Lazarus beat most Fortune 500 security teams to post-quantum crypto — and it didn’t need a compliance deadline to get there.
At Kaspersky’s Security Analyst Summit in Bali this week, GReAT researchers disclosed Operation FlashHole: a Lazarus campaign against South Korean construction, software, and wire-communication-equipment firms. The twist: the updated LPEClient malware uses ML-KEM-1024 to encrypt the key exchange with its command server before downloading and running follow-on payloads in memory. Kaspersky traces Lazarus’s use of post-quantum crypto back to at least September 2024 — over a year before most enterprise PQC migration plans left the whiteboard.
What this changes for defenders:
Your TLS inspection just lost visibility. If DPI or TLS-interception tooling isn’t PQC-aware, an ML-KEM-wrapped C2 handshake reads as noise, not a signature match.
AI-personalized lures now come with quantum-safe plumbing. The campaign leaned on Lazarus’s long-running “DreamJob” fake-CV playbook, complete with an AI-generated photo tailored to the target — social engineering and crypto-agility are advancing on the same timeline, not separate ones.
“Harvest now, decrypt later” has a mirror image. Nation-state actors aren’t only banking ciphertext for a future quantum computer — some are already running PQ algorithms operationally, today, to shield their own infrastructure from your interception.
Bottom Line: PQC adoption isn’t a race you can afford to lose to the people attacking you. If your detection, inspection, and threat intel stack doesn’t recognize post-quantum traffic patterns yet, you’re already behind adversaries who do.
Is your detection and inspection tooling PQC-aware yet, or is that still a 2027 line item?
#PostQuantumCryptography #PQC #Cybersecurity #ThreatIntelligence #CISO #QuantumSafe #InfoSec #RiskManagement