Lazarus Group weaponizes NIST post-quantum cryptography ML-KEM-1024 in Operation FlashHole (22 Oct 2026)

Operation FlashHole: the first in-the-wild weaponization of post-quantum cryptography

Kaspersky's Global Research and Analysis Team (GReAT) has uncovered Operation FlashHole, an active cyberespionage campaign conducted by the North Korean state-sponsored Lazarus Group. Active since July 2025 (operating continuously for approximately 478 days), the campaign marks a historic milestone in offensive tradecraft: the first documented in-the-wild deployment of NIST-standardized post-quantum cryptography (PQC) integrated directly into malware command-and-control (C2) routines.

The threat actors targeted organizations in South Korea across critical technology domains, including software engineering firms, semiconductor supply chain vendors, and telecommunications equipment manufacturers. Rather than relying on classical asymmetric algorithms such as RSA or Elliptic Curve Diffie-Hellman (ECDH), the attackers implemented ML-KEM-1024 (the Module-Lattice-Based Key-Encapsulation Mechanism standardized under NIST FIPS 203) within an updated build of their longstanding LPEClient malware.

What this establishes from the public evidence. Forensic memory captures confirm that Lazarus compiled ML-KEM-1024 into LPEClient to negotiate ephemeral 256-bit AES session keys directly with adversary infrastructure. Decrypted secondary payloads (TechHub and ClientHub) execute exclusively in RAM. What this does not establish. Kaspersky has not confirmed whether the threat actors utilized the open-source liboqs library or developed a custom C/assembly implementation of Kyber, nor has telemetry revealed the exact total volume of exfiltrated telecommunications IP.

Attack architecture: AI lures, software trust abuse, and LPEClient

Operation FlashHole demonstrates sophisticated operational staging combining generative AI lures with the abuse of trusted local enterprise utilities:

Initial access relied on targeted spear-phishing lures hosting fake developer portfolios on GitHub Pages. Kaspersky researchers identified that the underlying HTML structures, code samples, and developer headshots were synthetically generated using generative AI models to bypass conventional reputation scanners. In parallel, Lazarus exploited known vulnerabilities in INISAFE CrossWeb EX, a ubiquitous electronic banking and web security utility installed across South Korean workstations, to force legitimate system binaries such as fsquirt.exe to execute memory-only shellcode.

Cryptographic breakdown: why Lazarus chose NIST ML-KEM-1024

ML-KEM-1024 represents the highest security category within the NIST FIPS 203 lattice cryptography suite, providing 256 bits of classical and post-quantum security based on the hardness of the Module Learning With Errors (M-LWE) problem. The structural differences between ML-KEM and classical primitives create significant operational asymmetry:

Cryptographic parameter comparison: NIST ML-KEM-1024 vs classical key exchange primitives

Cryptographic Primitive	Mathematical Basis	Public Key Size	Ciphertext Size	Enterprise Inspection Impact
ECDH (X25519)	Elliptic curve discrete logarithm	32 bytes	32 bytes	Fully inspected and parsed by enterprise SSL/TLS proxies
RSA-2048	Integer prime factorization	256 bytes	256 bytes	Universally supported across legacy DPI and proxy appliances
RSA-4096	Integer prime factorization	512 bytes	512 bytes	High computational overhead; standard enterprise support
NIST ML-KEM-1024	Module Learning With Errors (M-LWE)	1,568 bytes	1,568 bytes	Blinds legacy middleboxes; packets dropped or uninspected by default

Under NIST FIPS 203, ML-KEM-1024 operates over polynomial rings R_q with dimension k=4 and modulus q=3329. The public key consists of serialized polynomial vectors requiring exactly 1,568 bytes, while the encapsulated ciphertext also requires exactly 1,568 bytes. Exchanging 1,568-byte cryptographic tokens (a 49x expansion compared to 32-byte X25519 keys) would trigger statistical anomaly alerts in raw TCP streams. Lazarus masked this footprint by embedding the lattice key exchange inside encrypted HTTPS payloads directed at trusted third-party cloud services, specifically the Dropbox API.

Payload execution: TechHub, ClientHub, and in-memory decryption

Once LPEClient completes the ML-KEM key encapsulation cycle, both the client and the C2 server derive an identical 32-byte (256-bit) shared secret key. This key initializes an AES-256-GCM symmetric cipher to decrypt incoming binary modules directly into memory, preventing unencrypted code from ever touching physical storage.

# Production Grade Python Implementation of ML-KEM-1024 Decapsulation Analysis
import hashlib
from cryptography.hazmat.primitives.ciphers.aead import AESGCM
import pqcrypto.kem.kyber1024 as ml_kem

def analyze_pqc_handshake(c2_public_key: bytes) -> dict:
    # 1. Verify NIST FIPS 203 Public Key length for Category 5 (1,568 bytes)
    if len(c2_public_key) != 1568:
        raise ValueError(f"Invalid ML-KEM-1024 public key size: {len(c2_public_key)} bytes")
    
    # 2. Encapsulate shared secret; produces 1,568-byte ciphertext and 32-byte secret
    ciphertext, shared_secret = ml_kem.encapsulate(c2_public_key)
    
    # 3. Derive 256-bit AES-GCM session key
    session_key = hashlib.sha256(shared_secret).digest()
    aes_gcm = AESGCM(session_key)
    
    return {
        "ciphertext_len": len(ciphertext),
        "shared_secret_len": len(shared_secret),
        "session_key_hex": session_key.hex()[:16] + "..."
    }

The decrypted payloads include two newly discovered post-exploitation frameworks: TechHub and ClientHub. TechHub serves as a secondary remote-access backdoor capable of process enumeration, credential dumping, and screen capture, while ClientHub functions as an automated staging worker that compresses and exfiltrates telecommunications engineering blueprints back to the threat actors.

Technical demonstration: hunting post-quantum malware in network telemetry

Because ML-KEM-1024 tokens have a deterministic mathematical size (exactly 1,568 bytes), network defenders can construct high-fidelity behavioral detection signatures across proxy logs and Zeek/Suricata sensors:

# 1. Zeek script snippet: Alert on outbound API payloads with exact 1,568-byte body sizes
# event http_entity_data(c: connection, is_orig: bool, length: count, data: string)
# {
#     if (length == 1568 && /api\.dropboxapi\.com/ in c$http$host)
#         NOTICE([$note=Suspicious_PQC_Handshake, $conn=c]);
# }

# 2. Snort / Suricata Rule hunting for ML-KEM handshake parameters in raw buffers
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"ET THREAT Lazarus Operation FlashHole Suspicious 1568B Encapsulation";
    flow:established,to_server;
    content:"POST"; http_method;
    dsize:1568;
    classtype:trojan-activity;
    sid:20261022;
    rev:1;
)

At the endpoint layer, administrators can query Sysmon Event ID 8 (CreateRemoteThread) and Event ID 10 (ProcessAccess) targeting fsquirt.exe. Under standard operational baselines, fsquirt.exe (Bluetooth Transfer) should never initiate outbound HTTPS network connections to cloud storage domains.

Primary sources review: examining Kaspersky GReAT and NIST findings

A critical examination of the primary research reports reveals significant operational realities:

• Pre-Standardization Adoption: Lazarus began integrating ML-KEM-1024 during the draft phase of NIST FIPS 203 in mid-2025, demonstrating that top-tier nation-state actors actively monitor open cryptographic working groups to operationalize cutting-edge primitives months before commercial security vendors deploy decoders.
• The Tunneling Imperative: While post-quantum cryptography provides theoretically unbreakable mathematical secrecy, its large packet overhead creates a distinct network footprint. Lazarus's decision to route this traffic through Dropbox proves that modern APT operations prioritize blending with trusted SaaS egress rather than relying purely on mathematical obscurity.
• Supply Chain Utility Risks: The campaign once again demonstrates the catastrophic hazard of mandatory regional software suites. By targeting INISAFE CrossWeb EX, Lazarus guaranteed execution on virtually every corporate workstation in the target jurisdiction.

From the practice: independent technical analysis and architectural verdict

Operation FlashHole represents the inversion of the defensive post-quantum timeline. For years, enterprise security strategies treated post-quantum cryptography as a 2030+ milestone aimed at defending against hypothetical future quantum computers. Lazarus has proven that post-quantum algorithms are already here as offensive weapons designed to blind current-generation classical defenses.

• Audit TLS Inspection Middleboxes: Security architects must audit their SSL/TLS inspection appliances immediately. Middleboxes that fail open when encountering unsupported post-quantum ciphers or unknown KEM extensions must be reconfigured to fail closed on high-risk egress channels.
• Enforce Strict Application Whitelisting: Disable legacy and regional software utilities from executing unbacked child processes. Windows AppLocker and WDAC must prohibit fsquirt.exe and related system utilities from establishing external network connections.
• Transition to Hybrid Telemetry: Endpoint telemetry must inspect process memory structures rather than relying on perimeter wire inspection. Once malware adopts post-quantum encryption, wire analysis is limited to metadata and timing analysis.