North Korean Lazarus Group Uses AI and Post‑Quantum Encryption in New Campaign

Kaspersky’s Global Research and Analysis Team (GReAT) has identified a new phase of the Lazarus Group’s Operation FlashHole, active since at least July 2025. The updated LPEClient tool now employs ML‑KEM‑1024, a post‑quantum key‑exchange that is resistant to future quantum‑computer attacks, to protect the channel used for downloading additional malware.

The campaign has targeted at least three South Korean firms in the software, construction and wired‑communication equipment sectors. The attackers used a GitHub Pages site that first displayed a fake AI‑generated résumé of a senior network appliance developer. In January 2026 the site was swapped for an interior‑design showcase aimed at a construction company. Kaspersky estimates that the victims received spear‑phishing emails linking to these sites, which loaded JavaScript from attacker‑controlled domains.

Once inside, the malware leveraged the widely used South Korean security product INISAFE CrossWeb EX. The code ran in memory with elevated privileges, spawned by a CrossWeb EX build released in 2023. This is a familiar route for Lazarus, which has abused CrossWeb EX in 2021‑2023 and in the earlier Operation SyncHole.

The new LPEClient no longer stores its own server address; instead it relays traffic through a loader called ClientHub that communicates via Dropbox. It profiles installed security products, Windows patch level and checks for protections such as Shadow Stack, then encrypts the report with GOST. The server sends four ML‑KEM‑1024 public keys; LPEClient derives four shared secrets, combines them into a single 128‑byte key for Threefish, and uses that key to decrypt the next payload.

ML‑KEM‑1024 is the strongest of the three parameter sets in NIST’s FIPS 203 standard and is the algorithm the NSA specifies for key establishment under CNSA 2.0. Kaspersky notes that Lazarus adopted this technology within weeks of NIST finalising its first post‑quantum standards on 13 August 2024.

The post‑quantum layer protects data in transit, not the malware’s execution on the host. Endpoint protection remains the most effective countermeasure. Kaspersky advises defenders to verify unexpected links, patch quickly, remove unnecessary components, restrict user privileges and monitor connections to cloud services such as GitHub and Dropbox.

The use of AI‑generated content and post‑quantum cryptography represents a significant evolution in Lazarus’s toolkit, but the core delivery vector—spear‑phishing with a convincing résumé—remains unchanged.