North Korea-linked Lazarus has begun using post-quantum cryptography to protect communications between malware-infected systems and its operators, according to cybersecurity researchers at Kaspersky. The group also used artificial intelligence to create fake employee identities and phishing emails containing links to fraudulent résumés.
Kaspersky investigated a cyberespionage campaign targeting South Korean companies in the construction, software and telecommunications-equipment industries. Victims who opened the links downloaded spyware designed to remain difficult to detect while stealing information from their computers.
The phishing techniques were not new, but researchers identified the use of post-quantum cryptographic mechanisms as a notable development. Such systems are designed to remain secure against quantum computers, which are still experimental but could eventually break some forms of encryption used today.
Sojun Ryu, a Kaspersky researcher, said the technology suggested that Lazarus was already addressing future vulnerabilities. He added that developing such a tool indicated the group had devoted resources to improving its malware capabilities and could maintain separate teams for operations, targeted attacks and specialized tools.
Post-quantum cryptography relies on mathematical problems considered difficult even for quantum computers. By contrast, some widely used cryptographic systems depend on problems that conventional computers struggle to solve but that sufficiently powerful quantum computers could handle more easily.
The first known cyberattack involving post-quantum encryption was identified in March in a ransomware operation attributed to Kyber, a relatively new group whose possible links to a state remain unknown. Lazarus adopted similar technology roughly six months later, demonstrating its ability to incorporate advanced cryptographic tools into its arsenal.
Anna Širokova, an analyst at Rapid7, which identified Kyber’s use of the technology, has described post-quantum encryption in ransomware as potentially a marketing tactic. She argued that the claim could sound more intimidating to nontechnical executives deciding whether to pay a ransom, even though attackers typically demand payment within a short period.
Quantum computers are still expected to be years, or possibly decades, away from widespread commercial use. Ryu nevertheless said Lazarus’s decision to protect its malicious payloads in advance showed long-term planning and a desire to prevent defenders and researchers from accessing them in the future.
Lazarus is described in the report as an umbrella name for several elite hacker teams unofficially sponsored by North Korea. Unlike many state-linked advanced persistent threats, which focus mainly on espionage or sabotage, the group has also been used to generate income for Pyongyang amid international sanctions. It has carried out major cryptocurrency thefts, including the theft of $1.5 billion from Bybit in a single day.
Sources: El País Tecnología.