Defend Post-Quantum Cryptography's “Harvest Now, Decrypt Later” with WAAP

Securing Against Post-Quantum "Harvest Now, Decrypt Later" Data Exfiltration via WAAP

TL;DR: Threat actors are actively exfiltrating currently encrypted sensitive data, anticipating future quantum decryption capabilities; immediate enhanced data loss prevention, particularly via WAAPs, is critical.

Technical Analysis

• Threat Vector: Adversaries are engaging in "Harvest Now, Decrypt Later" (HNDL) attacks by collecting data encrypted with current asymmetric cryptographic algorithms (e.g., RSA, ECC) for future decryption once cryptographically relevant quantum computers (CRQC) become available. This extends the lifespan and impact of data breaches.
• MITRE ATT&CK TTPs:
  • T1041: Exfiltration Over C2 Channel: Exfiltrating encrypted data through established command and control channels.
  • T1567: Exfiltration Over Web Service: Leveraging web services and APIs as exfiltration conduits, often masked as legitimate traffic.
  • T1560: Archive Collected Data: Compressing and encrypting collected data prior to exfiltration to facilitate bulk transfer and evade detection.
• Affected Specifications: Data protected by current public-key cryptography standards (e.g., RSA, ECDSA, Diffie-Hellman) is the primary target for long-term compromise. This includes sensitive intellectual property, personally identifiable information (PII), and national security data.
• IOCs: Not detailed in the source, as the focus is on the threat methodology and mitigation strategy rather than specific compromises.

Actionable Insight

• For Blue Teams/Detection Engineers: Implement advanced DLP and WAAP policies to detect and block abnormal data exfiltration patterns, especially from APIs and web applications. Prioritize monitoring of sensitive data outbound traffic for unusual volume, destination, or protocol usage. Update detection logic to identify potential data staging and exfiltration behaviors targeting encrypted data streams.
• For CISOs: Acknowledge the persistent threat of HNDL as a critical long-term data breach risk with implications extending far beyond immediate detection. Invest in robust WAAP and API security solutions as a primary defense layer against sophisticated data exfiltration vectors. This investment is complementary to, and precedes, the full transition to post-quantum cryptography, providing immediate protection against current data harvesting.

Source: https://www.akamai.com/blog/security/2025/nov/defend-post-quantum-harvest-now-decrypt-later-waap