Four ransomware generations. Six months of development. Eight victim claims published in a single day.
HYFLOCK spent much of 2026 building its ransomware operation, recruiting participants through underground forums and promoting increasingly sophisticated attack capabilities. By October, the group had begun publicly naming victims, and its ransomware had undergone significant changes.
Through threat hunting, Check Point Exposure Management researchers identified updated HYFLOCK ransomware builds and traced their development from April through October. The investigation revealed changes in how the malware launches, runs in the background, and interacts with network resources. Researchers also uncovered encryption weaknesses that could affect victims’ ability to recover their files.
The findings provide a closer look at HYFLOCK’s technical evolution, including the capabilities confirmed during analysis and those still awaiting verification.
Key Takeaways
- HYFLOCK’s ransomware evolved across four generations, with October introducing significant changes to deployment, background execution, and network activity.
- Researchers confirmed working encryption capabilities, including file encryption, scheduled-task registration, network-share activity, and attempts to interfere with recovery.
- Several advertised capabilities remain unverified, including successful domain-wide propagation and reliable execution after remote desktop sessions end.
- Encryption weaknesses affected recovery, allowing researchers to recover 73 internal components from seven encrypted Office files without obtaining a key.
- Public extortion followed months of recruitment, with eight victim claims appearing on HYFLOCK’s leak site on October 13.
How HYFLOCK Developed
HYFLOCK first appeared in underground forums in March 2026, advertising a Ransomware-as-a-Service (RaaS) platform. Its recruitment posts promoted encryption performance, access procurement, technical assistance, and shared negotiation tools designed to support affiliates carrying out attacks.
Over the following months, the group continued recruiting and developing its ransomware. By October, HYFLOCK had announced version 2.0 and begun presenting itself as a more integrated organization.
On October 13, the group published eight victim claims spanning manufacturing, business services, government, retail, and telecommunications. The listings remain unverified actor claims, and the investigation did not establish how the organizations were initially compromised or why they were targeted.
This activity provides a timeline for HYFLOCK’s development and the technical changes researchers identified in its ransomware during the same period.
Inside the Updated Ransomware
Researchers examined four ransomware generations, beginning with an April sample that already contained a developed Windows ransomware core written in Rust. The malware supported file encryption, network targeting, and attempts to interfere with security and recovery tools, although several capabilities could only be identified in the code because runtime analysis was limited.
In July, HYFLOCK introduced a new approach to packaging and launching the ransomware. A separate loader delivered the malware alongside its configuration and encryption key material, retaining the same underlying Rust/Nishi foundation.
October brought more substantial changes. An earlier build introduced a Go-based carrier that extracted and launched a revised ransomware payload, which then attempted to establish background execution through a scheduled task.
A second build, identified on October 17, ran as a standalone Rust encryptor and staged a copy of itself under a directory resembling a legitimate software update component. During analysis, it successfully registered a scheduled task and demonstrated extensive file processing, encryption, and network-share activity.
The changes show how HYFLOCK continued refining its ransomware’s execution and deployment capabilities throughout the year.
Figure 1. Changes in HYFLOCK’s ransomware execution and deployment across four analyzed generations.
What Researchers Confirmed
As HYFLOCK developed its ransomware, the operators promoted features intended to make attacks easier to deploy and harder to interrupt. Researchers examined these claims against the behavior observed in the analyzed samples.
The October 17 build successfully encrypted files, registered a scheduled task, accessed network-share resources, and attempted to interfere with system recovery. During controlled analysis, it produced 500 successful ransomware-extension renames and 17 validated encrypted files.
The malware also contained functionality for deploying ransomware across a network. However, successful domain-wide propagation was not observed, and Group Policy spreading was disabled in the recovered configuration.
Other advertised features, including reliable execution after remote desktop sessions end and the use of vulnerable drivers to disable security tools, remain unverified.
These observations provide a clearer picture of the ransomware’s demonstrated behavior and the capabilities requiring further investigation.
Encryption Weaknesses and File Recovery
The investigation also uncovered weaknesses in HYFLOCK’s encryption process, revealing different recovery outcomes across the October builds.
In an earlier October version, researchers identified a processing defect that could permanently discard portions of a file, potentially preventing complete recovery even with the correct decryption key.
The October 17 build exhibited another issue. Researchers discovered that larger files had only their first 4,096 bytes encrypted, leaving additional content accessible beyond that initial section.
By examining the remaining data, researchers recovered 73 CRC-valid internal components from seven encrypted Office files, including worksheet and shared-string data, without obtaining an encryption key.
Figure 2. The October 17 encryption behavior left portions of larger files accessible for partial recovery.
The recovered material represented portions of the affected files. Researchers did not restore complete files or develop a general method for decrypting HYFLOCK ransomware.
The findings demonstrate how differences between ransomware builds can influence file damage and the recovery options available to affected organizations.
What Security Teams Can Learn
HYFLOCK’s development shows how ransomware operations can evolve over a short period, with changes to execution, deployment, and file processing influencing both attack behavior and recovery.
For security teams, the findings highlight the value of examining individual ransomware versions and preserving affected artifacts during investigations. Reviewing network-share access, segmentation, scheduled-task activity, and recovery protections can also help organizations assess their exposure to the techniques observed in this research.
Check Point Exposure Management connects threat intelligence with asset context, vulnerabilities, and existing security controls to help organizations identify relevant exposures, validate exploitability, and coordinate safe remediation.
For the complete investigation, technical findings, and indicators of compromise, read the full HYFLOCK report.
Schedule a demo to see how Check Point Exposure Management turns threat intelligence into prioritized action.
