Lazarus Hackers Adopt Quantum-Resistant Cryptography for Attacks
The group is using quantum-resistant algorithms to secure their malicious data transmission.
Quantum Security in the Service of Cybercrime
The North Korean-linked hacking group Lazarus, widely considered one of the most dangerous actors globally, has deployed an unexpected strategy in its latest campaign, dubbed Operation FlashHole. Security experts report that the group is utilizing the ML-KEM-1024 cryptographic algorithm, which was specifically designed to protect data against decryption by future quantum computers. Ironically, the group has implemented this technology faster than many legitimate security systems.
How the New Tactic Works
Operation FlashHole, which has been active since July 2025, has targeted companies in South Korea’s software, construction, and telecommunications sectors. The hackers are using an updated version of LPEClient that incorporates four different quantum keys during data transmission. This method targets the "harvest now, decrypt later" strategy, where hackers record encrypted traffic with the expectation that they will be able to access the data as quantum computing technology advances.
Artificial Intelligence and Social Engineering
Alongside quantum protection, Lazarus is actively using artificial intelligence to bolster its campaigns. Experts have observed the hackers creating fake resumes and websites, using AI-generated photos and text to deceive potential victims. The attack chain typically begins with phishing emails that encourage users to click on suspicious links. Subsequently, the hackers exploit popular South Korean security software, INISAFE CrossWeb EX, to gain privileged access to systems.
What This Means for Users
Although quantum protection secures data transmission channels, the technology does not cover the actions of malware within a computer. Security specialists advise that both organizations and individuals focus on traditional defense mechanisms. Verifying suspicious links, keeping software updated, and removing unnecessary system components remain the most effective methods of protection. The adoption of such advanced technologies by Lazarus indicates that state-sponsored hacking groups are constantly evolving, blurring the lines between criminal activity and technological innovation. For users, including those in Georgia, this serves as a reminder that cybersecurity standards must continuously adapt to meet modern challenges.