HYFLOCK ransomware flaw leaves parts of larger files readable, offering limited recovery
RANSOMWAREHYFLOCKredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Check Point Exposure Management researchers found that the October 17 build of HYFLOCK encrypted only the first 4,096 bytes of larger files, leaving the rest intact. They recovered 73 internal components from seven Office files, but could not decrypt the encrypted prefixes without matching key material. An earlier October build could discard file data outright, which could block full recovery even with the correct key.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Preserve affected files and execution evidence before attempting any restoration.
- Review scheduled tasks, network share access and segmentation for signs of HYFLOCK activity.
- Check for the staging path ProgramData\EdgeUpdate with eu.exe and eu.cfg, the .locked extension and the HFLKEY01 trailer marker.
- Verify recovery protections before attempting restoration, as the malware attempted to disrupt recovery.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News
Who and what is in it
Malware
Companies