# North Korean Hackers Deploy Quantum-Resistant Encryption in Cyber Espionage

> North Korea's Lazarus Group used advanced post-quantum cryptography, Kyber/ML-KEM, in its 2026 'Operation Dream Job' campaign targeting defense and aerospace sectors across Europe and India, Check Point Research reported.

By PrimaryBrief newsroom · Published 2026-10-22T00:51:25.419334Z
Canonical: https://primarybrief.com/article/north-korean-hackers-deploy-quantum-resistant-encryption-in-cyber-espionage-cce19063

North Korea's state-sponsored Lazarus Group integrated the post-quantum cryptographic mechanism Kyber/ML-KEM into its "Operation Dream Job" campaign, targeting defense and aerospace companies across Europe and India in 2026, Check Point Research reported in August 2026 [6][9]. This advanced encryption secured the malware's command channel after the group exploited a Windows zero-day vulnerability [6].

The adoption of quantum-resistant cryptography by a state-sponsored actor represents a significant development in hardening cyberespionage operations against future decryption capabilities. This move raises the operational security bar for threat actors and increases the challenge for organizations defending high-value targets in critical sectors worldwide [7].

## What the records show

Malware deployed by the Lazarus Group in Operation Dream Job negotiated its command channel using Kyber/ML-KEM, a post-quantum key encapsulation scheme [6]. This mechanism, standardized in 2024 to resist attacks from quantum computers, generated key material for encryption after the malware established a foothold on target systems [6]. The campaign also exploited a Windows zero-day vulnerability, identified as CVE-2026-68820. This vulnerability, a use-after-free race condition in AFD.sys, a Windows kernel driver, allowed attackers to escalate privileges once they had initial access [6][9][10]. The Lazarus Group targeted organizations involved in surveillance sensors, drones, and robotics. Confirmed activity and targeting occurred in France, Germany, Brazil, and India [6][7][8][9][10][11].

## The timeline

This particular wave of Operation Dream Job began in early 2026 [8][9]. The Windows zero-day vulnerability, CVE-2026-68820, was actively exploited by the Lazarus Group starting in early July 2026 [10]. Check Point Research discovered this active exploitation and reported the vulnerability to Microsoft on July 28, 2026 [6][8][9]. Microsoft released a patch for CVE-2026-68820 on August 11, 2026, as part of its regular Patch Tuesday updates [6][8][9][10]. Check Point Research published its analysis of the campaign on the same day, August 11, 2026 [6].

## What changed and for whom

The Lazarus Group's integration of Kyber/ML-KEM into its malware marks an upgrade in its operational security. This makes the group's command and control communications more resilient to potential future decryption attempts by quantum computers [6][7]. This advanced cryptographic layer, combined with a second encryption layer using GOST-CBC and the malware's own AES transport encryption, indicates a determined effort to secure espionage activities [6]. For defense and aerospace companies, especially those in Europe, India, and Brazil, this signifies an adversary that exploits critical vulnerabilities and also invests in state-of-the-art cryptographic defenses [6][7][8][9][10][11].

## What the subject has said publicly

No public statements from the Lazarus Group or representatives associated with the North Korean government regarding Operation Dream Job or the use of post-quantum cryptography have been found in the provided evidence.

## What we could not confirm

It could not be confirmed how many organizations were successfully compromised across all targeted regions. The specific financial costs or data exfiltration volumes resulting from these attacks also could not be confirmed from the available records.

## Evidence cited
1. Lazarus hackers use post-quantum cryptography for malware delivery (www.bleepingcomputer.com) — https://www.bleepingcomputer.com/news/security/lazarus-hackers-use-post-quantum-cryptography-for-malware-delivery/
2. Trump Appointees Asked a Federal Cybersecurity Agency to Secretly Acquire a Voting Machine — and Hack It (www.propublica.org) — https://www.propublica.org/article/cisa-election-security-donald-trump
3. AI Safety and Cybersecurity Should Be Allies. Instead, They're at Odds (time.com) — https://time.com/article/2026/10/20/ai-safety-cybersecurity/
4. The Download: introducing the Impossible issue (www.technologyreview.com) — https://www.technologyreview.com/2026/10/21/1147573/the-download-introducing-impossible-issue/
5. Germany news: Hackers release AfD party emails (www.dw.com) — https://www.dw.com/en/germany-news-hackers-release-afd-party-emails/live-79709090?maca=en-rss-en-all-1573-rdf
6. Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day (infosecurity-magazine.com) — https://infosecurity-magazine.com/news/lazarus-used-post-quantum-key/
7. Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor (cleartext.fm) — https://cleartext.fm/news/lazarus-exploits-windows-zero-day-to-gain-system-access-and-deploy-backdoor
8. Lazarus Group Exploited Windows Zero-Day In Dream Job Campaign - AMPCUS Cyber (ampcuscyber.com) — https://ampcuscyber.com/news/lazarus-group-exploited-windows-zero-day-in-dream-job-campaign/
9. Lazarus Group Exploited A Windows Zero-Day In Operation Dream Job - Check Point Software (checkpoint.com) — https://www.checkpoint.com/press-releases/lazarus-group-exploited-a-windows-zero-day-in-operation-dream-job/
10. Lazarus Group Exploits Windows Zero-Day in Latest Operation Dream Job Wave (cloudsecurityalliance.org) — https://cloudsecurityalliance.org/blog/2026/08/16/lazarus-group-exploits-windows-zero-day-in-latest-operation-dream-job-wave/
11. Lazarus Group exploited Windows zero-day in Operation Dream Job campaign (therecord.media) — https://therecord.media/lazarus-group-windows-zero-day-operation-dream-job
12. Lazarus Group Campaign Targets South Korea Using Post-Quantum Cryptography (kaspersky.com) — https://www.kaspersky.com/about/newsroom/2026/lazarus-group-campaign-targets-south-korea-using-post-quantum-cryptography
13. Lazarus's 'FlashHole': New Campaign Hits South Korean Firms with Quantum-Resistant Cryptography (securityonline.info) — https://securityonline.info/lazarus-flashhole-south-korea-kaspersky/
14. Lazarus Group Targets South Korea Using Post-Quantum Cryptography in “Operation FlashHole” (kaspersky.com) — https://www.kaspersky.com/blog/lazarus-flashhole-targets-south-korea-using-pqc/51356/
15. This Week's Exploited Vulnerabilities: CVE-2026-68820, CVE-2026-59310, CVE-2026-20349, and More (safe.security) — https://safe.security/blog/this-weeks-exploited-vulnerabilities-cve-2026-68820-cve-2026-59310-cve-2026-20349-and-more
16. CISA Sets Deadline for Lazarus Windows Zero-Day - Decryption Digest (decryptiondigest.com) — https://decryptiondigest.com/cisa-sets-deadline-for-lazarus-windows-zero-day/
17. Lazarus Windows Exploit CVE-2026-68820 in Operation Dream Job | Greenbone Networks (greenbone.net) — https://www.greenbone.net/en/lazarus-windows-exploit-cve-2026-68820-in-operation-dream-job/
18. Microsoft August 2026 Patch Tuesday Analysis and Prioritization - Securden (securden.com) — https://www.securden.com/blog/microsoft-august-2026-patch-tuesday-analysis-and-prioritization-cve-2026-68820/
19. What is Kyber (ML-KEM)? (quentir.ai) — https://www.quentir.ai/blog/what-is-kyber-ml-kem
20. Lazarus Group Integrates ML-KEM Post-Quantum Cryptography into Malware (youtube.com) — https://www.youtube.com/watch?v=12345ABCDE
21. ML-KEM - Wikipedia (wikipedia.org) — https://www.wikipedia.org/wiki/ML-KEM
22. Post-Quantum Cryptography (ML-KEM): The Math. This post is also published on the… | by IyaSec | Jun, 2026 | Medium (medium.com) — https://medium.com/@iyasec/post-quantum-cryptography-ml-kem-the-math-d1e9e2482e98
23. Lazarus Group uses AI and post-quantum cryptography in attacks: Kaspersky - DIGITIMES Asia (dig.watch) — https://dig.watch/news/lazarus-group-uses-ai-and-post-quantum-cryptography-in-attacks-kaspersky/
24. Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day (infosecurity-magazine.com) — https://www.infosecurity-magazine.com/news/lazarus-used-post-quantum-key/
25. quentir.ai (quentir.ai) — https://quentir.ai/
26. medium.com (medium.com) — https://medium.com/