Kyber Ransomware Double Trouble: Windows and ESXi Attacks Explained
2026-04-22T07:23:49Z•616cba8a46482bd54b245b3f1df672a4133baa1d7007c3a0b5298ec9d9f897a2
ai-securitybulk-exportclickfixdatastore encryptiondefacementesxiexposure-managementhyper-vkybermetasploitnginx-uiopen-sourcephishingransomwareremediationrustsocial engineeringtorvm-terminationvmware esxivulnerability-managementwindows
What happened
Rapid7 documented multiple high-risk developments: a Kyber ransomware campaign deploying coordinated, dual-platform payloads targeting VMware ESXi (datastore encryption, optional VM termination, management UI defacement) and Windows file servers (Rust-built variant with an experimental Hyper-V target) using shared Tor-based infrastructure — representing a significant operational-impact ransomware threat. Rapid7 also covered a critical missing-authentication vulnerability in Nginx UI (CVE-2026-33032, CVSS 9.8) and new Metasploit modules/exploits (including modules for CVE-2026-28501 and CVE-202
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- rapid7_blog
- Record identifier
- 616cba8a46482bd54b245b3f1df672a4133baa1d7007c3a0b5298ec9d9f897a2
- Enrichment time
- 2026-04-22T07:23:49Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.