Kaspersky Uncovers AI-Driven Lazarus Campaign Using Post-Quantum Encryption

November 1, 2026: Kaspersky GReAT has uncovered an evolved wave of Lazarus’s Operation SyncHole, featuring more sophisticated tools and techniques for persistent cyberespionage. The campaign uses spear-phishing emails directing targets to fraudulent, AI-tailored portfolio and CV websites, consistent with Lazarus’s job-themed Operation DreamJob. Researchers also identified a GitHub Pages website linked to a GitHub account used as a command-and-control (C2) channel

The investigation revealed a potential exploitation of a vulnerability in CrossWeb EX, a widely used South Korean financial security and authentication software, as a possible entry point for infection. Researchers reconstructed the infection chain and identified multiple malicious payloads, including two previously undocumented tools, TouchHub and ClientHub, which install malware, execute commands and facilitate communication with attackers. One variant uses Dropbox for C2 communication.

The campaign also deploys an updated version of LPEClient to collect system and security software information before encrypting and transmitting it to attackers. Notably, the malware uses the post-quantum cryptographic mechanism ML-KEM-1024 to establish encrypted communications. It also employs advanced evasion techniques, including manipulating memory protections and disabling security monitoring hooks to avoid detection.

“Lazarus continues to expand its operations, launches new campaigns while introducing new tools and reworking familiar ones to meet its needs. Our analysis of Operation FlashHole, along with evidence from previous investigations, suggests that the group is also bringing AI into its long-established playbook, a shift we have observed among other threat actors aligned with Lazarus. What deserves closer attention is Lazarus’s adoption of cryptography designed to withstand future quantum threats. Our findings trace its use back to at least September 2024, showing that these capabilities were already protecting the group’s malware communications more than a year before this disclosure,” says Sojun Ryu, senior security researcher at Kaspersky GReAT. 

Organizations should train employees to identify phishing, promptly patch vulnerabilities, restrict user privileges and monitor cloud connections. Kaspersky recommends deploying Kaspersky Next solutions, adopting managed security services such as MDR and Incident Response, and leveraging Threat Intelligence to improve threat visibility, detect malicious activity, investigate incidents and strengthen overall cybersecurity resilience.

The full report is available on Securelist.com.