Kaspersky finds post-quantum key exchange in a reported Lazarus malware chain
Operation FlashHole illustrates an unexpected use for ML-KEM. The vendor’s disclosure concerns malware delivery, with activity evidence dating to July 2025.
Kaspersky
Cybersecurity company with threat-research teams that analyze malware and cryptographic implementations. Its Operation FlashHole reporting describes post-quantum key exchange in a malware delivery chain, with threat-actor attribution made by the vendor.
RussiaIdentity & attribution
- Organization record
- Kaspersky
- Recorded role
- Quantum Security & Cryptography
- Recorded aliases
- No aliases recorded in this assessment.
- Name and period
- No dated name or ownership transition is recorded here. An alias is a search aid, not evidence of a legal ownership relationship.
- Product scope
- Product-level review pending.
A company profile may discuss several systems. Capabilities remain attached to the product and conditions named in each source; they do not transfer automatically to related organizations. A verified security relationship has not been attached to this record.
Report an identity issue →Directory profile
Cybersecurity company with threat-research teams that analyze malware and cryptographic implementations. Its Operation FlashHole reporting describes post-quantum key exchange in a malware delivery chain, with threat-actor attribution made by the vendor.
A complete research assessment is not yet available. Directory inclusion does not imply a score or endorsement.
Start with the organization’s own material ↗QubitWire coverage
Since your review
Scope: Kaspersky. Reading a page never marks its records reviewed.
Keep a baseline and explicitly mark the evidence you have reviewed. This optional journal stays in this browser.
Sources & evidence
Keep up with the companies you follow.
Follow companies to find their published coverage here. Email alerts are not enabled.