Kyber ransomware deploys post-quantum encryption

A new ransomware operation named Kyber is targeting Windows and VMware ESXi systems with distinct variants, one of which claims to use post-quantum encryption. Cybersecurity firm Rapid7 analyzed two variants deployed in March 2026, finding the ESXi version uses traditional RSA-4096 and ChaCha8 despite marketing claims. The Windows variant, written in Rust, implements Kyber1024 for key protection alongside AES-CTR for file encryption. This marks an early adoption of post-quantum cryptography in ransomware, though the outcome for victims remains the same—files are unrecoverable without the attacker's private key.