Rapid7 Analyzes Kyber Ransomware’s Windows and ESXi Variants
Summary
Rapid7 analyzed Windows and ESXi Kyber ransomware samples recovered during a March 2026 response, finding distinct encryption implementations, shared campaign infrastructure, ESXi VM and datastore targeting, and Windows anti-recovery capabilities.
Key points
- Rapid7 recovered Windows and ESXi Kyber payloads during a March 2026 incident response engagement.
- The samples share a campaign identifier and Tor-based infrastructure, which the article says indicates coordinated cross-platform operations.
- The ESXi sample uses ChaCha8 with RSA-4096 key wrapping, despite ransom-note claims of AES-256-CTR and Kyber1024.
- The ESXi variant can terminate virtual machines, encrypt datastore files partially, and replace SSH and VMware management interface pages with ransom notes.
- The Windows variant implements AES-256-CTR, Kyber1024, and X25519, according to the article’s analysis.
- When elevated, the Windows variant can terminate targeted services and run commands to delete backups and shadow copies, disable recovery, and clear event logs.
- The Windows sample also includes an experimental option to forcibly stop Hyper-V virtual machines.
Article Details
- Attack Vectors
- The article does not describe how Kyber initially gains access to victim environments.
- The Linux/ESXi payload recursively traverses target directories and encrypts files in VMware datastores; with its vmkill option, it enumerates and terminates running VMs using esxcli.
- The Windows payload encrypts files and, when run with elevated privileges, terminates selected services and executes commands that delete shadow copies and backups, disable recovery, and clear Windows event logs.
- Both variants can deface access points by replacing the ESXi SSH login message and VMware web management pages; the Windows variant also has an experimental option to force-stop Hyper-V VMs.
- Defensive Notes
- According to the article, the Windows payload's service termination and anti-recovery commands require elevated privileges; without elevation, it performs file encryption only.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 45bff0df2c408b3f589aed984cc331b617021ecbea57171dac719b5f545f5e8d | SHA-256 hash of the Kyber Windows ransomware payload analyzed by Rapid7. |
| SHA256 | 6ccacb7567b6c0bd2ca8e68ff59d5ef21e8f47fc1af70d4d88a421f1fc5280fc | SHA-256 hash of the Kyber Linux/ESXi ransomware payload analyzed by Rapid7. |
MITRE ATT&CK
T1059.001 · PowerShellThe Windows payload invokes PowerShell commands to enumerate or stop Hyper-V VMs and to delete shadow copies.T1070.001 · Clear Windows Event LogsThe elevated Windows payload executes commands to clear all Windows event logs.T1083 · File and Directory DiscoveryThe ESXi payload recursively traverses directories to identify files for encryption.T1486 · Data Encrypted for ImpactBoth variants encrypt files for impact, including partial in-place encryption of ESXi datastore files and encryption of Windows files.T1489 · Service StopThe Windows variant terminates services matching patterns including msexchange, vss, backup, veeam, and sql; the ESXi variant can terminate running VMs.T1490 · Inhibit System RecoveryWhen elevated, the Windows variant deletes shadow copies and backups and disables Windows recovery settings.T1491.001 · Internal DefacementThe ESXi variant replaces the SSH login message and VMware web management interface pages with ransom-note content.
Threat Actors
Malware
Products
Microsoft Hyper-Vthe advertised hybrid Kyber1024 scheme and includes elevated service termination and experimental Hyper-V shutdown.Microsoft WindowsKyber is a cross-platform ransomware family that targets VMware ESXi datastores and Windows file systems with coordinated Tor-based infrastructure, campaign identifiers, and destructive anti-recovery features.VMware ESXiKyber is a cross-platform ransomware family that targets VMware ESXi datastores and Windows file systems with coordinated Tor-based infrastructure, campaign identifiers, and destructive anti-recovery features.