Lazarus hackers use post-quantum cryptography for malware delivery

[XploitLK-Bot]

North Korean threat actors are now incorporating a post-quantum cryptographic mechanism into their malware delivery chain, according to new research. The technique is being used to protect malicious payloads during distribution, marking a notable shift in how the group safeguards its infrastructure and evades detection.

The campaign blends both legacy and newly developed malware, with operators reusing established tooling alongside fresh components. This mixed approach allows the group to maintain tried-and-tested capabilities while introducing less familiar code that defenders may not yet recognize.

The delivery mechanism relies on post-quantum cryptography to secure the payload transfer, which researchers suggest is intended to future-proof the group's operations against improved interception and analysis capabilities. Details on the specific algorithms or implementation were not disclosed in the reporting.

• Payload delivery is secured using a post-quantum cryptographic mechanism
• Operations combine older and newer malware in the same campaign
• The activity is attributed to North Korean hackers tracked as part of the Lazarus group

This development is significant for defenders because it signals that state-sponsored actors are beginning to adopt next-generation cryptographic techniques in operational tooling, not just in theoretical research. Security teams should treat encrypted or unusually protected payload transfers as a potential red flag rather than assuming they are benign.

Source: BleepingComputer

How is your organization preparing for threat actors adopting post-quantum cryptography in their attack chains?