A state-linked hacking group has found an unexpected use for technology designed to protect the world from future quantum computers: hiding its own malicious code. Kaspersky researchers say the North Korea-linked Lazarus group is using ML-KEM-1024, a post-quantum encryption standard approved by the US National Institute of Standards and Technology, to encrypt communications between infected machines and its command-and-control servers. The campaign, dubbed Operation FlashHole, has targeted South Korean companies since July 2025.
A defensive technology repurposed for offense
ML-KEM, short for Module-Lattice-Based Key-Encapsulation Mechanism, was standardized to protect sensitive data against a looming threat known as "harvest now, decrypt later," in which adversaries collect encrypted data today in anticipation of cracking it once sufficiently powerful quantum computers exist. It is being adopted across browsers, messaging apps, and enterprise systems precisely because it is considered resistant to both classical and quantum attacks. Lazarus appears to have recognized a different advantage: if the encryption is strong enough to stop governments and corporations from being compromised, it is also strong enough to stop security researchers and antivirus software from inspecting malicious payloads in transit.
According to Kaspersky, the malware involved - a long-running Lazarus tool called LPEClient - receives ML-KEM-1024 public keys directly from its command-and-control infrastructure. The malware then generates shared keys from this exchange and uses them to decrypt payloads delivered afterward. In practice, this means that even if defenders intercept the network traffic, the actual malicious code remains unreadable without the corresponding private key material, which never leaves the attacker's infrastructure.
From a phishing link to memory-resident malware
The infection chain begins conventionally, with phishing pages steering victims toward specially crafted GitHub pages that load JavaScript hosted on external domains. From there, the attack moves almost entirely into memory, leaving fewer traces on disk. A legitimate South Korean security tool, INISAFE CrossWeb EX, is drawn into the process: its own execution launches fsquirt.exe, a genuine Windows utility, which is then used to run shellcode. That shellcode installs a downloader named TechHub, which pulls further malicious components from private GitHub repositories.
Kaspersky also documented a previously unseen loader, ClientHub, which communicates through Dropbox and exchanges data directly with LPEClient. Together, these tools profile victims, retrieve encrypted payloads, and work to stay beneath the radar of conventional monitoring tools. The technique of chaining legitimate software, cloud services, and custom malware is characteristic of Lazarus's broader playbook, which favors blending in with ordinary network traffic over conspicuous intrusion methods.
Layered encryption protecting a modular backdoor
The cryptographic design is more elaborate than a single encryption step. LPEClient receives a byte array from its server containing four separate 1,568-byte blocks, each holding an ML-KEM-1024 public key. From these, the malware derives four shared key pairs and ciphertexts, which are then encrypted again using the GOST algorithm before being relayed back through ClientHub. The resulting shared secrets supply key material for Threefish, a block cipher, which finally decrypts a response containing configuration parameters and an executable payload.
That payload is Cubridge, a modular backdoor capable of file management, command execution, reconnaissance, screenshot capture, and loading further malicious modules. LPEClient loads it reflectively, directly into memory, avoiding the creation of files that might be flagged by antivirus scanners. Kaspersky also found auxiliary tools designed to steal saved credentials, cookies, and browsing history from Chromium-based browsers, suggesting the campaign's goals extend beyond initial access toward sustained espionage.
Why the choice of encryption matters
Kaspersky has identified at least three affected organizations in South Korea, spanning software development, construction, and wired communications equipment manufacturing, though the firm cautions that the real number of victims is likely higher. Beyond the immediate intrusion, the episode carries a broader significance for the security industry. Post-quantum cryptography has been promoted largely as a protective measure for governments, banks, and infrastructure operators preparing for a future quantum threat. Its adoption by an advanced persistent threat group demonstrates that defensive innovations are rarely one-sided: any tool strong enough to shield legitimate communications can also shield malicious ones. For defenders, it signals that traffic analysis and signature-based detection will need to adapt, since standard encryption protocols are no longer a reliable indicator of benign activity.