Kaspersky is addressing one of the most debatable technological challenges of the coming decade: the rise of quantum computing and its potential impact on digital security.

In this context, experts have identified the main quantum threats that demand immediate action from the cybersecurity community.

As classical computers approach their physical limits, their performance growth is slowing — constraining progress in areas that depend on complex computation.

At the same time, quantum computers offer the potential to solve specific problems far faster than classical systems. For now, however, their practical use remains limited to narrow and experimental domains.

Nevertheless, experts estimate that we may see a fully fault-tolerant quantum computer within the next decade — a development that could unlock significant advances, but also unleash a new era of cybersecurity threats.

Supporting this urgency, Deloitte’s 2024 Global Future of Cyber Survey reports that 83% of organizations are already assessing or taking steps to address quantum computing risks, demonstrating growing awareness and proactive strategies in the private sector.

To better understand the scope of the evolving threat, Kaspersky has identified three of the most urgent quantum-related risks that demand action from the cybersecurity community:

The top three risks:

Quantum computers could be used to compromise the traditional encryption methods that currently protect data in countless digital systems — posing a direct threat to global cybersecurity infrastructures.

Threats include the interception and decoding of sensitive diplomatic, military, and financial communications, as well as the real-time decryption of private negotiations – something quantum systems could handle much faster than classical machines, turning secure conversations into open books.

1. Store now, decrypt later: the key threat of the coming years

Threat actors are already harvesting encrypted data today, with the intention of decrypting it in the future once quantum capabilities advance. This “store now, decrypt later” tactic could expose sensitive information years after it was originally transmitted — including diplomatic exchanges, financial transactions, and private communications.

2. Sabotage in blockchain and cryptocurrency

Blockchain networks are not immune to quantum threats. Bitcoin’s Elliptic Curve Digital Signature Algorithm (ECDSA), which relies on elliptic curve cryptography (ECC), is especially vulnerable.

Potential risks include forging digital signatures, which threatens Bitcoin, Ethereum, and other cryptocurrencies; attacks on ECDSA that secure crypto wallets; and tampering with blockchain transaction history, undermining trust and integrity.

3. Quantum-resistant ransomware: a new front

Looking ahead, developers and operators of advanced ransomware may begin adopting post-quantum cryptography to protect their own malicious payloads. So-called “quantum-resistant” ransomware would be designed to resist decryption by both classical and quantum computers — potentially making recovery without paying a ransom nearly impossible.

At present, quantum computing does not offer a way to decrypt files locked by current ransomware. Data protection and recovery still rely on traditional security solutions and collaboration among law enforcement agencies, quantum researchers, and international organisations.

Building quantum-safe defenses

Quantum computers are not yet a direct threat — but by the time they are, it may be too late to respond. Transitioning to post-quantum cryptography will take years. Preparations must begin today.

The cybersecurity community, IT companies, and governments must coordinate to address the risks ahead. Policymakers should develop clear strategies to migrate to post-quantum algorithms. Businesses and researchers need to begin implementing new security standards now.

“The most critical risk lies not really in the future, but in the present: encrypted data with long-term value is already at risk from future decryption. The security decisions we make today will define the resilience of our digital infrastructure for decades.

“Governments, businesses, and infrastructure providers must begin adapting now, or risk systemic vulnerabilities that cannot be retroactively fixed,” states Sergey Lozhkin, Head of Kaspersky Global Research & Analysis Team for META and APAC.

Contrary to popular belief, using cutting-edge artificial intelligence tools slowed down experienced software developers when they were working in codebases familiar to them, rather than supercharging their work, a new study found.

AI research nonprofit METR conducted the in-depth study, on a group of seasoned developers earlier this year while they used Cursor, a popular AI coding assistant, to help them complete tasks in open-source projects they were familiar with.

Before the study, the open-source developers believed using AI would speed them up, estimating it would decrease task completion time by 24%. Even after completing the tasks with AI, the developers believed that they had decreased task times by 20%. But the study found that using AI did the opposite: it increased task completion time by 19%.

The study’s lead authors, Joel Becker and Nate Rush, said they were shocked by the results: prior to the study, Rush had written down that he expected “a 2x speed up, somewhat obviously.”

The findings challenge the belief that AI always makes expensive human engineers much more productive, a factor that has attracted substantial investment into companies selling AI products to aid software development.

AI is also expected to replace entry-level coding positions. Dario Amodei, CEO of Anthropic, recently told Axios that AI could wipe out half of all entry-level white collar jobs in the next one to five years.

Prior literature on productivity improvements has found significant gains: one study found using AI sped up coders by 56%, another study found developers were able to complete 26% more tasks in a given time.

But the new METR study shows that those gains don’t apply to all software development scenarios. In particular, this study showed that experienced developers intimately familiar with the quirks and requirements of large, established open source codebases experienced a slowdown.

Other studies often rely on software development benchmarks for AI, which sometimes misrepresent real-world tasks, the study’s authors said.

The slowdown stemmed from developers needing to spend time going over and correcting what the AI models suggested.

“When we watched the videos, we found that the AIs made some suggestions about their work, and the suggestions were often directionally correct, but not exactly what’s needed,” Becker said.

The authors cautioned that they do not expect the slowdown to apply in other scenarios, such as for junior engineers or engineers working in codebases they aren’t familiar with.

Still, the majority of the study’s participants, as well as the study’s authors, continue to use Cursor today.

The authors believe it is because AI makes the development experience easier, and in turn, more pleasant, akin to editing an essay instead of staring at a blank page.

“Developers have goals other than completing the task as soon as possible,” Becker said. “So they’re going with this less effortful route.”

Kaspersky GReAT (Global Research and Analysis Team) experts have discovered open-source packages that download the Quasar backdoor and a stealer designed to exfiltrate cryptocurrency. The malicious packages are intended for the Cursor AI development environment, which is based on Visual Studio Code — a tool used for AI-assisted coding.

The malicious open-source packages are extensions hosted in the Open VSX repository that claim to provide support for the Solidity programming language. However, in practice, they download and execute malicious code on users’ devices.

During an incident response, a blockchain developer from Russia reached out to Kaspersky after installing one of these fake extensions on his computer, which allowed attackers to steal approximately $500,000 worth of crypto assets.

The threat actor behind these packages managed to deceive the developer by making the malicious package rank higher than the legitimate one. The attacker achieved this by artificially inflating the malicious package’s downloads count to 54,000.

After installation, the victim gained no actual functionality from the extension. Instead, malicious ScreenConnect software was installed on the computer, granting threat actors remote access to the infected device.

Using this access, they deployed the open-source Quasar backdoor along with a stealer that collects data from browsers, email clients, and crypto wallets. With these tools, the threat actors were able to obtain the developer’s wallet seed phrases and subsequently steal cryptocurrency from the accounts.

After the malicious extension downloaded by the developer was discovered and removed from the repository, the threat actor republished it and artificially inflated its installation count to a higher number – 2 million, compared to 61,000 for the legitimate package. The extension was removed from the platform following a request from Kaspersky.

“Spotting compromised open-source packages with the naked eye is becoming increasingly difficult. Threat actors are using increasingly creative tactics to deceive potential victims, even developers who have a strong understanding of cybersecurity risks — particularly those working in the blockchain development field.

As we expect adversaries to continue targeting developers, it is recommended that even experienced IT professionals deploy dedicated security solutions to safeguard sensitive data and prevent financial losses,” commented Georgy Kucherin, Security Researcher with Kaspersky’s Global Research and Analysis Team.

The threat actor behind the attack published not only malicious Solidity extensions but also another NPM package, solsafe, which also downloads ScreenConnect. A few months earlier, three additional malicious Visual Studio Code extensions were released — solaibot, among-eth, and blankebesxstnion — all of them have already been removed from the repository.