Lazarus hackers use post-quantum cryptography for malware delivery

North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware.

The campaign targets South Korean organizations through a “rather complex” infection chain. Researchers at cybersecurity company Kaspersky dubbed the operation FlashHole and attributed it to the Lazarus Group.

Analysis of the malware revealed that the threat actor used the standardized ML-KEM post-quantum cryptographic mechanism to communicate with the command-and-control (C2) server for malware delivery.

Kaspersky says the attackers used LPEClient malware, previously associated with Lazarus, to receive ML-KEM-1024 public keys from its C2 infrastructure and generate shared keys that allowed it to decrypt subsequently incoming payloads.