Abstract Considering the performance of the standard KF (Kalman filter)degrades significantly when subjected to a hybrid attack, this paper investigates the state estimation problem for a class of stochastic systems under randomly occurring hybrid cyber attacks, which involves denial-of-service (DoS) attack and deception attack obeying unknown Gaussian distribution. First, to consider the DoS attack and deception attack in a unified model, a categorical distributed vector is employed to establish a new measurement model including hybrid cyber attacks. Next, the conjugate prior distributions for the unknown attack parameters are determined, in which the attack probabilities are modeled as Dirichlet distribution, and the deception attack is described by Gaussian-inverse-Wishart distribution. Then, based on variational Bayesian (VB) inference, a RKF (robust Kalman filter) is designed to simultaneously estimate the state and unknown attack parameters. Finally, the estimation performance of the proposed filter is illustrated through a simulation example.