HYFLOCK Ransomware's October Build Encrypted Only the First 4,096 Bytes of Larger Files, Check Point Found. If You Were Hit, Keep the Encrypted Files. Five Hashes and the Artifacts to Hunt.
If HYFLOCK ransomware has hit you, do not wipe the encrypted files. Check Point Exposure Management found that the October 17 build encrypted only the first 4,096 bytes of larger files, and its researchers recovered 73 internal components from seven encrypted Office files without a key. That is partial recovery, not a decryptor. An earlier October build had a different defect that could permanently discard parts of a file, so keep the originals and any copies of the malware and notes for responders.
What Check Point found
HYFLOCK appeared on underground forums in March 2026 as a ransomware-as-a-service offering. It announced version 2.0 in October and began naming victims: on October 13 its leak site listed eight victim claims across manufacturing, business services, government, retail and telecommunications. Check Point says those listings are unverified actor claims and that its investigation did not establish how any organization was first compromised. The Hacker News reports the group had listed 13 victims by the time of its roundup.
Check Point traced four generations of the ransomware from April to October, with changes in how it launches and runs. In July a separate loader started delivering the encryptor with its configuration and key material. An early October build used a Go carrier that extracted a revised Rust payload and tried to set up background execution through a scheduled task. The October 17 build ran as a standalone Rust encryptor and staged a copy of itself under a directory resembling a legitimate software update component.
In controlled analysis, the October 17 build registered a scheduled task, produced 500 successful ransomware-extension renames and 17 validated encrypted files, touched network shares and tried to interfere with system recovery. It contained functionality for deploying across a network, but Check Point did not observe domain-wide spread, and Group Policy spreading was disabled in the recovered configuration. Other advertised abilities, such as reliable execution after remote desktop sessions end and using vulnerable drivers to disable security tools, remain unverified.
The encryption weaknesses
Two flaws affected recovery, in different builds. An earlier October version had a processing defect that could permanently discard portions of a file, which could prevent complete recovery even with the correct key. In the October 17 build, larger files had only their first 4,096 bytes encrypted, leaving the rest readable. By examining that remaining data, researchers recovered 73 CRC-valid internal components from seven encrypted Office files, including worksheet and shared-string data, without a key. Check Point stresses that this recovered only portions of the files and is not a general decryption method.
What to hunt for
Check Point's appendix lists artifacts that vary per run, so match on shape, not exact names. Generic filenames and extensions should not be treated as malicious on their own.
A scheduled task that launches an executable named eu.exe from a folder starting with EdgeUpdate_ followed by a suffix, with a file named eu.cfg beside it.
Encrypted files renamed with an extension of .locked_ followed by a 12-character identifier, and ransom notes named How to Restore My Files in text or HTML form.
Files named system_config_ and testdecryptkry_ followed by an identifier, with a .dat extension. The second holds RSA-wrapped key material, not a usable plaintext key.
Files named .hyflock-, followed by a process number, with a .exe extension, and working files named .hyflock_claim, .encrypting_flag and encryption_progress.log.
Markers inside samples: HYFLCK03 in the October carrier footer, HYFLOCK_NIS_CFG in the payload configuration slot, and HFLKEY01 as the trailer on October 17 encrypted files.
Review network-share access, segmentation, scheduled-task creation and recovery protections, which are the areas Check Point highlights.
What we put in the feed
Check Point's report lists SHA-256 hashes for the loaders, carrier and encryptors. We ingested five of them, read back by primary key, under the source manual-batch-hyflock-2026-11 at confidence 85: the July parent loader, the July child encryptor, the October Go carrier, the October operational Rust payload and the October 17 standalone encryptor. They are:
ac233f0bfefb8b39ea84c61b0bec54037285caf5fe439f2c5160842fa4eea815 (July encryptor)
b15482d0846ef997f9c049e77d85efeba4ab9b33550b4384052efeb1a3dcc8cc (October Go carrier)
a120f0c0defe4b6943e09f06272a86ae75d1a4524fa9bf21da25c8c0d747ef5a (October Rust payload)
b1f0a2fff8baab47463fa04b1ee279ef86265db24a58f7fc1b56c5576ec801db (October 17 encryptor)
We left out the two ransom-note hashes and a sample Check Point describes as an analysis artifact with differing configuration behavior. We hold no first-party sighting of HYFLOCK. This is corroboration of Check Point's research, not a lead.
What is not known
How victims were first compromised. Whether the leak-site claims are accurate. Whether later builds fixed the encryption weaknesses. Who is behind the group. The report names no command-and-control addresses or domains, and we ingested none.
Limits
We read Check Point's blog post and its full PDF report, and The Hacker News's roundup. We did not run or obtain any sample. We reassembled the hashes from a two-line-wrapped table in the PDF and confirmed each is 64 hexadecimal characters; check them against the original before relying on one.
Five percent of this is wrong somewhere. It always is. If you have a HYFLOCK sample from a newer build, tell us.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments