Lazarus used ML-KEM to hide a Windows zero-day

On August 11, 2026, Microsoft's Patch Tuesday release fixed 421 vulnerabilities. Exactly one of them, CVE-2026-68820 in the AFD.sys driver, was already being exploited in the wild, and the group behind it had wrapped its exploit-delivery channel in the same key-encapsulation algorithm NIST finalized for defenders two years earlier. That detail, more than the zero-day itself, is why this campaign is worth a post on a site about migrating to post-quantum cryptography.

Operation Dream Job, again

The campaign runs on a familiar playbook for Lazarus: a recruiter persona approaches an employee at a target firm with a fabricated job offer, and a malicious attachment or link starts the infection. Check Point's reporting places the targets in defense and aviation, working on surveillance sensors, drones, and robotics, with activity spanning France, Germany, Brazil, and India. The initial payload is MISTPEN, an in-memory downloader that takes its instructions from attacker-controlled files staged on OneDrive and pulled through the Microsoft Graph API, so the traffic blends into ordinary cloud-storage sync rather than standing out as a bespoke command channel.

The infrastructure behind MISTPEN is itself borrowed, not owned. Lazarus operated through Roundcube webmail servers compromised via CVE-2025-49113, reportedly using credentials sourced from dark-web leaks, and through compromised PrestaShop storefronts. Each hop hosts RelayShell, a previously undocumented PHP webshell built to relay messages rather than execute commands directly, another layer between the operators and anything a defender could trace back to owned infrastructure.

Where ML-KEM sits in the chain

Once MISTPEN has a foothold, it loads an in-memory local-privilege-escalation module aimed at CVE-2026-68820. Before requesting the exploit itself, the module fingerprints the host, asks the command server for four public keys, and runs them through ML-KEM to generate new key material for the session. The negotiated key wraps a GOST-CBC layer around the traffic, stacked on top of MISTPEN's existing AES transport, so the exploit request and the FudModule rootkit it eventually deploys travel through two independent layers of encryption negotiated fresh for that session. FudModule, Lazarus's kernel-mode rootkit, then runs with the SYSTEM privileges CVE-2026-68820 hands it.

None of this is exotic engineering. ML-KEM is a public, standardized, well-audited algorithm with reference implementations in every major cryptographic library, which is exactly why a group building malware would reach for it: it is free, it is fast, and nobody has to write their own lattice code to use it. That is the same argument quantakrypto makes to clients migrating for defensive reasons, and it applies just as well to a threat actor building an operational-security layer.

Why an attacker adopting PQC is not the headline it sounds like

It is tempting to read "nation-state malware uses post-quantum cryptography" as a story about quantum computers. It is not. Lazarus is not protecting this traffic against a future cryptographically relevant quantum computer, it is protecting it against interception and analysis today, the same threat model any C2 channel has always faced. ML-KEM shows up here for the mundane reason any well-engineered primitive shows up in a toolkit: it works, it is reviewed, and it is already sitting in the libraries the malware links against. The interesting signal is what that says about how mainstream ML-KEM has become in only two years since FIPS 203 finalized: it is now unremarkable enough, from an engineering standpoint, that it turns up in both browser TLS stacks and North Korean malware for the identical reason.

For defenders, the actionable part of this story is unchanged from before Check Point's report. CVE-2026-68820 needs patching wherever AFD.sys is exposed, and Operation Dream Job's social-engineering pattern (unsolicited recruiter contact, an attachment that arrives before any real interview happens) is worth briefing to anyone in a targeted sector. What this does not do is move up any timeline for harvest-now-decrypt-later exposure or change the case for an inventory of where your own cryptography lives. Those arguments stood on their own before a threat actor happened to also be an ML-KEM user.

The point

References

• Check Point Research: Shattering the Dream, when a job offer becomes a zero-day attack (research.checkpoint.com) - the primary disclosure of the campaign, MISTPEN, and the ML-KEM key exchange.
• CVE-2026-68820 (nvd.nist.gov) - the AFD.sys use-after-free, patched in Microsoft's August 2026 Patch Tuesday release.
• NIST FIPS 203, ML-KEM (csrc.nist.gov) - the finalized standard the malware's key exchange implements.
• The Hacker News: Lazarus exploits Windows zero-day to gain SYSTEM access and deploy backdoor (thehackernews.com) - independent coverage of the campaign and the AFD.sys exploit chain.
• quantakrypto: how ML-KEM became the default in browsers - why the same algorithm shows up on the defensive side.
• quantakrypto: quantifying harvest-now-decrypt-later exposure - the actual quantum-era risk this campaign does not change.