North Korean Hackers Use Post-Quantum Encryption to Hide New Malware

Key Takeaways

• North Korea’s Lazarus Group is deploying new malware that uses post-quantum encryption to evade detection.
• The “Operation FlashHole” campaign targets South Korean organizations across software, construction, and wired communications.
• The attack chain leverages phishing, legitimate South Korean software (CrossWeb EX), and memory-resident malware.
• The primary goal is stealthy payload delivery and data exfiltration, employing advanced encryption (ML-KEM-1024) to secure communications.

Lazarus Group Adopts Post-Quantum Encryption for Stealthy Malware Operations

The notorious North Korean state-sponsored hacking collective, Lazarus Group, has escalated its cyber espionage capabilities by incorporating post-quantum cryptography into its latest malware campaigns. Dubbed “Operation FlashHole,” this sophisticated effort aims to obscure critical later-stage payloads from conventional security defenses, marking a significant advancement in the group’s evasion tactics.

Unlike traditional methods that merely encrypt files at rest, the new technique employs a modern key-establishment protocol to secure payloads transmitted from its command-and-control (C2) infrastructure. This development was uncovered during an investigation into attacks primarily targeting organizations within South Korea.

Operation FlashHole: A Multi-Stage Attack

The infection sequence for Operation FlashHole is intricate, weaving together multiple techniques. It initiates with targeted phishing, exploits trusted South Korean software, deploys several distinct malware families, and extensively utilizes memory-resident code to minimize forensic artifacts.

According to Kaspersky’s findings, at least three organizations have been compromised, spanning the software development, construction, and wired communications equipment sectors. The earliest indications of this operation date back to July 2025.

Analysts from Securelist identified the malware and named the overarching activity Operation FlashHole. Their comprehensive report details how Lazarus is exploiting CrossWeb EX, a financial security application widely used for accessing South Korean banking and government portals. While the precise method of abuse for this legitimate software remains unconfirmed, researchers traced malicious code execution directly within its process. This mirrors previous Lazarus activities that have leveraged South Korean security software and supply chain vulnerabilities.

Advanced Evasion: Post-Quantum Cryptography at Play

The campaign likely begins with highly tailored phishing emails, directing victims to deceptive websites designed to mimic legitimate pages, such as fake résumé submission sites or interior design portfolios. Securelist discovered malicious links embedded within these sites, suggesting that merely visiting them could initiate the infection process. Researchers also noted the potential use of AI to generate images on some of these lure pages. The full initial compromise chain, however, remains an assessment rather than a fully proven sequence.

Following initial access, the attackers pivot to using legitimate Windows utilities and executing most of their malicious code in memory, effectively limiting disk-based indicators of compromise. The malware arsenal includes components like TechHub, TouchHub, TouchShift, ClientHub, LPEClient, and Cubridge. TechHub assists in delivering subsequent components, while others handle persistence, system profiling, and further payload deployment. Cubridge serves as a central orchestrator, dynamically loading various modules and plugins rather than relying on a monolithic backdoor.

This modular architecture provides attackers with significant flexibility, allowing them to deploy only the necessary capabilities for a given target. Securelist’s analysis revealed tools capable of collecting system and process information, searching for specific files, and exfiltrating sensitive browser data, including stored passwords, cookies, bookmarks, and browsing history. Furthermore, some components communicate via legitimate platforms such as GitHub and Dropbox, while others utilize compromised websites, further complicating detection.

The Role of ML-KEM-1024 in LPEClient

The most notable technological advancement observed in Operation FlashHole is the integration of post-quantum encryption within LPEClient, a Lazarus malware family traditionally used for system profiling and payload delivery. In this campaign, LPEClient retrieves four ML-KEM-1024 public-key blocks from its C2 server. These blocks are then used to establish shared keys, with corresponding ciphertexts sent back via ClientHub. The keys derived from this process are crucial for protecting the subsequent payload during its delivery and decryption phase.

ML-KEM, or Module-Lattice-based Key Encapsulation Mechanism, is a cryptographic algorithm designed to enable two parties to establish a shared secret over an insecure channel, which can then be used for symmetric encryption. The National Institute of Standards and Technology (NIST) standardized ML-KEM in FIPS 203, with ML-KEM-1024 being one of its specified parameter sets. It is important to note that the use of ML-KEM does not imply the attackers possess a quantum computer; rather, the method is engineered to withstand attacks from future quantum computing capabilities.

Securelist reports that the malware leverages these established keys with the Threefish block cipher to decrypt a subsequent payload, which is then loaded directly into memory. The report also details various techniques employed to disrupt security monitoring before this final payload executes. These findings underscore that post-quantum cryptography, while not a threat in itself, becomes a significant concern when integrated into a broader, multi-layered attack chain that combines stealth, trusted software, and staged malware delivery.

What You Should Do

• Review and Update Financial Security Software: Organizations in South Korea should meticulously review the usage and exposure of financial security software like CrossWeb EX. Ensure all such applications are fully updated to the latest versions.
• Monitor Process and Memory Activity: Investigate any unusual child processes or unexpected memory activity originating from trusted applications. This is critical given the malware’s preference for memory-resident execution.
• Audit Cloud Service Usage: Look for suspicious use of legitimate cloud platforms such as GitHub or Dropbox on systems that do not typically require access to these services.
• Correlate Endpoint and Network Data: Actively correlate endpoint alerts with unusual web traffic patterns. This holistic approach is essential for detecting malware that leaves minimal disk artifacts.
• Implement Behavioral Detection: Shift security defenses to focus on behavioral analysis and contextual understanding rather than solely relying on known file signatures. Lazarus Group’s tactics combine targeted lures, legitimate software, and layered encryption, necessitating a more sophisticated detection strategy.
• Employee Training: Reinforce employee training on identifying and reporting phishing attempts, especially those involving tailored content or fake websites.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.