Kaspersky finds post-quantum key exchange in a reported Lazarus malware chain
Operation FlashHole illustrates an unexpected use for ML-KEM. The vendor’s disclosure concerns malware delivery, with activity evidence dating to July 2025.
Kaspersky’s October 21 Operation FlashHole report describes an ML-KEM-1024-based exchange protecting malware delivery in activity it attributes to Lazarus. Its investigation traces evidence to July 2025. This is a new disclosure about older activity, rather than evidence that the campaign began on the report’s publication date.[1][2]
The finding concerns attackers using cryptography. It does not describe a quantum computer breaking encryption or establish a weakness in ML-KEM. The reported mechanism and the investigating vendor’s attribution should remain separate claims, each attached to the evidence supporting it.[1][2]
Our assessment is that this makes the story useful beyond its surprising headline. A protected channel describes what an observer can learn about an exchange. It does not establish that the software using the channel has a legitimate purpose. Security properties and the conduct of a programme need separate explanations.
That distinction can clarify public discussion of post-quantum adoption. A product may adopt an algorithm to protect customers, while an incident report may describe a similar tool being used to obstruct investigation. The shared terminology does not turn those situations into the same event or establish an algorithm failure.
For defenders, the useful question is whether the report’s observations help identify relevant activity in their own environment. Some technical findings may be directly testable. Attribution may depend on a broader collection of evidence. Keeping those boundaries visible supports proportionate investigation without treating every algorithm mention as a new class of compromise.
The next informative development would be corroborating evidence that strengthens or narrows the reported account. Until then, the defensible story is a dated vendor investigation, a specific cryptographic finding and an activity timeline that predates disclosure. That is enough to show why quantum-resistant tools can matter on both sides of a security incident.