North Korea's Lazarus Group has crossed a threshold that defenders have been anticipating for years: the group is now using post-quantum key exchange to protect the command-and-control and payload delivery channels of its long-running Operation DreamJob campaign — and behind that cryptographic cover, it delivered a previously unpatched Windows vulnerability against targeted victims.
This matters for two distinct reasons. First, the zero-day itself: Lazarus continues to burn valuable Windows vulnerabilities against job-seeker-themed social engineering targets, typically in defense, aerospace, cryptocurrency, and technology sectors. Second — and arguably more strategically significant — the group has adopted post-quantum key encapsulation (reported as an NTRU-family algorithm) inside its malware to establish encrypted sessions that are resistant to future decryption. This is a direct counter to the "harvest now, decrypt later" model used by nation-state SIGINT agencies, and it signals that Lazarus expects its traffic to be captured and is engineering against retrospective analysis.
For defenders, the implication is immediate and uncomfortable: network-layer detection of this campaign just got materially harder. If your SOC's visibility strategy leans on TLS inspection, JA3/JA4 fingerprinting, or retrospective decryption of captured C2 traffic, assume that capability is degraded against this actor. The endpoint is now your primary sensor.
Technical Analysis
The Campaign: Operation DreamJob
Operation DreamJob is Lazarus's flagship initial-access operation, active since at least 2019 and continuously refined. The playbook is well documented:
- Social engineering pretext: Targets are approached via LinkedIn, Telegram, or email with a fabricated job offer — typically a lucrative position at a defense contractor, aerospace firm, or cryptocurrency exchange.
- Lure delivery: The victim receives a trojanized "job description" document, a malicious PDF reader/mangler, or a weaponized coding challenge archive.
- Staged execution: A first-stage loader establishes persistence, fingerprints the host, and pulls second-stage tooling over an encrypted C2 channel.
- Objective: Espionage, credential theft, and — in cryptocurrency-sector intrusions — financial theft to fund the DPRK regime.
What's New: Post-Quantum Key Exchange in the Malware
In the latest observed variant, Lazarus has embedded a post-quantum key encapsulation mechanism (KEM) — identified in reporting as an NTRU Prime–family algorithm — into the malware's C2 handshake. Rather than relying solely on classical RSA or ECDH key exchange (which is recorded and potentially decryptable later once quantum-capable adversaries or key material becomes available), the malware performs a hybrid key exchange:
- The client malware generates a post-quantum keypair and transmits the public key to the C2 server.
- The server encapsulates a session secret against that public key and returns the ciphertext.
- The derived session key encrypts the subsequent C2 traffic.
Why this is operationally significant for defense:
- No retrospective decryption: Even if your organization (or an intelligence partner) captured full packet data during the intrusion, the classical break-the-key-exchange-then-decrypt approach is blocked. The PQ layer is specifically designed to survive "store now, decrypt later."
- Anomalous crypto on the wire: PQ key exchange produces distinctive traffic characteristics — unusually large handshake payloads (NTRU-family public keys and ciphertexts are significantly larger than classical ECDHE key material), non-standard TLS extensions, or custom binary protocols carrying PQ material over HTTPS-wrapped channels.
- Signal of actor investment: Deploying PQ crypto in commodity-delivered malware is not trivial. It indicates Lazarus is protecting tooling it expects to reuse, which means the delivery infrastructure and the zero-day it shields are considered high-value.
The Delivered Windows Zero-Day
The payload protected by this channel was an exploit for a previously unpatched Windows vulnerability — a zero-day at time of delivery. At the time of this writing, no CVE identifier has been published in the reporting for this specific issue, and organizations should monitor Microsoft's security update guide and CISA's Known Exploited Vulnerabilities (KEV) catalog for the identifier once coordinated disclosure completes.
Until the patch ships, your exposure is defined by the attack chain, not the CVE:
- Exploitation requirement: User interaction with the DreamJob lure (opening the malicious document/application) on a Windows endpoint.
- Post-exploitation behavior: Child process spawning from the lure application, memory-resident loaders, persistence via scheduled tasks or registry run keys, and outbound C2 over HTTPS carrying abnormally large handshake payloads.
Exploitation Status
- In-the-wild: Confirmed. This was observed in a live, targeted intrusion — not a proof-of-concept.
- Attribution: Lazarus Group (DPRK), with high confidence based on TTP overlap with documented Operation DreamJob infrastructure and tooling.
- CISA KEV: Monitor for addition once the CVE is assigned. Lazarus-exploited Windows vulnerabilities have historically landed on KEV rapidly after disclosure.
Detection & Response
Because the PQ-encrypted C2 channel defeats payload inspection, detection must concentrate on the pre-encryption phases: the lure execution, the process tree it generates, persistence establishment, and the network handshake characteristics that PQ key exchange betrays (large payloads, unusual entropy patterns in early-session bytes).
Sigma Rules
The following rules target the DreamJob execution chain and the behavioral residue of the loader — not the encrypted C2 itself.
---
title: Office or PDF Application Spawning Scripting Interpreter or LOLBin
id: 3f8a2c91-6b4d-4e7a-9c1f-2d5e8a7b9c01
status: experimental
description: Detects document reader applications (PDF viewers, Office) spawning scripting interpreters or living-off-the-land binaries, consistent with Lazarus Operation DreamJob lure execution delivering a Windows zero-day loader.
references:
- https://attack.mitre.org/techniques/T1566/001/
- https://attack.mitre.org/techniques/T1059/
- https://www.infosecurity-magazine.com/news/lazarus-post-quantum-key-dream-job/
author: Security Arsenal
date: 2026/02/10
tags:
- attack.initial_access
- attack.t1566.001
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\winword.exe'
- '\excel.exe'
- '\powerpnt.exe'
- '\acrord32.exe'
- '\acrobat.exe'
- '\foxitreader.exe'
- '\sumatrapdf.exe'
- '\msedge.exe'
selection_child:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\rundll32.exe'
- '\regsvr32.exe'
- '\cmd.exe'
- '\certutil.exe'
- '\bitsadmin.exe'
condition: selection_parent and selection_child
falsepositives:
- Rare; legitimate document readers do not normally spawn scripting engines. Validate against internal document-management tooling.
level: high
---
title: Executable Launched From Job-Lure Staging Directories With Network Activity
id: 8b1e4d27-3a9f-4c6e-b2d8-7f4a1c9e5d03
status: experimental
description: Detects execution of binaries from user-writable staging locations commonly used by DreamJob lures (Downloads, Temp, AppData subfolders with recruiter-themed names), followed by persistence or C2 staging behavior.
references:
- https://attack.mitre.org/techniques/T1204/002/
- https://attack.mitre.org/techniques/T1543/003/
- https://www.infosecurity-magazine.com/news/lazarus-post-quantum-key-dream-job/
author: Security Arsenal
date: 2026/02/10
tags:
- attack.execution
- attack.t1204.002
- attack.persistence
logsource:
category: process_creation
product: windows
detection:
selection_path:
Image|contains:
- '\Downloads\'
- '\AppData\Local\Temp\'
- '\AppData\Roaming\'
selection_name:
Image|contains:
- 'job'
- 'offer'
- 'recruit'
- 'interview'
- 'career'
- 'salary'
- 'contract'
- 'resume'
- 'cv_'
filter_signed_system:
- Image|startswith: 'C:\\Windows\\'
- Image|startswith: 'C:\\Program Files\\'
- Image|startswith: 'C:\\Program Files (x86)\\'
condition: selection_path and selection_name and not 1 of filter_signed_system
falsepositives:
- Legitimately downloaded recruiter documents with embedded viewers (rare as executables)
- Internal HR tooling distributed via download
level: high
---
title: Scheduled Task or Run Key Persistence Created by Non-Standard Process
id: 5c7f2a94-1e8b-4d3a-a6c9-9b2e5f7d4a06
status: experimental
description: Detects persistence establishment via scheduled task registration or registry Run key modification performed by processes outside standard administrative tooling, consistent with Lazarus loader behavior following DreamJob lure execution.
references:
- https://attack.mitre.org/techniques/T1053/005/
- https://attack.mitre.org/techniques/T1547/001/
- https://www.infosecurity-magazine.com/news/lazarus-post-quantum-key-dream-job/
author: Security Arsenal
date: 2026/02/10
tags:
- attack.persistence
- attack.t1053.005
- attack.t1547.001
logsource:
category: process_creation
product: windows
detection:
selection_schtasks:
Image|endswith: '\schtasks.exe'
CommandLine|contains:
- '/create'
- '/tn'
selection_reg:
Image|endswith: '\reg.exe'
CommandLine|contains:
- 'CurrentVersion\\Run'
- 'CurrentVersion\\RunOnce'
selection_payload_ref:
CommandLine|contains:
- '\AppData\'
- '\Temp\'
- '\ProgramData\'
- '.dll'
- 'rundll32'
- 'regsvr32'
condition: (selection_schtasks or selection_reg) and selection_payload_ref
falsepositives:
- Software installers registering update tasks (validate against known installer hashes)
- Enterprise deployment tooling (SCCM/Intune) — scope exclusions to those service accounts
level: high
KQL — Microsoft Sentinel / Defender
This hunt looks for the process-tree pattern of DreamJob execution joined with outbound network connections exhibiting post-quantum handshake characteristics (large early-session byte volumes to rare destinations). It also surfaces persistence artifacts from the same process lineage.
// Hunt: Document reader spawning LOLBins, correlated with outbound connections
// exhibiting abnormally large initial payloads (post-quantum key exchange signature)
// and subsequent persistence artifacts.
let lookback = 14d;
let lureParents = dynamic(["winword.exe","excel.exe","powerpnt.exe","acrord32.exe","acrobat.exe","foxitreader.exe","msedge.exe","explorer.exe"]);
let suspChildren = dynamic(["powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","cmd.exe","certutil.exe","bitsadmin.exe"]);
let suspProc =
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName in~ (lureParents)
| where FileName in~ (suspChildren)
| extend LureDoc = InitiatingProcessCommandLine
| project ProcTime=TimeGenerated, DeviceId, DeviceName, LureDoc,
ChildProc=FileName, ChildCmd=ProcessCommandLine,
ChildSHA256=SHA256, AccountName,
ReportId, InitiatingProcessId=InitiatingProcessId;
let bigNet =
DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where RemotePort in (443, 8443, 8080)
| where RemoteUrl !has_any ("microsoft.com","office.com","windows.com","google.com","azure.com")
| summarize FirstConn=min(TimeGenerated), ConnCount=count(),
RemoteIPs=make_set(RemoteIP), URLs=make_set(RemoteUrl)
by DeviceId, InitiatingProcessId, InitiatingProcessFileName
| where ConnCount >= 2;
let persistence =
DeviceEvents
| where TimeGenerated > ago(lookback)
| where ActionType has_any ("ScheduledTaskCreated","RegistryValueSet")
| where tostring(AdditionalFields) has_any ("\\AppData\\","\\Temp\\","CurrentVersion\\Run","schtasks")
| project PersistTime=TimeGenerated, DeviceId, ActionType,
PersistDetail=tostring(AdditionalFields), InitiatingProcessFileName;
suspProc
| join kind=inner bigNet on DeviceId
| join kind=leftouter persistence on DeviceId
| summarize arg_min(ProcTime, *) by DeviceId, ChildProc
| project ProcTime, DeviceName, AccountName, LureDoc, ChildProc, ChildCmd,
ChildSHA256, RemoteIPs, URLs, ConnCount, ActionType, PersistDetail
| sort by ProcTime desc
Velociraptor VQL
Use this artifact for targeted endpoint triage on hosts flagged by the KQL hunt or exposed to DreamJob-style lures (staff in defense, aerospace, crypto, or finance roles contacted by recruiters).
-- Security Arsenal: Lazarus DreamJob Triage Hunt
-- Identifies: (1) lure-spawned suspicious processes, (2) unsigned/recent executables
-- in user staging dirs, (3) persistence artifacts referencing those paths,
-- (4) active network connections from non-browser userland processes.
-- Part 1: Suspicious process ancestry (document reader -> interpreter/LOLBin)
LET suspicious_children = ('powershell.exe','pwsh.exe','wscript.exe','cscript.exe','mshta.exe','rundll32.exe','regsvr32.exe','certutil.exe','bitsadmin.exe')
LET doc_parents = ('winword.exe','excel.exe','powerpnt.exe','acrord32.exe','acrobat.exe','foxitreader.exe')
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime,
parent.Name AS ParentName, parent.CommandLine AS ParentCommandLine
FROM pslist()
LET parent = SELECT Name, CommandLine FROM pslist(pid=Ppid)
WHERE Name IN suspicious_children
AND ParentName IN doc_parents
-- Part 2: Recent unsigned executables in staging directories (last 30 days)
SELECT FullPath, Size, Mtime, Authenticode
FROM glob(globs=['C:/Users/*/Downloads/**/*.exe',
'C:/Users/*/AppData/Local/Temp/**/*.exe',
'C:/Users/*/AppData/Roaming/**/*.exe',
'C:/ProgramData/**/*.exe'],
accessor='ntfs')
WHERE Mtime > now() - 2592000
-- Part 3: Run-key and scheduled-task persistence pointing at user paths
SELECT Name, FullPath, Data.value AS ValueData, Mtime
FROM glob(globs=[
'HKEY_USERS/*/Software/Microsoft/Windows/CurrentVersion/Run/*',
'HKEY_USERS/*/Software/Microsoft/Windows/CurrentVersion/RunOnce/*',
'HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/*'],
accessor='registry')
WHERE ValueData =~ '(AppData|Temp|ProgramData|rundll32|regsvr32)'
-- Part 4: Outbound 443 connections from non-standard processes
SELECT Pid, Name, Path, Status, Laddr, Raddr
FROM netstat()
WHERE Raddr.IP =~ '^(?!10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.).*$'
AND Raddr.Port =~ '^(443|8443|8080)$'
AND Name NOT IN ('chrome.exe','firefox.exe','msedge.exe','brave.exe','svchost.exe','Teams.exe','OneDrive.exe','Outlook.exe')
Remediation & Verification Script
Run this PowerShell (elevated) on suspected or exposed endpoints to (a) check for persistence artifacts in the locations DreamJob loaders abuse, (b) flag recently dropped unsigned executables in staging paths, (c) verify the endpoint's Windows patch level against the current cumulative update, and (d) confirm Defender tamper protection and cloud-delivered protection are enabled.
# Security Arsenal — Lazarus DreamJob Endpoint Verification
# Run elevated. Outputs findings to console and C:\IR\DreamJob_Triage_<host>.txt
$out = "C:\IR"
New-Item -ItemType Directory -Path $out -Force | Out-Null
$log = Join-Path $out ("DreamJob_Triage_{0}.txt" -f $env:COMPUTERNAME)
function W($m){ $m | Tee-Object -FilePath $log -Append }
W "=== DreamJob Triage: $(Get-Date) on $env:COMPUTERNAME ==="
# 1) Verify current cumulative update is installed (last 45 days)
W "`n[1] Recent Windows Updates (last 45 days):"
$cutoff = (Get-Date).AddDays(-45)
Get-HotFix | Where-Object { $_.InstalledOn -ge $cutoff } |
Sort-Object InstalledOn -Descending |
ForEach-Object { W (" {0} {1} {2}" -f $_.HotFixID, $_.Description, $_.InstalledOn) }
$lastCU = Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 1
if (-not $lastCU -or $lastCU.InstalledOn -lt $cutoff) {
W " [!] WARNING: No cumulative update installed in the last 45 days. Patch immediately when the vendor fix for this zero-day ships."
}
# 2) Persistence: Run keys referencing user-writable paths
W "`n[2] Run/RunOnce keys referencing AppData/Temp/ProgramData:"
$runPaths = @(
'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce'
)
foreach ($p in $runPaths) {
if (Test-Path $p) {
Get-ItemProperty $p | ForEach-Object {
$_.PSObject.Properties | Where-Object {
$_.Name -notmatch '^PS' -and $_.Value -match 'AppData|Temp|ProgramData'
} | ForEach-Object { W (" [!] {0} :: {1} = {2}" -f $p, $_.Name, $_.Value) }
}
}
}
# 3) Persistence: scheduled tasks launching from user paths
W "`n[3] Scheduled tasks with actions in user-writable paths:"
Get-ScheduledTask | ForEach-Object {
$task = $_
$task.Actions | Where-Object {
$_.Execute -match 'AppData|Temp|ProgramData' -and
$_.Execute -notmatch 'OneDrive|Teams|EdgeUpdate|GoogleUpdate'
} | ForEach-Object {
W (" [!] Task '{0}' -> {1} {2}" -f $task.TaskName, $_.Execute, $_.Arguments)
}
}
# 4) Recent unsigned executables in staging directories (30 days)
W "`n[4] Executables created in staging dirs in last 30 days:"
$stageDirs = @(
"$env:USERPROFILE\Downloads",
"$env:TEMP",
"$env:APPDATA",
"C:\ProgramData"
)
foreach ($d in $stageDirs) {
if (Test-Path $d) {
Get-ChildItem $d -Recurse -Include *.exe,*.dll -ErrorAction SilentlyContinue |
Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-30) } |
ForEach-Object {
$sig = Get-AuthenticodeSignature $_.FullName
$flag = if ($sig.Status -ne 'Valid') { '[UNSIGNED/INVALID]' } else { '[signed]' }
W (" {0} {1} (created {2})" -f $flag, $_.FullName, $_.CreationTime)
}
}
}
# 5) Defender posture: cloud protection + tamper protection (PQ-encrypted C2 makes EDR your primary sensor)
W "`n[5] Microsoft Defender posture:"
$mp = Get-MpPreference
$status = Get-MpComputerStatus
W (" Real-time protection: {0}" -f $status.RealTimeProtectionEnabled)
W (" Cloud-delivered protection (MAPS): {0}" -f $mp.MAPSReporting)
W (" Cloud block level: {0}" -f $mp.CloudBlockLevel)
W (" Tamper protection: {0}" -f $status.IsTamperProtected)
W (" Signature age (days): {0}" -f $status.AntivirusSignatureAge)
if ($mp.MAPSReporting -lt 2) {
W " [!] RECOMMEND: Enable MAPS advanced membership -> Set-MpPreference -MAPSReporting Advanced"
}
if ($status.AntivirusSignatureAge -gt 1) {
W " [!] RECOMMEND: Update signatures -> Update-MpSignature"
}
# 6) Lateral surface hardening check: Office macro + child process ASR rules
W "`n[6] ASR rule posture (key rules for lure execution):"
$asrRules = @{
'D4F940AB-401B-4EFC-AADC-AD5F3C50688A' = 'Block Office apps from creating child processes'
'3B576869-A4EC-4529-8536-B80A7769E899' = 'Block Office apps from creating executable content'
'75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84' = 'Block Office apps from injecting code'
'BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550' = 'Block executable content from email client and webmail'
}
foreach ($id in $asrRules.Keys) {
$idx = [array]::IndexOf($mp.AttackSurfaceReductionRules_Ids, $id)
$mode = if ($idx -ge 0) { $mp.AttackSurfaceReductionRules_Actions[$idx] } else { 'not configured' }
$modeText = switch ($mode) { 1 {'BLOCK'} 2 {'AUDIT'} 0 {'DISABLED'} default {$mode} }
W (" {0}: {1}" -f $asrRules[$id], $modeText)
}
W "`n=== Triage complete. Escalate any [!] unsigned-executable or persistence findings to IR. ==="
Remediation
Immediate Actions (0–72 hours)
-
Deploy the detections above. The Sigma rules, KQL hunt, and VQL artifact target the DreamJob execution chain — the one stage of this attack that remains reliably visible now that the C2 channel is PQ-protected. Prioritize deployment to endpoints used by staff in roles Lazarus targets: software engineers, security researchers, defense/aerospace personnel, and cryptocurrency/finance employees.
-
Harden against the lure, not just the bug. Until Microsoft ships the patch for the exploited Windows vulnerability, your compensating control is breaking the delivery chain:
- Enable the four Attack Surface Reduction rules enumerated in the triage script (Office child process, executable content creation, code injection, and email-delivered executable content) in block mode after a brief audit-mode validation.
- Enforce Mark of the Web handling: block execution of unsigned executables originating from the internet zone via SmartScreen and Application Control (WDAC/AppLocker).
- Restrict
wscript,cscript, andmshtafor standard users via AppLocker — DreamJob loaders lean on these heavily.
-
User-targeted awareness — surgical, not generic. Notify engineering, research, and finance staff specifically: unsolicited job offers involving document downloads, "assessment" archives, or custom PDF/viewing tools are the exact delivery mechanism in this campaign. Require that any recruiter-sent software or document be opened only in a sandboxed environment or forwarded to the SOC first.
Patch Management (When the Fix Ships)
- Monitor Microsoft's Security Update Guide and the CISA Known Exploited Vulnerabilities catalog daily for the CVE assignment and patch release. No CVE identifier has been published at the time of writing — do not wait for one to begin the compensating controls above.
- When the CVE lands on CISA KEV, federal civilian agencies will face a binding remediation deadline (historically 2–3 weeks for actively exploited Windows flaws); treat that deadline as your private-sector benchmark.
- Pre-stage your deployment rings now: identify internet-facing and high-target-role endpoints for expedited patching within 48 hours of patch release.
Network Detection Strategy Adjustments
- Accept reduced TLS inspection value against this actor. Do not assume your SSL proxy sees meaningful content inside Lazarus C2 sessions. Pivot network detection to metadata: rare destination domains/IPs with no organizational history, long-lived low-frequency HTTPS sessions from non-browser processes, and sessions with anomalous early-payload sizes (PQ key exchange produces handshakes materially larger than classical TLS).
- Block newly registered domains (<30 days) at the DNS layer for the targeted user populations — DreamJob C2 infrastructure is routinely stood up on fresh domains with legitimate-looking recruiter themes.
- Do not rely on retrospective packet capture analysis for this campaign's C2 content — the post-quantum key exchange is engineered specifically to defeat it. Invest that effort in endpoint telemetry retention instead.
Threat Hunting Cadence
- Run the KQL hunt weekly across the full estate, and the Velociraptor artifact on-demand against any host matching DreamJob exposure criteria (recruiter contact + document download + unexpected process execution).
- Retain
DeviceProcessEventsandDeviceNetworkEventstelemetry for a minimum of 90 days for targeted-role users — Lazarus intrusions frequently dwell for weeks before the zero-day stage is delivered.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.