Lazarus campaign reportedly used ML-KEM to protect malware payload delivery

Shared keys reportedly used to decrypt delivered payloads

Kaspersky dubbed the operation FlashHole and attributed it to the Lazarus Group. The researchers said the campaign targeted South Korean organizations through phishing pages and crafted GitHub pages, with an in-memory execution chain.

They reported that LPEClient received ML-KEM-1024 public keys from command-and-control infrastructure, generated shared keys, and used them to decrypt incoming payloads. Kaspersky identified at least three South Korean companies and suspected additional organizations may have been affected.

The supplied analysis does not provide a comparable prior measurement or establish whether Lazarus had previously used ML-KEM in other operations.

Kaspersky's analysis reportedly identified ML-KEM-1024, a standardized post-quantum cryptographic mechanism, in FlashHole's malware-delivery communications. The reported chain used LPEClient to obtain public keys and decrypt later payloads.

An analysis linking post-quantum encryption to concealment

ML-KEM is a NIST-approved post-quantum cryptographic standard used in software projects to protect data against “hack now, decrypt later” threats. In this unverified account, its reported use is tied specifically to concealing malware payload delivery alongside an in-memory execution chain.