Kyber Ransomware: Post-Quantum Hybrid Encryption Operation Targeting Windows & VMware ESXi
Kyber Ransomware (TL-2026-0412), also tracked as Kyber Ransomware, is a critical-severity ransomware operation scored CVSS 9.1, first published 2026-04-22. It is attributed to Kyber Group (Russia) with low confidence, affects VMware (Broadcom) ESXi, references 6 CVEs (CVE-2020-1472, CVE-2023-27997, CVE-2024-21762), maps to 31 MITRE ATT&CK techniques (T1003.001, T1003.006, T1018), and is covered by 9 detection rules and 29 indicators of compromise.
Key facts for TL-2026-0412
- Threat ID
- TL-2026-0412
- Also known as
- Kyber Ransomware, Kyber1024 Locker, Operation LatticeLock
- Severity
- CRITICAL
- CVSS
- 9.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- 2026-04-22
- Last reviewed
- 2026-04-22
- Attribution
- Kyber Group
- Attribution confidence
- LOW
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- healthcare, financial services, manufacturing, government, managed service providers, higher education, technology, legal services
- Target regions
- North America, Europe, Australia, Latin America
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in Kyber Ransomware
Malware and tooling: kyber, AdFind - S0552, Cobalt Strike, NetSupport RAT, Rclone - S1040
Kyber is a novel ransomware operation first observed in Q2 2026 that implements Kyber1024 post-quantum lattice-based key encapsulation combined with classical AES-256-GCM hybrid encryption across Windows endpoints and VMware ESXi hypervisors. The group operates double-extortion campaigns, exfiltrating data before encryption and publishing victims to a dedicated Tor leak site. The adoption of a CRYSTALS-Kyber post-quantum primitive in ransomware design represents a paradigm shift aimed at blocking any future harvest-now-decrypt-later recovery attempts by nation-state or law-enforcement quantum decryption capabilities.
How Kyber Ransomware works
Kyber ransomware is a newly observed ransomware-as-a-service (RaaS) operation whose encryptor was first submitted to public malware repositories on 2026-04-18 and which was publicly profiled by BleepingComputer on 2026-04-21. The malware ships as two distinct payloads: a Windows PE64 executable (kyber.exe / kyber_locker.exe) and a statically-linked ELF64 binary for VMware ESXi (kyber_esxi). Both payloads share a common Rust-based encryption core built on the liboqs 0.10.x library and implement a hybrid cryptographic scheme in which a per-file AES-256-GCM symmetric key is encapsulated using CRYSTALS-Kyber1024 (NIST FIPS 203 ML-KEM-1024) against a hardcoded public key embedded in the binary. The corresponding Kyber1024 private key is held exclusively by the operators, making decryption without the key computationally infeasible under both classical and quantum adversary models.
On Windows, the encryptor terminates ~187 services and processes associated with backup software (Veeam, Acronis, Commvault), databases (MSSQL, Oracle, MySQL, PostgreSQL), Exchange, and security tooling prior to encryption. It deletes Volume Shadow Copies via `vssadmin.exe delete shadows /all /quiet`, clears Windows event logs, and disables Windows Recovery Environment using `bcdedit /set {default} recoveryenabled No` and `bcdedit /set {default} bootstatuspolicy ignoreallfailures`. Files are renamed with the `.kyber1024` extension and a per-directory ransom note `HOW_TO_RECOVER_KYBER.txt` is dropped.
On VMware ESXi, the attacker first gains shell access to the hypervisor (typically via stolen vCenter credentials, SSH enabled post-compromise, or exploitation of prior ESXi CVEs), enumerates running virtual machines with `esxcli vm process list`, force-kills them via `esxcli vm process kill --type=force --world-id=<id>`, and then invokes the encryptor against VMFS datastores at `/vmfs/volumes/`. The ESXi variant targets files with extensions `.vmdk`, `.vmx`, `.vmsn`, `.vmsd`, `.vswp`, `.nvram`, and `.log`, encrypting only the first 1 MiB of large VMDK files in intermittent-encryption mode (every 64 KiB of an 8 MiB block) to accelerate mass encryption while still rendering VM disks unbootable.
Initial access has been observed through three vectors: (1) exploitation of internet-facing ScreenConnect, Fortinet SSL-VPN, and Citrix NetScaler appliances using n-day CVEs; (2) purchase of valid VPN/RDP credentials from initial-access brokers; and (3) targeted spear-phishing of IT administrators with malicious ISO attachments delivering NetSupport RAT as a foothold. Post-compromise, the actors use Cobalt Strike 4.10 beacons over HTTPS, AdFind for Active Directory reconnaissance, Rclone for exfiltration to Mega.nz and a hardcoded Backblaze B2 bucket, and Advanced IP Scanner for lateral enumeration. Domain privilege escalation has been observed via Zerologon (CVE-2020-1472) on unpatched DCs and via DCSync using compromised privileged accounts.
Double-extortion is enforced via a Tor leak site (kyberleaksxxxxx[.]onion) that lists non-paying victims with sample file trees, and a dedicated negotiation portal requires victims to authenticate with a unique per-victim token embedded in the ransom note. Initial demands have been observed between 1.5 and 8 BTC for SMB targets and upward of 30 BTC for enterprise ESXi-wide encryption events.
MITRE ATT&CK techniques used in TL-2026-0412
Credential Access
T1003.001 OS Credential Dumping: LSASS Memory; T1003.006 OS Credential Dumping: DCSync
Discovery
T1018 Remote System Discovery; T1046 Network Service Discovery; T1482 Domain Trust Discovery
Lateral Movement
T1021.002 Remote Services: SMB/Windows Admin Shares; T1021.004 Remote Services: SSH
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task; T1136.001 Create Account: Local Account
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1059.004 Command and Scripting Interpreter: Unix Shell
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Defense Evasion
T1070.004 Indicator Removal: File Deletion
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1573.002 Encrypted Channel: Asymmetric Cryptography
Initial Access
T1078.002 Valid Accounts: Domain Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1566.001 Phishing: Spearphishing Attachment
Impact
T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery; T1529 System Shutdown/Reboot
Collection
Exfiltration
T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
Resource Development
T1583 Acquire Infrastructure; T1588.001 Obtain Capabilities: Malware
Reconnaissance
T1592 Gather Victim Host Information
defense-impairment
T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs
Affected products and versions in Kyber Ransomware
- VMware (Broadcom) — ESXi
Vulnerable versions: 6.7; 7.0 U1; 7.0 U2; 7.0 U3 (pre-U3s); 8.0; 8.0 U1; 8.0 U2
Fixed in: 7.0 U3s+; 8.0 U3+ - VMware (Broadcom) — vCenter Server
Vulnerable versions: 7.0 U3; 8.0 U1; 8.0 U2
Fixed in: 7.0 U3s+; 8.0 U3+ - Microsoft — Windows
Vulnerable versions: 10; 11; Server 2016; Server 2019; Server 2022 - Microsoft — Windows Server (Domain Controller, Zerologon)
Vulnerable versions: Server 2008 R2; Server 2012; Server 2012 R2; Server 2016; Server 2019
Fixed in: Patched with KB4601348+ - Fortinet — FortiGate / FortiOS SSL-VPN
Vulnerable versions: 6.x; 7.0.x <7.0.15; 7.2.x <7.2.9; 7.4.x <7.4.4
Fixed in: 7.4.4+; 7.2.9+; 7.0.15+ - Citrix — NetScaler ADC / Gateway
Vulnerable versions: 13.0 <13.0-92.19; 13.1 <13.1-49.15; 14.1 <14.1-8.50
Fixed in: 13.1-49.15+; 14.1-8.50+ - ConnectWise — ScreenConnect
Vulnerable versions: <23.9.8
Fixed in: 23.9.8+
Remediation for Kyber Ransomware
Patches
- VMware ESXi 8.0 U3 / 7.0 U3s / 6.7 EOL (VMSA-2024-0006, VMSA-2024-0013 for prior CVEs often abused for access)
- Patch CVE-2020-1472 (Zerologon) on all Domain Controllers (KB4601348 or later cumulative)
- Patch Fortinet FortiOS SSL-VPN (CVE-2023-27997, CVE-2024-21762, CVE-2024-55591) to latest FortiOS 7.4.4+
- Patch Citrix NetScaler ADC/Gateway (CVE-2023-4966 CitrixBleed, CVE-2024-8534) to current supported builds
- Patch ConnectWise ScreenConnect (CVE-2024-1708/1709) to version 23.9.8 or later
Immediate actions
- Isolate ESXi hosts from general VLANs and restrict management-network access to a hardened jump-host only
- Enable ESXi lockdown mode (Strict) and disable SSH/ESXi Shell on all hypervisors except during change windows
- Revoke and rotate all vCenter and ESXi local accounts; enforce MFA on vCenter via SSO identity provider
- Block outbound traffic to Mega.nz, Backblaze B2, and known Cobalt Strike team server IPs at the perimeter
- Deploy emergency EDR/AV signatures for the kyber.exe and kyber_esxi hashes listed in the IOC set
- Hunt for pre-encryption reconnaissance: AdFind, Advanced IP Scanner, Rclone, and NetSupport RAT telemetry
- Verify immutable / air-gapped backup copies exist for all Tier-0 and Tier-1 VMs and test restore procedures
Workarounds
- Disable SSH and ESXi Shell on all ESXi hosts via DCUI or Host Client until MFA-gated bastion access is deployed
- Place ESXi management interfaces behind firewall ACLs allowing only vCenter and jump-host source IPs
- Block the Kyber leak site and negotiation portal Tor bridge IPs at egress to deter C2/negotiation callbacks
- Force VSS writer protection via Controlled Folder Access on Windows 10/11 and Server 2019/2022
Longer-term hardening
- Deploy EDR with behavior-based ransomware rollback (MDE, CrowdStrike Falcon, SentinelOne) on every Windows endpoint
- Migrate VMware ESXi hosts to vSphere 8.0 U3 and enable Secure Boot, TPM 2.0, and vSphere Native Key Provider
- Implement network segmentation: management, vMotion, storage, and VM traffic on isolated VLANs with no east-west trust
- Adopt an immutable-backup architecture (Veeam hardened repository, Rubrik, Cohesity) with 3-2-1-1-0 rule compliance
- Implement privileged access workstations (PAWs) for all vSphere administrators and enforce just-in-time elevation
- Continuously monitor vCenter and ESXi audit logs in a SIEM; alert on SSH enablement, new local users, and lockdown-mode changes
CVEs associated with Kyber Ransomware
CVE-2020-1472, CVE-2023-27997, CVE-2024-21762, CVE-2023-4966, CVE-2024-1708, CVE-2024-1709
Weaknesses (CWE) in Kyber Ransomware
CWE-284, CWE-522, CWE-311, CWE-326, CWE-400
Timeline of Kyber Ransomware
- NIST publishes FIPS 203 ML-KEM (CRYSTALS-Kyber) as the finalized post-quantum key encapsulation standard, enabling production implementations via liboqs.
- Russian-language cybercrime forum XSS advertisement for an 'enterprise-grade quantum-resistant locker' project, later attributed to the Kyber operators, posted by handle 'k1024r'.
- Registration of domain kyberleaks[.]xyz and first Tor v3 hidden service kyberleaksxxxxx[.]onion observed via passive DNS and Tor descriptor monitoring.
- First confirmed Kyber ransomware incident: a North American MSP ESXi cluster encrypted, approximately 380 customer VMs rendered inoperative.
- European manufacturing group listed on Kyber leak site with 1.2 TB of exfiltrated engineering data; negotiation portal activity observed.
- Operators begin abusing Fortinet FortiOS SSL-VPN CVE-2024-21762 and ConnectWise ScreenConnect CVE-2024-1709 as preferred initial access vectors.
- Windows (kyber.exe) and ESXi (kyber_esxi) samples first uploaded to public malware repositories; Rust binary with liboqs 0.10.x imports confirmed via static analysis.
- BleepingComputer publishes profile of Kyber ransomware confirming post-quantum Kyber1024 KEM adoption and ESXi-specific encryption logic.
- Threadlinqs Intelligence publishes TL-2026-0412 with full TTPs, MITRE mapping, IOCs, and detection content.
- As of 2026-05-29, Kyber ransomware remains an active RaaS operation: its Tor leak site was confirmed live (ransomware.live, checked 2026-05-30) with no takedown, arrest, or sinkhole, and Rapid7/SOC Prime/CYFIRMA report ongoing Windows+ESXi attacks. Rapid7 notes the ESXi variant's post-quantum claim is partly false (ChaCha8+RSA-4096), but the Windows variant genuinely uses Kyber1024; n-day initial-access CVEs are patched yet still exploited.
Sources cited for Kyber Ransomware
- BleepingComputer: New Kyber Ransomware Uses Post-Quantum Encryption, Targets VMware ESXi
- NIST FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM / CRYSTALS-Kyber)
- Open Quantum Safe: liboqs library
- CISA #StopRansomware: Guide on Securing VMware ESXi
- MITRE ATT&CK: Data Encrypted for Impact (T1486)
- VMware Security Advisory VMSA-2024-0013 (ESXi patches routinely abused for ransomware access)
- CISA KEV: CVE-2020-1472 Zerologon
- Fortinet PSIRT FG-IR-24-015 (CVE-2024-21762 SSL-VPN Out-of-Bound Write)
- Mandiant: Ransomware Operators Shift Focus to ESXi Hypervisors
- CrowdStrike 2026 Global Threat Report: Ransomware trends
Threats related to Kyber Ransomware
- VECT Ransomware 2.0 — Russian-Speaking RaaS with ChaCha20 Buffer-Reuse Bug Producing Permanent Data Destruction (Wiper-by-Accident) Across Windows, Linux, and ESXi
- Proofpoint AI Era Ransomware Report: 37% of Paying Victims Face Repeat Extortion Demands
- Payouts King Ransomware Uses QEMU Virtual Machines to Bypass EDR and Endpoint Security Controls
- FortiBleed Credential Theft Campaign: FortigateSniffer Tool Deployed Against 430,000+ FortiGate Firewalls, Linked to INC Ransom and Lynx Ransomware
- LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S. Bancorp)
- Payouts King Ransomware — BlackBasta Successor Operation Targeting US Manufacturing, Healthcare, and Construction Sectors
Detection coverage for TL-2026-0412
As of 2026-04-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0412 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.