Kyber Ransomware: Post-Quantum Hybrid Encryption Operation Targeting Windows & VMware ESXi — Threadlinqs Intelligence
As of 2026-05-30, Kyber Ransomware: Post-Quantum Hybrid Encryption Operation Targeting Windows & VMware ESXi is a critical-severity ransomware threat attributed to Kyber Group (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 29 indicators of compromise.
Threat ID: TL-2026-0412 · Severity: CRITICAL · CVSS: 9.1 · Status: ACTIVE · Category: RANSOMWARE
Attribution: Kyber Group · Russia · FINANCIAL
Kyber is a novel ransomware operation first observed in Q2 2026 that implements Kyber1024 post-quantum lattice-based key encapsulation combined with classical AES-256-GCM hybrid encryption across
Kyber ransomware is a newly observed ransomware-as-a-service (RaaS) operation whose encryptor was first submitted to public malware repositories on 2026-04-18 and which was publicly profiled by BleepingComputer on 2026-04-21. The malware ships as two distinct payloads: a Windows PE64 executable (kyber.exe / kyber_locker.exe) and a statically-linked ELF64 binary for VMware ESXi (kyber_esxi). Both payloads share a common Rust-based encryption core built on the liboqs 0.10.x library and implement a hybrid cryptographic scheme in which a per-file AES-256-GCM symmetric key is encapsulated using CRYSTALS-Kyber1024 (NIST FIPS 203 ML-KEM-1024) against a hardcoded public key embedded in the binary. The corresponding Kyber1024 private key is held exclusively by the operators, making decryption without the key computationally infeasible under both classical and quantum adversary models.
On Windows, the encryptor terminates ~187 services and processes associated with backup software (Veeam, Acronis, Commvault), databases (MSSQL, Oracle, MySQL, PostgreSQL), Exchange, and security tooling prior to encryption. It deletes Volume Shadow Copies via `vssadmin.exe delete shadows /all /quiet`, clears Windows event logs, and disables Windows Recovery Environment using `bcdedit /set {default} recoveryenabled No` and `bcdedit /set {default} bootstatuspolicy ignoreallfailures`. Files are renamed with the `.kyber1024` extension and a per-directory ransom note `HOW_TO_RECOVER_KYBER.txt` is dropped.
On VMware ESXi, the attacker first gains shell access to the hypervisor (typically via stolen vCenter credentials, SSH enabled post-compromise, or exploitation of prior ESXi CVEs), enumerates running virtual machines with `esxcli vm process list`, force-kills them via `esxcli vm process kill --type=force --world-id=<id>`, and then invokes the encryptor against VMFS datastores at `/vmfs/volumes/`. The ESXi variant targets files with extensions `.vmdk`, `.vmx`, `.vmsn`, `.vmsd`, `.vswp`, `.nvram`, and `.log`, encrypting only the first 1 MiB of large VMDK files in intermittent-encryption mode (every 64 KiB of an 8 MiB block) to accelerate mass encryption while still rendering VM disks unbootable.
Initial access has been observed through three vectors: (1) exploitation of internet-facing ScreenConnect, Fortinet SSL-VPN, and Citrix NetScaler appliances using n-day CVEs; (2) purchase of valid VPN/RDP credentials from initial-access brokers; and (3) targeted spear-phishing of IT administrators with malicious ISO attachments delivering NetSupport RAT as a foothold. Post-compromise, the actors use Cobalt Strike 4.10 beacons over HTTPS, AdFind for Active Directory reconnaissance, Rclone for exfiltration to Mega.nz and a hardcoded Backblaze B2 bucket, and Advanced IP Scanner for lateral enumeration. Domain privilege escalation has been observed via Zerologon (CVE-2020-1472) on unpatched DCs and via DCSync using compromised privileged accounts.
Double-extortion is enforced via a Tor leak site (kyberleaksxxxxx[.]onion) that lists non-paying victims with sample file trees, and a dedicated negotiation portal requires victims to authenticate with a unique per-victim token embedded in the ransom note. Initial demands have been observed between 1.5 and 8 BTC for SMB targets and upward of 30 BTC for enterprise ESXi-wide encryption events.
Weaknesses (CWE)
CWE-284, CWE-522, CWE-311, CWE-326, CWE-400
Target sectors: healthcare, financial services, manufacturing, government, managed service providers, higher education, technology, legal services
Target regions: North America, Europe, Australia, Latin America
Detections & IOCs
As of 2026-07-26, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 29 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
RANSOMWARE, CRITICAL, threat intelligence, cybersecurity, CVE-2020-1472, CVE-2023-27997, CVE-2024-21762, CVE-2023-4966, CVE-2024-1708, CVE-2024-1709, T1592, T1583, T1588.001, T1190, T1078.002, T1566.001, T1133, T1059.001, T1059.003, T1059.004