HYFLOCK ransomware: Rust Windows encryptor with build-specific flaws that affect recovery

What happened

HYFLOCK is a Ransomware-as-a-Service operation that surfaced on underground forums in March 2026, according to GBHackers. Recruitment pitches offered encryption performance, access procurement, technical support and shared negotiation tools for affiliates. By October the operators were promoting version 2.0 (GBHackers).

Check Point Exposure Management researchers traced four generations between April and October 2026 (GBHackers, Cyber Security News):

• April: the earliest analyzed sample already had a substantial Windows ransomware core written in Rust. It supported file encryption, network targeting and interference with security and recovery mechanisms. Some capabilities were established only through code inspection (GBHackers).
• July: a separate loader delivered the ransomware, configuration and key material (GBHackers).
• Early October: a Go-based carrier extracted and launched a revised payload that tried background execution through a scheduled task (GBHackers).
• October 17 build: a standalone Rust encryptor that staged itself in a directory resembling a legitimate software update component and registered a scheduled task during testing (GBHackers, Cyber Security News).

On October 13 the leak site published eight victim claims across manufacturing, business services, government, retail and telecommunications. These remain unverified. Researchers did not determine initial access methods or targeting criteria (GBHackers, Cyber Security News).

Recovery-relevant flaws, per build

• Earlier October build: a processing defect could permanently discard file content. Even with the correct decryption key, affected files might stay incomplete (GBHackers).
• October 17 build: larger files had only their first 4,096 bytes encrypted, leaving later content accessible. Of 17 validated encrypted files, fourteen larger files showed a 4,096 byte encrypted prefix and three smaller files were encrypted across their full length. Configuration settings indicated full encryption, but they did not match the larger files’ actual condition (Cyber Security News).
• Partial recovery: researchers recovered 73 CRC-valid internal components from seven encrypted Office documents without a key, including worksheet and shared-string data. This was partial content recovery, not full restoration or a universal decryptor (GBHackers, Cyber Security News).
• Key handling: the malware uses 16 byte symmetric keys, AES counter-mode processing and RSA protection for recovery material. Each validated October 17 output kept its original-length body and added a 556 byte trailer with encryption metadata and a wrapped key. Researchers recovered neither a plaintext encryption key nor an RSA private key. HYFLOCK can also keep encrypting when key wrapping or backup storage fails (Cyber Security News).
• Scope of the finding: the 4 KB result is specific to the tested build and collected files, and should not be treated as universal across the family (Cyber Security News).

Demonstrated versus claimed

• Controlled analysis of the October 17 build recorded 500 successful ransomware-extension renames and 17 validated encrypted files. These counts measure different things and are not interchangeable (GBHackers, Cyber Security News).
• Researchers observed network-share access and attempts to interfere with system recovery. Recovery-sabotage commands had varied outcomes, and complete deletion of recovery objects was not proven. Administrative-share activity did not establish compromise of another computer (Cyber Security News).
• Successful domain-wide spreading was not observed, and Group Policy propagation was disabled in the recovered configuration (GBHackers, Cyber Security News).
• Advertised vulnerable-driver techniques for disabling security tools, and claims of continued operation after remote desktop sessions disconnected, remain unverified (GBHackers).

No CVE is associated with this story in the sources. Initial access method: not confirmed.

Am I affected?

The sources describe a Windows ransomware family, so Windows endpoints and servers reachable through network shares are the relevant scope. No vendor product vulnerability or affected version list is given. Whether any real victim was compromised is not confirmed, because the eight leak site entries are unverified claims.

Indicators from the source-confirmed artifact list (Cyber Security News):

What to do now

1. Hunt for the artifacts above, especially an EdgeUpdate_ style folder under ProgramData, eu.cfg, system_config.dat, .locked_ extensions and .hyflock_claim files on shares.
2. Review scheduled tasks for unexpected entries that launch a copy of an executable from a update-like directory (GBHackers).
3. Review network-share access and administrative-share activity, and tighten segmentation so one host cannot reach broad file shares.
4. Protect recovery paths, including backups, since the malware attempts to interfere with system recovery (GBHackers).
5. If files are encrypted, preserve the encrypted files and execution evidence before attempting restoration. Do not overwrite them.
6. Identify the exact build, because recovery prospects differ. The earlier October build may have destroyed data permanently, while the October 17 build leaves content past the first 4,096 bytes of larger files readable (GBHackers, Cyber Security News).
7. Do not assume paying a ransom or obtaining a key restores files. The findings do not establish that every affected file can be recovered or that payment would resolve the damage (GBHackers).

Sources

• GBHackers: Hackers Develop New HYFLOCK Ransomware That Encrypts Files and Attempts to Block Recovery
• Cyber Security News: HYFLOCK Ransomware Encrypts Only First 4KB of Larger Files, Leaves Parts of Victims’ Files Accessible