Kaspersky Says Lazarus Uses Post-Quantum Crypto

A hacking group better known for fake job offers has started protecting its malware’s communications with encryption built to resist quantum computers, according to Kaspersky. The security company says an updated version of LPEClient, a tool it attributes to the Lazarus group, uses ML-KEM-1024 to set up an encrypted link with its operators’ server before pulling down further malware and running it in memory.

TSN tracks attacks like this on its ransomware and cyber attacks hub.

The finding comes from what Kaspersky’s Global Research and Analysis Team calls Operation FlashHole, presented at its Security Analyst Summit in Bali. In a press release, it describes “a cyberespionage campaign attributed to the Lazarus APT group”, active “since at least July 2025”, that has hit at least three organisations in South Korea in construction, software and communications equipment manufacturing. The attribution is Kaspersky’s own; the company says it rests on overlaps in targets, infection methods and tooling with earlier campaigns it linked to the group, and in particular on the reuse of LPEClient.

A fake résumé, and a photo Kaspersky says AI made

The attacks began with tailored spear-phishing, Kaspersky says. Targets received emails pointing to fabricated portfolio and CV sites hosted on GitHub Pages. One showed the résumé of a supposed senior network-appliance developer, with a photograph that Kaspersky’s researchers say was AI-generated, judging by its missing metadata and unnatural texture. In January the same site was replaced with an interior design showcase, which Kaspersky believes reached a target in the construction sector.

The company says the attackers “also used AI to tailor the fraudulent websites”, although its technical write-up on Securelist adds that the generated site was then adjusted by hand for each target. Visiting it most likely triggered an infection that ran through CrossWeb EX, security and web authentication software widely used in South Korea, possibly by way of a vulnerability in it. From there, Kaspersky traced a chain of old and new tools, including two it had not seen before, TouchHub and ClientHub. One ClientHub variant talks to its operators through Dropbox.

How the post-quantum step works

ML-KEM is a key-encapsulation mechanism standardised by the US National Institute of Standards and Technology in FIPS 203. In NIST’s words, it lets two parties “establish a shared secret key over a public channel”, which can then be used with conventional encryption. NIST says ML-KEM is “believed to be secure, even against adversaries who possess a quantum computer”, and ML-KEM-1024 is the strongest of its three versions.

According to Securelist, the updated LPEClient receives four 1,568-byte blocks from its command server, each holding an ML-KEM-1024 public key. It uses them to generate four shared keys, sends the matching ciphertexts back, and combines the four keys to decrypt the next response with a cipher called Threefish. The malware also uses GOST, Russia’s national encryption standard, elsewhere in the exchange, and tries to blind security tools by changing memory protections and disabling a monitoring hook.

Kaspersky’s researchers did not hide their surprise. “Ironically, the group seems to have adopted more secure post-quantum cryptography faster than many legitimate security products,” they write. Sojun Ryu, a senior security researcher at Kaspersky GReAT, said the company’s findings trace the group’s use of quantum-resistant cryptography “back to at least September 2024”, meaning it was protecting malware traffic “more than a year before this disclosure”.

Kaspersky counts three victims but thinks there are many more: it says it remains “confident that a considerably larger number of organizations across a broader spectrum of industries have been affected”. It also separates FlashHole, which it describes as espionage, from a parallel cluster of attacks on South Korea using a backdoor called COPPERHEDGE, which it says appears to be about making money. The quantum-resistant link, in other words, is guarding a spying operation whose full reach Kaspersky itself has not yet mapped.