Ransomware Group Kyber Uses Post-Quantum Claims to Intimidate Victims

• •Kyber ransomware claims to use post-quantum cryptography to intimidate victims.
• •The malware employs ML-KEM for key exchange but relies on conventional AES-256 for encryption.
• •Victims are given about a week to respond to ransom demands, despite quantum threats being years away.

The ransomware group Kyber has emerged, utilizing claims of post-quantum cryptography to enhance psychological pressure on victims. This malware, which has been active since at least September 2025, employs the ML-KEM standard to assert its quantum resistance, although its actual encryption methods remain conventional. Kyber's Windows variant uses ML-KEM1024 to protect an AES-256 key for file encryption, but the practical benefits of this approach for attackers are minimal. Victims are typically given a week to respond to ransom demands, despite the fact that quantum computers capable of breaking current encryption standards are still years away. Variants of Kyber have shown inconsistencies, with some claiming to use ML-KEM while actually relying on RSA encryption. Security researchers emphasize that the use of post-quantum elements serves more as a marketing tactic than a technical advancement. The psychological impact on non-technical decision-makers is significant, as the term 'post-quantum encryption' sounds more intimidating than traditional methods. Overall, the ransomware's threat level is heightened by its innovative marketing approach rather than its technical capabilities.