Search Ransomware Intelligence
Jump to a group, country, industry or search victims.
Kyber
As of Oct 19, 2026, Kyber has listed 2 confirmed victims on its leak site since Mar 18, 2026, 0.0% of all victims tracked by Brandefense. Its most targeted country is United States (100.0% of its victims) and its most targeted sector is Aerospace and Defense.
Kyber is a recently identified ransomware group using sophisticated hybrid encryption (AES-256-CTR with X25519 and Kyber1024), operating Tor-based communication channels and employing double-extortion with free partial decryption offered to build negotiation trust, discovered through underground forum monitoring in 2025.
Follow and IOC feeds are part of the Brandefense platform.
- Confirmed Victims
- 2
- Rank By Victims
- #326
- Last Leak-Site Post
- Jul 30, 2026
- Top Country
- United States
- Top Sector
- Aerospace and Defense
Victims Posted Per Month.
| Month | Confirmed victims |
|---|---|
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 1 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| March 2026 | 1 |
| April 2026 | 0 |
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 1 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
| Month | Confirmed victims |
|---|---|
| March 2026 | 1 |
| April 2026 | 0 |
| May 2026 | 0 |
| June 2026 | 0 |
| July 2026 | 1 |
| August 2026 | 0 |
| September 2026 | 0 |
| October 2026 (month in progress) | 0 |
Latest Kyber Victims.
Search all 2 →| Victim | Country | Industry | Data claimed | Posted |
|---|---|---|---|---|
| L3HARRIS l3harris.com | USUnited States | Aerospace and Defense | Not stated | |
| L3HARRIS l3harris.com | USUnited States | Government and Public Sector | Not stated |
How They Operate.
Kyber's threat actor profile lists 1 malware and tools, with its targets and related actors.
TTPs, CVEs and malware →Who Kyber Targets.
Shares are of this group's confirmed victims.History.
Busiest month on record: 1 confirmed victims
First confirmed victim listed on its leak site
Most recent leak-site post
First seen in Brandefense data
Get Real-Time Alerts, IOC Feeds And Takedowns.
The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.