Now, even ransomware is using post-quantum cryptography

A newly emerged ransomware strain is making headlines by touting its use of advanced encryption techniques designed to withstand potential quantum computer attacks. Known as Kyber, this ransomware has been on the radar since at least last September, primarily due to its claim of employing ML-KEM, or Module Lattice-based Key Encapsulation Mechanism, which is recognized by the National Institute of Standards and Technology. The name 'Kyber' is actually derived from the alternate term for ML-KEM. In this context, Kyber refers to the ransomware itself, while ML-KEM denotes the encryption algorithm. This asymmetric method facilitates secure key exchanges by relying on mathematical problems involving lattices—areas where quantum computers do not have a computational edge. Designed as a successor to traditional systems like Elliptic Curve and RSA cryptography, ML-KEM aims to provide enhanced security against quantum attacks. On Tuesday, cybersecurity firm Rapid revealed that they had reverse-engineered the Windows version of Kyber, discovering it utilized ML-KEM1024, recognized as the most robust variant of the post-quantum cryptography standard. Kyber cleverly employs ML-KEM to safeguard the key responsible for encrypting victims' data using AES-256, another cryptographic standard considered secure against quantum threats. Notably, while AES-128 could have also withstood such an attack, the use of AES-256 indicates a high level of security commitment. Brett Callow, a threat analyst with Emsisoft, pointed out that this is the first verified instance of ransomware implementing post-quantum cryptography.