# Kyber Ransomware: Post-Quantum Hybrid Encryption Operation Targeting Windows & VMware ESXi

> Kyber is a novel ransomware operation first observed in Q2 2026 that implements Kyber1024 post-quantum lattice-based key encapsulation combined with classical AES-256-GCM hybrid encryption across Windows endpoints and VMware ESXi hypervisors. The group operates double-extortion campaigns, exfiltrating data before encryption and publishing victims to a dedicated Tor leak site. The adoption of a CRYSTALS-Kyber post-quantum primitive in ransomware design represents a paradigm shift aimed at blocking any future harvest-now-decrypt-later recovery attempts by nation-state or law-enforcement quantum decryption capabilities.

- **Published:** 2026-04-22T12:00:00Z
- **Last reviewed:** 2026-04-22T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0412
- **ID:** TL-2026-0412
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Kyber Group (Russia)
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2020-1472, CVE-2023-27997, CVE-2024-21762, CVE-2023-4966, CVE-2024-1708, CVE-2024-1709

## Description

Kyber ransomware is a newly observed ransomware-as-a-service (RaaS) operation whose encryptor was first submitted to public malware repositories on 2026-04-18 and which was publicly profiled by BleepingComputer on 2026-04-21. The malware ships as two distinct payloads: a Windows PE64 executable (kyber.exe / kyber_locker.exe) and a statically-linked ELF64 binary for VMware ESXi (kyber_esxi). Both payloads share a common Rust-based encryption core built on the liboqs 0.10.x library and implement a hybrid cryptographic scheme in which a per-file AES-256-GCM symmetric key is encapsulated using CRYSTALS-Kyber1024 (NIST FIPS 203 ML-KEM-1024) against a hardcoded public key embedded in the binary. The corresponding Kyber1024 private key is held exclusively by the operators, making decryption without the key computationally infeasible under both classical and quantum adversary models.

On Windows, the encryptor terminates ~187 services and processes associated with backup software (Veeam, Acronis, Commvault), databases (MSSQL, Oracle, MySQL, PostgreSQL), Exchange, and security tooling prior to encryption. It deletes Volume Shadow Copies via `vssadmin.exe delete shadows /all /quiet`, clears Windows event logs, and disables Windows Recovery Environment using `bcdedit /set {default} recoveryenabled No` and `bcdedit /set {default} bootstatuspolicy ignoreallfailures`. Files are renamed with the `.kyber1024` extension and a per-directory ransom note `HOW_TO_RECOVER_KYBER.txt` is dropped.

On VMware ESXi, the attacker first gains shell access to the hypervisor (typically via stolen vCenter credentials, SSH enabled post-compromise, or exploitation of prior ESXi CVEs), enumerates running virtual machines with `esxcli vm process list`, force-kills them via `esxcli vm process kill --type=force --world-id=<id>`, and then invokes the encryptor against VMFS datastores at `/vmfs/volumes/`. The ESXi variant targets files with extensions `.vmdk`, `.vmx`, `.vmsn`, `.vmsd`, `.vswp`, `.nvram`, and `.log`, encrypting only the first 1 MiB of large VMDK files in intermittent-encryption mode (every 64 KiB of an 8 MiB block) to accelerate mass encryption while still rendering VM disks unbootable.

Initial access has been observed through three vectors: (1) exploitation of internet-facing ScreenConnect, Fortinet SSL-VPN, and Citrix NetScaler appliances using n-day CVEs; (2) purchase of valid VPN/RDP credentials from initial-access brokers; and (3) targeted spear-phishing of IT administrators with malicious ISO attachments delivering NetSupport RAT as a foothold. Post-compromise, the actors use Cobalt Strike 4.10 beacons over HTTPS, AdFind for Active Directory reconnaissance, Rclone for exfiltration to Mega.nz and a hardcoded Backblaze B2 bucket, and Advanced IP Scanner for lateral enumeration. Domain privilege escalation has been observed via Zerologon (CVE-2020-1472) on unpatched DCs and via DCSync using compromised privileged accounts.

Double-extortion is enforced via a Tor leak site (kyberleaksxxxxx[.]onion) that lists non-paying victims with sample file trees, and a dedicated negotiation portal requires victims to authenticate with a unique per-victim token embedded in the ransom note. Initial demands have been observed between 1.5 and 8 BTC for SMB targets and upward of 30 BTC for enterprise ESXi-wide encryption events.

## MITRE ATT&CK

- T1592 Gather Victim Host Information
- T1583 Acquire Infrastructure
- T1588.001 Obtain Capabilities: Malware
- T1190 Exploit Public-Facing Application
- T1078.002 Valid Accounts: Domain Accounts
- T1566.001 Phishing: Spearphishing Attachment
- T1133 External Remote Services
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1136.001 Create Account: Local Account
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1068 Exploitation for Privilege Escalation
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1070.004 Indicator Removal: File Deletion
- T1003.001 OS Credential Dumping: LSASS Memory
- T1003.006 OS Credential Dumping: DCSync
- T1046 Network Service Discovery
- T1018 Remote System Discovery
- T1482 Domain Trust Discovery
- T1021.004 Remote Services: SSH
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1560 Archive Collected Data
- T1071.001 Application Layer Protocol: Web Protocols
- T1573.002 Encrypted Channel: Asymmetric Cryptography
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1529 System Shutdown/Reboot

## Sources

- [BleepingComputer: New Kyber Ransomware Uses Post-Quantum Encryption, Targets VMware ESXi](https://www.bleepingcomputer.com/news/security/new-kyber-ransomware-uses-post-quantum-encryption-targets-vmware-esxi/)
- [NIST FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM / CRYSTALS-Kyber)](https://csrc.nist.gov/pubs/fips/203/final)
- [Open Quantum Safe: liboqs library](https://github.com/open-quantum-safe/liboqs)
- [CISA #StopRansomware: Guide on Securing VMware ESXi](https://www.cisa.gov/stopransomware/esxi)
- [MITRE ATT&CK: Data Encrypted for Impact (T1486)](https://attack.mitre.org/techniques/T1486/)
- [VMware Security Advisory VMSA-2024-0013 (ESXi patches routinely abused for ransomware access)](https://www.vmware.com/security/advisories/VMSA-2024-0013.html)
- [CISA KEV: CVE-2020-1472 Zerologon](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Fortinet PSIRT FG-IR-24-015 (CVE-2024-21762 SSL-VPN Out-of-Bound Write)](https://www.fortiguard.com/psirt/FG-IR-24-015)
- [Mandiant: Ransomware Operators Shift Focus to ESXi Hypervisors](https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence)
- [CrowdStrike 2026 Global Threat Report: Ransomware trends](https://www.crowdstrike.com/global-threat-report/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0412