Meta News

Ransomware Kyber Uses Post-Quantum Cryptography in a Historical Precedent

Summary: A new ransomware family, named Kyber, has been identified using ML-KEM, a post-quantum cryptography technique, setting a precedent for the use of such methods by malware.

The Quantum Truce Ends: Ransomware Starts Armoring Up with Post-Quantum Cryptography

For the first time, security researchers detect malware variants that utilize algorithms designed to resist future computers. The group behind the 'Kyber' ransomware leads this evolution, which experts describe as both a technical advancement and a tactic of psychological terror.

MADRID, April 24, 2026 – For years, post-quantum cryptography (PQC) has been a topic of academic debate and government preparation ahead of the 'Q Day'—the moment a quantum computer is capable of breaking current encryption—. However, this technology has jumped from defense laboratories into the hands of cybercriminals. According to a recent technical analysis, the ransomware known as Kyber has become the first confirmed malware family to use post-quantum standards to protect its operations.

The Technical Leap: ML-KEM in Action

The cybersecurity firm Rapid7 identified a variant of Kyber written in Rust that is not limited to conventional techniques. While most ransomware uses algorithms like RSA or elliptic curves (vulnerable to future quantum attacks) to protect encryption keys, Kyber has implemented the ML-KEM-1024 standard.

This lattice-based algorithm is one of the standards recently approved by NIST (the U.S. National Institute of Standards and Technology) precisely to withstand the computational power of quantum computers. Although the victim's files are still encrypted with fast AES-256, the 'master key' that allows their recovery is protected by this post-quantum layer.

Real Innovation or Marketing Strategy?

For many analysts, this move does not reflect an immediate technical necessity, as today there are no quantum computers capable of decrypting traditional RSA. So, why do it?

Key facts

  • Kyber is a ransomware family that uses ML-KEM.
  • ML-KEM is a post-quantum cryptography (PQC) standard.
  • Kyber's Windows variant uses ML-KEM1024.
  • The ransomware combines ML-KEM with AES-256.

Why it matters

The use of PQC by ransomware demonstrates a growing sophistication in attackers, preparing for future attacks with quantum computers. This forces organizations to review and strengthen their current cryptographic defenses to avoid system obsolescence.

Tags:
ransomware quantum computing PQC ciberseguridad criptografía

Structured details

  • Industry: cybersecurity
  • Source type: media
  • Claim status: confirmed
  • Verification: claimed_by_source
  • Entities: National Institute of Standards and Technology, Rapid7, Emsisoft

Source: https://arstechnica.com/security/2026/04/now-even-ransomware-is-using-post-quantum-cryptography/

Published on