Kyber is a 2026 ransomware operation with separate encryptors for Windows servers and VMware ESXi hosts. On Windows, encrypted files end in the unusual suffix .#~~~ and the note is READ_ME_NOW.txt. On ESXi, virtual machine files get .xhsyw and a readme.txt note. The note opens by naming Kyber Ransomware and claims post-quantum Kyber1024 key generation. Only the Windows build matches that claim. The ESXi build uses ChaCha8 with RSA-4096. Before encrypting, it shuts down virtual machines and deletes shadow copies and logs. The note says data was copied and threatens publication on a Tor blog, and offers three test decryptions. No lineage to an earlier family has been established.
File extensions: .#~~~, .xhsyw
Ransom note filenames: READ_ME_NOW.txt, readme.txt
Decryptor: No public decryptor was found. Checked 2026-10-14.
The ransomware identification tool didn’t load. This is usually temporary — please refresh. If you’re dealing with an active incident, don’t wait on it:
Emergency response: +1 (877) 364-5161