New HYFLOCK ransomware encrypts Windows files and tries to block recovery
RANSOMWAREHYFLOCKredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Researchers describe successive Windows encryptors from the HYFLOCK ransomware operators that encrypt files, access network shares and attempt to obstruct recovery. Encryption and scheduled-task registration were confirmed, while domain-wide propagation and reliable remote execution were not established, and implementation flaws produce uneven results for victims. The article does not name CVEs or affected versions. Defenders should monitor for unexpected scheduled-task creation and unusual SMB access, and verify backups are offline and tested.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Verify that backups are current, offline or immutable, and tested for restoration.
- Monitor for unexpected scheduled tasks and unusual access to network shares.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
GBHackers
Who and what is in it
Malware