Malware
Kyber
- First Reported
- Apr 21, 2026
- Latest Reported
- Apr 23, 2026
Reported Context (3)
- Kyber is a cross-platform ransomware family that targets VMware ESXi datastores and Windows file systems with coordinated Tor-based infrastructure, campaign identifiers, and destructive anti-recovery features. Rapid7 Analyzes Kyber Ransomware’s Windows and ESXi Variants
- A new Kyber ransomware operation has been observed targeting Windows systems and VMware ESXi endpoints, with Rapid7 analyzing two distinct variants deployed on the same network in March 2026. Rapid7 Finds Kyber Ransomware Uses Post-Quantum Key Protection Only in Windows Variant
- Ransomware trends show faster dwell times, specialization (e.g., Kyber, Akira), and increasing targeting of ESXi, OT, and SMB environments. Check Point Links SystemBC C2 to 1,570-Plus Victims and Reports The Gentlemen Activity
Malware (1)
People (1)
Threat Actors (6)
MITRE ATT&CK (13)
Products (8)
Tools (3)
Industries (3)
Countries (5)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.