Kaspersky's Operation FlashHole Report, 21 October 2026: Lazarus Wraps LPEClient Payload Delivery in Four ML-KEM-1024 Key Exchanges Against South Korean Firms, TRL 9

Kaspersky's Securelist report of 21 October 2026 on Operation FlashHole shows the Lazarus Group's LPEClient tool receiving four ML-KEM-1024 public keys, deriving four shared secrets and decrypting its next payload with a 128-byte Threefish key, in a campaign against at least three South Korean software, construction and telecom-equipment firms since July 2025; the company's press release traces the group's use of the mechanism to September 2024. This post reads the development as an offensive post-quantum cryptography capability on the harvest-now-decrypt-later branch: what an intrusion unit gains when captured command-and-control traffic stays closed to future decryption, how the same four-key construction appeared in Check Point's August 2026 Dream Job report, and what the ML-KEM-1024 malware finding leaves unproven for a program office, at TRL 9.