A North Korean state-backed hacking group has started building quantum-resistant encryption into its espionage toolkit, a shift that signals how nation-state attackers are preparing for a future in which today's codes may no longer hold. Researchers at Kaspersky Lab's Global Research and Analysis Team (GReAT) say the campaign, dubbed Operation FlashHole, has targeted at least three South Korean organizations in construction, software development, and wired communication equipment manufacturing since at least July 2025.
A Familiar Lure With a New Twist
The intrusion method itself is not new: fabricated job applications sent through phishing emails, pointing victims to fake résumé and portfolio websites. What stands out is the craftsmanship. One such page, hosted on GitHub Pages, featured a photo of the fictitious applicant generated by artificial intelligence. Kaspersky's researchers believe neural networks may have been used to customize these decoy pages for individual targets, making the social engineering harder to spot than earlier, more generic Lazarus campaigns.
Once a victim engaged with the fake site, the attackers moved to exploit CrossWeb EX, a legitimate program widely used in South Korea for financial authentication. A possible vulnerability in that software is suspected to have given the hackers a foothold inside victims' systems, a pattern consistent with Lazarus Group's long history of abusing trusted local software ecosystems rather than relying solely on custom malware delivery.
New Tools, Familiar Playbook
Kaspersky identified two previously undocumented malicious tools in the campaign, TouchHub and ClientHub. Both allow operators to run commands remotely, install further malware, and maintain communication channels with infected machines. Notably, one variant uses Dropbox as a covert communication channel, a technique that lets malicious traffic blend into ordinary cloud-service activity and evade detection systems tuned to flag suspicious network destinations.
The most consequential discovery, though, involves an updated version of LPEClient, a tool previously linked to Lazarus Group operations. This version incorporates ML-KEM-1024, a post-quantum key encapsulation mechanism designed to resist decryption attempts by future quantum computers. The mechanism is used to establish an encrypted channel with the attackers' command server, through which additional malicious modules can be downloaded and executed directly in a device's memory, leaving minimal forensic traces on disk.
Why Post-Quantum Cryptography Matters Here
Post-quantum cryptography was developed to protect data against a scenario known as "harvest now, decrypt later," in which encrypted communications intercepted today could be broken once sufficiently powerful quantum computers exist. Standards bodies have been rolling out quantum-resistant algorithms for legitimate institutions to adopt defensively. Kaspersky's findings suggest Lazarus Group has been using such cryptography offensively since at least September 2024, protecting its own command-and-control infrastructure from future interception rather than protecting user data. That is a notable inversion of the technology's original purpose, and it implies a level of technical sophistication and long-term planning not typically associated with financially motivated cybercrime.
The development also complicates attribution and defense. If state-linked actors routinely wrap their infrastructure in forward-secure, quantum-resistant encryption, security teams lose one of their traditional investigative tools: the ability to decrypt and analyze intercepted command traffic after the fact. Separately, researchers at Mysten Labs have argued that artificial intelligence currently poses a more immediate threat to cryptocurrency security than quantum computing itself, a reminder that these two technological pressures, AI-driven social engineering and quantum-era cryptography, are converging rather than arriving in isolation.