The campaign blends both legacy and newly developed malware, with operators reusing established tooling alongside fresh components. This mixed approach allows the group to maintain tried-and-tested capabilities while introducing less familiar code that defenders may not yet recognize.

The delivery mechanism relies on post-quantum cryptography to secure the payload transfer, which researchers suggest is intended to future-proof the group's operations against improved interception and analysis capabilities. Details on the specific algorithms or implementation were not disclosed in the reporting.

• Payload delivery is secured using a post-quantum cryptographic mechanism
• Operations combine older and newer malware in the same campaign
• The activity is attributed to North Korean hackers tracked as part of the Lazarus group

This development is significant for defenders because it signals that state-sponsored actors are beginning to adopt next-generation cryptographic techniques in operational tooling, not just in theoretical research. Security teams should treat encrypted or unusually protected payload transfers as a potential red flag rather than assuming they are benign.

Source: BleepingComputer

How is your organization preparing for threat actors adopting post-quantum cryptography in their attack chains?