{"id":235726,"date":"2026-04-23T02:30:08","date_gmt":"2026-04-23T07:30:08","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/04\/kyber-ransomware-gang-toys-with-post-quantum-encryption-on-windows"},"modified":"2026-04-23T02:30:08","modified_gmt":"2026-04-23T07:30:08","slug":"kyber-ransomware-gang-toys-with-post-quantum-encryption-on-windows","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/04\/kyber-ransomware-gang-toys-with-post-quantum-encryption-on-windows","title":{"rendered":"Kyber ransomware gang toys with post-quantum encryption on Windows"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/kyber-ransomware-gang-toys-with-post-quantum-encryption-on-windows.jpg\"><\/a><\/p>\n<p>A new Kyber ransomware operation is targeting Windows systems and VMware ESXi endpoints in recent attacks, with one variant implementing Kyber1024 post-quantum encryption.<\/p>\n<p>Cybersecurity firm Rapid7 retrieved and analyzed two distinct Kyber variants in March 2026 during an incident response. Both variants were deployed on the same network, with one targeting VMware ESXi and the other focusing on Windows file servers.<\/p>\n<p>\u201cThe ESXi variant is specifically built for VMware environments, with capabilities for datastore encryption, optional virtual machine termination, and defacement of management interfaces,\u201d <a href=\"https:\/\/www.rapid7.com\/blog\/post\/tr-kyber-ransomware-double-trouble-windows-esxi-attacks-explained\/\" target=\"_blank\" rel=\"nofollow noopener\">explains Rapid7<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A new Kyber ransomware operation is targeting Windows systems and VMware ESXi endpoints in recent attacks, with one variant implementing Kyber1024 post-quantum encryption. Cybersecurity firm Rapid7 retrieved and analyzed two distinct Kyber variants in March 2026 during an incident response. Both variants were deployed on the same network, with one targeting VMware ESXi and the [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34,1625,1617],"tags":[],"class_list":["post-235726","post","type-post","status-publish","format-standard","hentry","category-cybercrime-malcode","category-encryption","category-quantum-physics"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/235726","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=235726"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/235726\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=235726"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=235726"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=235726"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}