Hackers Develop New HYFLOCK Ransomware That Encrypts Files and Attempts to Block Recovery

HYFLOCK ransomware operators have developed successive Windows encryptors that lock files, access network shares, and attempt to obstruct recovery, while implementation flaws create sharply different outcomes for victims.

The investigation distinguishes demonstrated functionality from promotional claims. Although researchers confirmed encryption and scheduled-task registration, they did not establish successful domain-wide propagation or reliable execution after remote desktop sessions ended.

HYFLOCK surfaced on underground forums in March 2026, advertising a Ransomware-as-a-Service platform. Recruitment pitches offered encryption performance, access procurement, technical support, and shared negotiation tools for affiliates conducting intrusions.

By October, the operators were promoting version 2.0 and presenting a more integrated organization.

On October 13, their leak site published eight victim claims across manufacturing, business services, government, retail, and telecommunications.

These remained unverified claims; researchers did not determine initial access methods or targeting criteria.

The earliest analyzed April sample already contained a substantial Windows ransomware core written in Rust.

It supported file encryption, network targeting, and interference with security and recovery mechanisms, although restricted runtime analysis left some capabilities established only through code inspection.

July introduced a separate loader delivering the ransomware, configuration, and encryption key material while retaining the Rust/Nishi foundation.

Check Point Exposure Management researchers traced, four generations between April and October 2026, revealing an operation moving from underground recruitment toward public extortion.

HYFLOCK Ransomware

An early October generation used a Go-based carrier to extract and launch a revised payload, which attempted background execution through a scheduled task.

A second October build, identified on October 17, instead operated as a standalone Rust encryptor.

It staged itself beneath a directory resembling a legitimate software update component and successfully registered a scheduled task during testing.

Controlled analysis of the October 17 build recorded 500 successful ransomware-extension renames and 17 validated encrypted files.

Researchers also observed network-share access and attempts to interfere with system recovery. Those results establish working encryption, but the rename count should not be confused with independently validated encrypted-file totals.

Network deployment functionality was present, yet successful domain-wide spreading was not observed. Group Policy propagation was disabled in the recovered configuration.

Advertised vulnerable-driver techniques for disabling security tools also remained unverified, alongside claims concerning continued operation after remote desktop sessions disconnected.

An earlier October build contained a processing defect capable of permanently discarding file content.

Consequently, obtaining the correct decryption key might still leave affected files incomplete, separating irreversible corruption from ordinary encryption damage.

The October 17 version exposed a different weakness: larger files had only their first 4,096 bytes encrypted, leaving subsequent content accessible.

Researchers recovered 73 CRC-valid internal components from seven encrypted Office documents without a key, including worksheet and shared-string data.

Crucially, this was partial content recovery, not complete document restoration or a universal decryptor. The findings do not establish that every affected file can be recovered or that paying a ransom would resolve damage.

For defenders, the practical priority is preserving encrypted artifacts and identifying the exact ransomware build before evaluating recovery options.

The research also highlights scheduled-task monitoring, network-share access reviews, segmentation, and recovery protections as relevant defensive considerations.

HYFLOCK illustrates why observed behavior, configuration settings, and build-specific defects matter more than an operator’s advertised feature list when assessing operational risk and recovery prospects across different affected systems and individual encrypted documents.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.