Kyber Ransomware Hyper-V Forced Shutdown

Ethan Andrews@eandrews

•updated Apr 22, 2026•7•0•457

Detects PowerShell commands used by Kyber ransomware to enumerate and forcefully shut down Hyper-V virtual machines. This action is typically performed to release file locks on virtual disks prior to encryption.