system memory.

ML-KEM-1024 represents the heaviest security tier under NIST's FIPS 203 standard, published in August 2024. It is also the exact key-establishment algorithm required by the US National Security Agency for its Commercial National Security Algorithm Suite 2.0. Check Point Research corroborated this architecture in August 2026, linking similar multi-key ML-KEM routines to the deployment of the group's FudModule rootkit.

Why Lazarus cares about future decryptors

No quantum machine exists today that can crack standard 2048-bit RSA or modern Diffie-Hellman keys. That makes Lazarus's cryptography choice look strange on the surface—until you consider who is intercepting their network traffic.

Western signals intelligence agencies routinely log encrypted enemy traffic across global backbones. In standard espionage operations, recorded traffic sits inside vast data lakes waiting for the day when quantum systems can decipher it, a strategy known as harvest now, decrypt later. By baking post-quantum cryptography directly into payload pipelines, Lazarus aims to permanently blind investigators who might otherwise unravel these custom implants decades down the line.

This level of long-term planning shows just how methodical state-sponsored actors have become, echoing how North Korean hackers drained billions from Binance using intricate operational engineering.

Familiar phishing hooks behind cutting-edge math

Despite the bleeding-edge cryptography protecting the payload pipe, the initial infiltration relied on plain human deception. The attackers directed victims to GitHub Pages hosting AI-generated resumes for senior network developers and interior design portfolios.

Once a target engaged, the infection chain exploited local quirks in South Korea's software ecosystem, specifically abusing vulnerable builds of INISAFE CrossWeb EX, a mandatory authentication plugin required for local online banking. Lazarus had already exploited related Cross EX packages in 2021, 2022, and 2023.

The post-quantum wrapper does nothing to mask malicious behavior once the code hits the operating system. Endpoint detection agents, behavior monitors, and memory scanners can still spot injected payloads regardless of how thoroughly the wire transfer was scrambled.

What it means for enterprise defense

For system administrators in the US and Europe, Lazarus's switch to ML-KEM does not require tearing up existing endpoint security playbooks. Because the quantum-resistant algorithm only guards network packets between the command server and the loader, standard host-level defenses like Credential Guard, behavioral anomaly detection, and strict application whitelisting remain entirely effective.

The real wake-up call is for network security teams relying strictly on perimeter traffic inspection. As threat actors rapidly adopt post-quantum cipher suites, inspecting outbound malicious payloads using legacy middleboxes will grow increasingly impractical.