Post-Quantum Cryptography is Already in Use... for Ransomware

It is known that cybercriminals are among the first to exploit new techniques and technologies to bypass the defenses of their victims: we have witnessed this phenomenon with AI, and now it is the turn of post-quantum cryptography. A new ransomware group, known as Kyber, has indeed made a name for itself through its use of the Kyber1024 cipher in its activities.

Post-Quantum Cryptography Used in Crime

The cybersecurity company Rapid7 has published an analysis of Kyber's activities, a new group of criminals that makes the use of post-quantum cryptography its main distinguishing feature.

The group has developed ransomware in two variants, one for Windows and one for Linux and ESXi. While the latter actually uses traditional systems (ChaCha8 and AES) to accomplish its task, the Windows version uses AES to encrypt files and Kyber1024, which is among the post-quantum ciphers approved by NIST in 2022, to encrypt the symmetric key used for AES.

The approach taken by the Kyber group is thus doubly interesting because it exploits a dual-cipher system (symmetric key for the actual encryption, and public key to protect the symmetric key) and because one of these ciphers is post-quantum. It should be noted that this is not used directly for file encryption.

The ransomware leverages many functionalities provided by the victim’s operating systems: for example, in the case of ESXi, it utilizes built-in tools to obtain a list of running VMs and encrypt their disks; in the case of Windows, it uses PowerShell to disable features such as shadow copies and the Windows Recovery Environment, thereby preventing the possibility of restoration.

Currently, the group has only named one victim on its Tor site, a US company engaged in the defense sector. However, Kyber's activities seem to be feverish: Rapid7 detected more than 900 attacks in just the month of March.