Executive Summary
In March 2026, the Kyber ransomware group emerged as a significant threat, demonstrating a specialized capability to disrupt both Windows and VMware ESXi environments simultaneously. By targeting critical virtualization infrastructure, the group aims for total operational disruption. Recent analysis shows the group uses coordinated campaigns linked by unique identifiers and shared Tor infrastructure for negotiations and data leaks.
Technically, the group employs a dual-binary approach: a C++ ELF variant for ESXi and a Rust-based PE variant for Windows. While the group advertises advanced 'post-quantum' encryption (Kyber1024), this was only verified in the Windows variant; the ESXi variant relies on standard ChaCha8 and RSA-4096. Both variants prioritize disabling recovery mechanisms, with the ESXi version terminating VMs via native esxcli commands and the Windows version executing 11 distinct commands to wipe backups and logs.