Future-Proof Ransomware and AI Avatars: The Cyber R&D Pipeline Is Open

John Z Black May 1, 2026 Ransomware & Cybercrime #ransomware #AI #deepfake #quantum-safe #Lazarus

Cybercriminals are living in the 2030s while most of us are still fixing 2024 problems. This week, we saw two massive leaps forward in the “Bad Guy R&D” department.

First, there’s a new ransomware group that named itself “Kyber” after the NIST quantum-safe standard. They’re the first to implement ML-KEM encryption. They aren’t trying to lock your files faster; they’re trying to make the recovery permanent. By using post-quantum crypto, they’re ensuring that even if quantum computers become a reality in ten years, your choice to ignore the ransom today is a total data loss tomorrow. They’ve weaponized our own recovery solution into a permanent lock.

Then there’s BlueNoroff. The North Korean group is creating live AI avatars using stolen video of executives to impersonate them on real-time Zoom calls. They jump into a meeting, build rapport with their own team’s face, and then push a “ClickFix” malware link. It’s a terrifying leap in social engineering that proves your eyes can no longer distinguish between a coworker and a nation-state actor.

Innovations aren’t just for defenders. Every technical leap we make is being turned into a weapon in the same week.

Deep dive into the IRONIC branding of Kyber ransomware and its PQC implementation.