Kyber ransomware is the first confirmed case of ransomware using post-quantum cryptography, making victim file recovery cryptographically harder than ever.
Security firm Rapid7 reverse-engineered the Kyber ransomware family and confirmed it uses ML-KEM1024 — the highest-strength version of NIST's post-quantum cryptographic standard — to protect the AES-256 key used to encrypt victims' files. This makes Kyber the first confirmed ransomware to deploy post-quantum cryptography (PQC), meaning decryption tools relying on classical cryptographic weaknesses will not work. The ransomware has been active since at least September 2024 and targets Windows systems. The PQC implementation is not marketing — Rapid7 verified it through reverse engineering.
Kyber ransomware has operationalized ML-KEM1024 before most enterprise security stacks have even evaluated PQC migration. If your product handles key exchange, digital signatures, or encrypted backups using RSA or ECC, those primitives are now visibly behind the threat curve — attackers have deployed the upgrade first. This is also a signal that PQC libraries (liboqs, BoringSSL PQC branches) are production-ready enough for adversaries to trust them in live malware.
Audit your key exchange code this week: grep your codebase for RSA and ECDH usage, then cross-reference against the liboqs PQC drop-in replacement docs to estimate migration scope before your security team asks you to.
Install the open-quantum-safe Python wrapper: pip install liboqs-python
Tags