Lazarus Unit of North Korea Uses Post‑Quantum Encryption in Fresh ‘Operation FlashHole’ Campaign

Security analysts are warning that the Lazarus cyber‑espionage team of North Korea has begun combining artificial‑intelligence methods with post‑quantum cryptography to protect its newest malware payloads. This step represents a significant rise in the group’s operational complexity and may make defending against it harder for the organizations it targets.

Kaspersky Lab traced the operation—named Operation FlashHole—to activity dating back to at least July 2025. Their probe connected the campaign to a minimum of three South Korean companies working in software development, construction, and telecom‑equipment fields. According to the report, the affected entities were breached via malicious payloads that employed the newly seen encryption techniques.

At the heart of the intrusion lies a revised LPEClient utility, now featuring four distinct ML‑KEM‑1024 key exchanges. ML‑KEM‑1024, a lattice‑based key‑encapsulation scheme, is thought to withstand attacks from forthcoming quantum computers. Embedding four simultaneous exchanges allows the malware to keep its command‑and‑control communications hidden, even against conventional decryption efforts.

Check Point Research confirmed Kaspersky’s observations, pointing out that the utility’s design seems intentionally engineered to merge AI‑guided payload selection with a post‑quantum protective layer. Although the team withheld further technical specifics, they stressed that pairing machine‑learning heuristics with quantum‑resistant encryption is a first among identified state‑sponsored threat groups.

Analysts caution that employing post‑quantum algorithms may extend the period needed for incident responders to reverse‑engineer the malicious code, possibly letting breaches remain hidden for longer. In addition, the AI component could let the malware modify its actions on the fly, customizing exploits to the particular environment of each target. Combined, these features increase the challenges for firms that depend on traditional security solutions.

Experts advise impacted organizations to focus on sharing threat intelligence, refresh detection signatures to recognize the new cryptographic signatures, and contemplate network‑level monitoring capable of spotting irregular key‑exchange traffic. As quantum‑resistant techniques become more widespread, security teams will have to revise their defensive playbooks to counter this emerging class of fortified malware.