Kyber Ransomware Double Trouble: Windows and ESXi Attacks Explained
2026-04-23T07:23:51Z•86efe2e790525664bee854322ce13e2ed219adf2536f43c5018e1f40da54379a
AI-securityCVE-2026-28501CVE-2026-28517CVE-2026-33032MCPbulk-exportclaude-masqueradeclickfixhyper-vkybermetasploitnginx-uiopen-sourcephishingransomwareremediationrusttorvmware-esxivulnerability-managementwindows-ransomware
What happened
This collection of Rapid7 posts covers multiple high-impact security topics: a detailed analysis of Kyber ransomware showing coordinated dual-platform attacks (VMware ESXi datastore encryption and Windows file-server ransomware — Windows build written in Rust with an experimental Hyper‑V target — using Tor-based infrastructure); disclosure and remediation guidance for a critical Nginx UI missing-authentication vulnerability (CVE-2026-33032, CVSS 9.8); new Metasploit modules including exploits and auxiliary modules for recent CVEs (notably CVE-2026-28501 and CVE-2026-28517); a ClickFix phishing
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- rapid7_blog
- Record identifier
- 86efe2e790525664bee854322ce13e2ed219adf2536f43c5018e1f40da54379a
- Enrichment time
- 2026-04-23T07:23:51Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.