Kaspersky's Operation FlashHole Report, 21 October 2026: Lazarus Wraps LPEClient Payload Delivery in Four ML-KEM-1024 Key Exchanges Against South Korean Firms, TRL 9
Kaspersky's Securelist report of 21 October 2026 on Operation FlashHole shows the Lazarus Group's LPEClient tool receiving four ML-KEM-1024 public keys, deriving four shared secrets and decrypting its next payload with a 128-byte Threefish key, in a campaign against at least three South Korean software, construction and telecom-equipment firms since July 2025; the company's press release traces the group's use of the mechanism to September 2024. This post reads the development as an offensive post-quantum cryptography capability on the harvest-now-decrypt-later branch: what an intrusion unit gains when captured command-and-control traffic stays closed to future decryption, how the same four-key construction appeared in Check Point's August 2026 Dream Job report, and what the ML-KEM-1024 malware finding leaves unproven for a program office, at TRL 9.
Europol and UC3M's Harvest Now, Decrypt Later Report, 7 October 2026: Which Captured TLS, SSH and OpenPGP Traffic a Quantum Computer Could Read, and Why Government Communications Rate High Risk
A Task Force for the Ciphertext Already on Deposit
The U.S. Treasury has launched a Quantum-Readiness Task Force to move the financial sector onto post-quantum cryptography, anchored to Executive Order 14412 and its 2030 and 2031 federal deadlines. We read the announcement through the threat it exists to counter, harvest now, decrypt later collection against long-lived financial data, and list the checkpoints that would show a coordination body turning into an enforceable migration calendar.
One Million Noisy Qubits Reprice the Attack on RSA-2048
A Google Quantum AI paper cut the projected hardware cost of breaking RSA-2048 by a factor of twenty. Here is what the new estimate means for harvest now, decrypt later and the arithmetic of your post-quantum migration deadline.