HYFLOCK ransomware flaw leaves parts of larger files readable, offering limited recovery
- Severity
- High
- Sources
- 1
What happened
Check Point Exposure Management traced four HYFLOCK generations from April to October 2026. The October 17 Rust build encrypted only the first 4,096 bytes of 14 larger files, and fully encrypted three smaller ones, appending a 556-byte trailer with a wrapped key; recovery was partial only, with no plaintext key or RSA private key recovered. An earlier October Go-carrier build could drop data during processing. Defenders should preserve affected files and execution evidence, then review scheduled tasks, share access, segmentation and recovery protections before restoration. Watch for ProgramData\EdgeUpdate paths, eu.cfg, .locked extensions and the HFLKEY01 trailer marker.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Preserve affected files and execution evidence before attempting any restoration.
- Review scheduled tasks, network share access and segmentation for signs of HYFLOCK activity.
- Check for the staging path ProgramData\EdgeUpdate with eu.exe and eu.cfg, the .locked extension and the HFLKEY01 trailer marker.
- Verify recovery protections before attempting restoration, as the malware attempted to disrupt recovery.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Malware
Companies