North Korea-linked hacking group Lazarus incorporated a newly standardized, quantum-resistant cryptographic mechanism into its malware within weeks of its U.S. publication, according to cybersecurity firm Kaspersky, which traces the technique to at least September 2024.
- North Korea's Lazarus Group implements the US post-quantum cryptographic algorithm ML-KEM-1024 into custom malware targeting South Korean firms.
- The NIST standard FIPS 203 was published on August 13, 2024, with malware deployment traced to September 2024.
- Lazarus outpaces Western institutional adoption schedules as the National Security Agency sets final post-quantum compliance deadlines out to 2035.
The mechanism, ML-KEM-1024, is part of a post-quantum cryptography standard published by the National Institute of Standards and Technology (NIST) on Aug. 13, 2024. Kaspersky disclosed the finding on Oct. 21, 2026, alongside details of Operation FlashHole, a cyberespionage campaign targeting organizations in South Korea.
Lazarus Integrated the Standard Into Malware
Kaspersky researcher Sojun Ryu said the firm’s investigation traced Lazarus’ use of post-quantum cryptography to at least September 2024, more than a year before the Operation FlashHole findings became public. That date is based on Kaspersky’s technical analysis; the specific samples have not been independently confirmed in the public reporting cited here.
The updated LPEClient malware retrieves four ML-KEM-1024 public keys from an attacker-controlled server and uses them to generate shared secrets and corresponding ciphertexts. The malware sends the ciphertexts back to the operators, then uses the resulting key material to decrypt subsequent payloads. Kaspersky’s analysis describes additional cryptographic processing involving GOST and Threefish, with the final payload loaded directly into computer memory.
ML-KEM is a key-encapsulation mechanism that allows two parties to establish a shared secret over a public channel, which can then support encrypted communications. NIST’s FIPS 203 standard specifies three parameter sets, with ML-KEM-1024 offering the highest security strength of the three. The design aims to withstand attacks from future sufficiently powerful quantum computers, but it runs on conventional systems. Its presence in malware does not indicate that Lazarus has access to a quantum computer.
Have a development worth tracking?
Share product launches, funding announcements, partnerships, research findings and market developments with The Grey Terminal's readership.
→ Submit a Press ReleaseOperation FlashHole Targeted South Korean Organizations
Kaspersky said the earliest evidence of Operation FlashHole dates to July 2025. The firm identified at least three affected organizations in South Korea across the software, construction and wired communications equipment manufacturing sectors, and assessed that the actual number of victims was likely higher. It attributed the campaign to Lazarus with medium-to-high confidence, citing similarities with previous activity, including Operation SyncHole.
The campaign used targeted phishing emails that directed recipients to fabricated résumé and portfolio websites customized for their organizations. One résumé site included a photograph that Kaspersky assessed as AI-generated because it lacked image metadata and displayed unusual textures. Researchers also assessed that AI may have helped produce and customize the fraudulent sites, although the precise role of AI remains unconfirmed.
The attackers also abused CrossWeb EX, a legitimate financial security application used in South Korea to access online banking and government websites. Kaspersky reconstructed a multistage infection chain involving updated versions of existing Lazarus tools and two previously undocumented components, TouchHub and ClientHub. The campaign used GitHub infrastructure for command-and-control activity, while one version of ClientHub communicated through Dropbox. Researchers said they could not precisely determine what triggered the initial infection in every case.
U.S. Government Migration Timelines Extend Into the 2030s
The September 2024 finding predates several major milestones in U.S. government plans to transition sensitive systems to post-quantum cryptography. The National Security Agency’s Commercial National Security Algorithm Suite 2.0 includes ML-KEM-1024, but its adoption requirements apply across defined acquisition and deployment timelines rather than through a single switch-over date.
Under the published schedule, new National Security Systems acquired from Jan. 1, 2027, must support CNSA 2.0. Some categories, including software and firmware signing and specified networking equipment, face exclusive-use targets in 2030. Other categories have later milestones, with the broader transition aimed at 2035.
Lazarus’ reported use of the algorithm illustrates the difference between a threat actor integrating a tool into one malware chain and large organizations migrating products, infrastructure and legacy systems. The finding does not show that Lazarus has outpaced every Western organization, nor does it measure the security of its implementation. It does show that defenders may encounter post-quantum cryptography in malicious software before the technology is widely deployed across the systems they protect.
The main unanswered questions are whether independent researchers can verify the September 2024 samples, how widely the technique has been used beyond the identified malware, and whether other threat groups have adopted similar methods. Kaspersky’s disclosure establishes an early-use claim; independent technical confirmation would help determine how broadly that timeline can be generalized.
Activate Terminal Layer
Structural analysis of the systems, pressures, and stakeholders behind this story.
