Rapid7 Finds Kyber Ransomware Uses Post-Quantum Key Protection Only in Windows Variant
Summary
Rapid7 analyzed Kyber ransomware variants found on one network in March 2026. The ESXi variant uses ChaCha8 and RSA-4096 despite Kyber1024 claims; the Windows variant uses Kyber1024 and X25519 to protect keys, with AES-CTR for files.
Key points
- Rapid7 analyzed two Kyber variants deployed on the same network in March 2026: one targeting VMware ESXi and one targeting Windows file servers.
- The ESXi variant enumerates virtual machines, encrypts datastore files, and defaces management interfaces with ransom notes.
- Despite advertising Kyber1024, the Linux ESXi encryptor uses ChaCha8 for file encryption and RSA-4096 for key wrapping.
- The Windows Rust variant uses Kyber1024 and X25519 to protect key material, while AES-CTR encrypts files.
- The Windows variant appends the .#~~~ extension, terminates services, deletes backups, and disables several recovery paths.
- Both variants share a campaign ID and Tor-based ransom infrastructure, which Rapid7 says indicates deployment by the same affiliate.
Article Details
- Attack Vectors
- The ESXi variant enumerates virtual machines, encrypts datastore files, and defaces ESXi management interfaces with ransom notes.
- The Windows Rust variant targets file servers, encrypts files with an appended .#~~~ extension, and includes an experimental feature to shut down Hyper-V virtual machines.
MITRE ATT&CK
T1070.001 · Clear Windows Event LogsThe Windows variant clears event logs.T1486 · Data Encrypted for ImpactBoth Kyber variants encrypt victim data: the ESXi variant encrypts datastore files, and the Windows variant encrypts files using AES-CTR.T1489 · Service StopThe Windows variant terminates SQL, Exchange, and backup services.T1490 · Inhibit System RecoveryThe Windows variant deletes backups and shadow copies and disables boot repair to impede data recovery.T1491.001 · Internal DefacementThe ESXi variant defaces management interfaces with ransom notes.T1529 · System Shutdown/RebootThe variants can terminate virtual machines, and the Windows variant includes an experimental feature to shut down Hyper-V virtual machines.
Malware
Products
Microsoft Exchange ServerIt is designed to eliminate a broad range of data recovery paths, deleting shadow copies, disabling boot repair, killing SQL, Exchange, and backup services, clearing event logs, and wiping the Windows Recycle Bin.Microsoft Hyper-Vimplements Kyber1024 for key encapsulation, disables recovery mechanisms, and includes an experimental Hyper-V shutdown feature;Microsoft WindowsA new Kyber ransomware operation has been observed targeting Windows systems and VMware ESXi endpoints, with Rapid7 analyzing two distinct variants deployed on the same network in March 2026.SQLIt is designed to eliminate a broad range of data recovery paths, deleting shadow copies, disabling boot repair, killing SQL, Exchange, and backup services, clearing event logs, and wiping the Windows Recycle Bin.VMware ESXiA new Kyber ransomware operation has been observed targeting Windows systems and VMware ESXi endpoints, with Rapid7 analyzing two distinct variants deployed on the same network in March 2026.