Kyber is a cross-platform ransomware threat designed to encrypt data across both VMware ESXi systems and Windows file servers. The operators rely on native utilities such as esxcli , PowerShell, and vssadmin to shut down virtual machines, remove shadow copies, and distribute ransom notes across impacted environments. In March 2026, researchers recovered two related samples: an ELF binary targeting ESXi and a Rust-based PE file built for Windows. Both variants were linked through shared Tor-based infrastructure and a common campaign identifier.
Rapid7 obtained both the ESXi and Windows payloads and conducted static analysis to better understand their behavior. The research showed that the malware uses custom encryption routines built around ChaCha8 with RSA-4096 key wrapping, while the Windows version also incorporates a hybrid Kyber1024 and AES-CTR encryption scheme. Investigators documented the targeted file extensions, ransom note placement, service termination behavior, and a distinctive mutex tied to a Boomplay URL.
Recommended defenses include hardening ESXi access by disabling SSH where possible and enforcing multi-factor authentication, while also restricting access to native utilities such as vssadmin , wmic , and reg . Organizations should secure backups through immutability and monitor closely for changes to VMware management files as well as the appearance of the .#~~~ file extension. Additional detections should focus on the identified mutex and the specific ransom note filenames associated with the campaign.
If Kyber activity is detected, isolate the affected system immediately, preserve the malware samples, and begin recovery using immutable backups. Security teams should block access to the Tor hidden services tied to the campaign ID, remove the mutex, and delete any ransom note files dropped by the malware. A full forensic review should then examine service termination events, registry changes, and related system activity before rebuilding affected virtual machines or hosts from clean images.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.
Attack Narrative & Commands: The simulated attacker has obtained local administrator rights on the compromised host and wishes to prevent system recovery after encrypting files. Following Kyber ransomware behavior, the attacker first enumerates all existing Volume Shadow Copies via WMI and deletes each one using a PowerShell one‑liner. As a fallback (or to ensure completeness), the attacker also runs vssadmin.exe Delete Shadows /all /quiet . Both commands generate a CommandLine field that matches the Sigma rule exactly, causing an alert.
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
