Kyber Ransomware Double Trouble: Windows and ESXi Attacks Explained
2026-04-21T19:23:59Z•44588a884c23bea5de0138195ae2c6c1cc20ea41d6ded207fc985427c4e8ec09
CVE-2026-28501CVE-2026-28517CVE-2026-33032MCP-serverai-securitybulk-exportclickfixdatastore-encryptionexposure-managementhyper-vincident-responsekybermanagement-defacementmetasploitnginx-uiphishingproject-glasswingransomwareremediationrustsocial-engineeringtorvmware-esxiwindows
What happened
This Rapid7 collection covers multiple security topics from April 2026: a technical analysis of Kyber ransomware showing coordinated dual-platform campaigns (VMware ESXi-targeted and Windows Rust variant, with Tor-based ransom infrastructure, datastore encryption, optional VM termination, management interface defacement, and an experimental Hyper-V target); disclosure of a critical missing-authentication vulnerability in Nginx UI (CVE-2026-33032, CVSS 9.8, patched March 15, 2026); a Metasploit update adding seven modules including exploits for CVE-2026-28501 (AVideo SQLi) and CVE-2026-28517 (o
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- rapid7_blog
- Record identifier
- 44588a884c23bea5de0138195ae2c6c1cc20ea41d6ded207fc985427c4e8ec09
- Enrichment time
- 2026-04-21T19:23:59Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.