1. Kyber ransomware: two payloads, one blackout

Rapid7 first documented Kyber during a March 2026 incident response at a large US defence contractor and IT services provider. The attackers deployed two ransomware programs in the same network at the same time: one for Windows file servers and one for VMware ESXi, the platform that runs many companies' virtual servers. Hitting both at once is designed to take an entire business offline, not just a few machines.

The ESXi version can shut down virtual machines, encrypt their storage and deface the management screen. The Windows version, written in Rust, even includes an "experimental" feature for Microsoft Hyper-V.

About the "post-quantum" headlines: Kyber advertises quantum-proof encryption. Rapid7 found the Windows version really does use the NIST-standard Kyber1024 algorithm — but the ESXi version only claims to, and relies on conventional RSA-4096 and ChaCha8. In practice it makes no difference to victims: files locked by modern ransomware cannot be decrypted without the attacker's key either way. Backups are the only reliable recovery.

Lessons:

  • Keep offline or immutable backups, and test restoring them — including whole virtual machines.
  • Treat hypervisor management (ESXi, vCenter, Hyper-V) as crown jewels: separate admin accounts, MFA, and no access from general user networks.
  • Patch virtualisation platforms promptly and monitor for mass shutdown of virtual machines.

2. Casbaneiro: fake invoices, real bank fraud

In August 2026, FortiGuard Labs observed a new Casbaneiro banking trojan campaign targeting users in Argentina, Peru, Colombia and Mexico. Emails and PDFs pose as urgent invoices or legal notices, and some even include the recipient's own email address to look personalised.

Clicking the link starts a multi-step download chain (a ZIP file, then an HTA script, then an AutoIt loader) that quietly injects the malware into a normal Windows process. It checks the computer's language and stops if it is set to English, French or German — a clear sign it is built for Spanish- and Portuguese-speaking victims.

Casbaneiro then waits. It only becomes active when the victim opens a targeted banking website, where it can show fake windows and swap copied cryptocurrency addresses on the clipboard. It also steals Outlook contacts and email sender/recipient details, spreading stolen data across several servers to avoid detection.

Lessons:

  • Be suspicious of any "invoice" or "legal notice" that pushes you to download a file through a link.
  • Never ignore an unexpected pop-up asking for banking details while you are on your bank's website.
  • After pasting a payment or crypto address, check it matches the original before confirming.

3. BambooToken ("The banana stand"): hiding behind a messaging broker

Lumen's Black Lotus Labs exposed BambooToken, a Windows and Linux backdoor active since at least February 2023. On Windows it hides inside a legitimately signed program from Tendyron's OnKey authentication software — commonly used in Chinese banking and government networks — by planting a malicious DLL next to it ("DLL side-loading").

Its unusual feature is how it talks to its operators: MQTT, a lightweight protocol normally used by smart devices and IoT sensors. Infected machines only ever connect to a message broker, never directly to the attacker, which makes the operation much harder to trace. Lumen identified roughly a dozen victims across Asia and South America, including hotels, biomedical firms, law firms, a financial organisation and a GitLab source-code server.

Lessons:

  • A digitally signed program is not automatically safe — attackers borrow trusted software to load their own code.
  • Unexpected MQTT traffic from office PCs or servers is worth investigating.
  • Source-code servers such as GitLab are high-value targets and need the same protection as email.

The common thread

All three threats are built to stay quiet: Kyber until it strikes everything at once, Casbaneiro until you visit your bank, BambooToken for years behind a broker. And two of the three begin with a message designed to look like normal business — an invoice, a notice, a document.

Unexpected invoice? Verify before you click.

Contact the sender through a known channel — not the details in the message.

Sources

Rapid7 — Kyber Ransomware Double Trouble: Windows and ESXi Attacks Explained

Cloud Security Alliance — Kyber Ransomware: Post-Quantum Encryption as an Attack Weapon

FortiGuard Labs — Casbaneiro: A Banking Trojan with Distributed Data-Receiving Servers

Lumen Black Lotus Labs — The banana stand: brokering and managing infections across Asia using MQTT