Kyber is a 2025 ransomware group known for hybrid post-quantum encryption and double-extortion tactics.
Kyber is a cybercriminal ransomware group discovered in 2025 through underground forum monitoring. While specific victimology is not provided, it operates as a ransomware crew. The group employs sophisticated hybrid encryption (AES-256-CTR with X25519 and Kyber1024), double-extortion tactics, and offers free partial decryption to build negotiation trust, using Tor-based communication channels. Defenders should monitor for unusual file encryption activity, Tor network connections, and anomalies related to post-quantum algorithm usage.
Kyber is a recently identified ransomware group using sophisticated hybrid encryption (AES-256-CTR with X25519 and Kyber1024), operating Tor-based communication channels and employing double-extortion with free partial decryption offered to build negotiation trust, discovered through underground forum monitoring in 2025.
The Kyber group employs a hybrid encryption approach, which includes AES-256-CTR, X25519, and Kyber1024 algorithms.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.