HYFLOCK Ransomware Encrypts Only First 4KB of Larger Files, Leaves Parts of Victims’ Files Accessible

HYFLOCK ransomware has an encryption weakness that leaves parts of larger files readable, giving affected organizations a limited chance to recover data without paying attackers.

In the October 17 build, the malware encrypted only the first 4,096 bytes of larger files examined during testing, leaving content beyond that section accessible.

The finding does not mean victims can unlock everything. Researchers recovered selected contents from encrypted Microsoft Office files, but did not restore complete documents or produce a general decryptor.

An earlier October build presented a different danger: a processing defect could permanently discard file data, potentially preventing full recovery even with the correct key.

Check Point Exposure Management researchers identified the updated HYFLOCK builds through threat hunting, tracing four generations from April through October 2026.

Their published investigation into HYFLOCK separates observed behavior from operator claims, revealing stronger deployment features alongside uneven file processing.

HYFLOCK Ransomware

The October 17 sample produced 17 validated encrypted files. Fourteen larger files recorded an encrypted prefix of 4,096 bytes, while three smaller files were encrypted across their complete original lengths.

Configuration settings indicated full encryption, but those settings did not match the larger files’ actual condition. Partial encryption also appears in other ransomware families.

For example, Gunra’s configurable partial encryption lets attackers select how much content to encrypt. HYFLOCK’s finding, however, is specific to the tested build and collected files; it should not be treated as universal behavior across the family.

Examining the untouched content, researchers recovered 73 internal components from seven encrypted Office files, including worksheet and shared-string data.

Those components passed cyclic redundancy checks, supporting their integrity. The result demonstrates partial recovery, not decryption: the encrypted prefixes remained unavailable without matching key material or an exact trusted copy.

The malware uses 16-byte symmetric keys, AES counter-mode processing, and RSA protection for recovery material.

Each validated October 17 output retained its original-length body and added a 556-byte trailer containing encryption metadata and a wrapped key. Researchers recovered neither a plaintext encryption key nor an RSA private key.

Recovery risks extend beyond inaccessible prefixes. The earlier October build could omit data during processing, echoing the broader problem illustrated by VECT’s damaging recovery flaws, where implementation errors undermine restoration.

HYFLOCK can also continue encrypting when key wrapping or backup storage fails, creating another potential barrier to recovery.

Updated Rust Encryptor Expands Deployment and Recovery Risks

HYFLOCK appeared in underground promotion in March 2026 as a Ransomware-as-a-Service offering. By October 13, its leak site carried eight victim claims across manufacturing, business services, government, retail, and telecommunications.

These remain unverified attacker claims; the investigation did not establish the victims’ initial compromise routes. The April sample already contained a Windows ransomware core written in Rust.

July added a separate loader carrying the payload, configuration, and key material. An earlier October version used a Go carrier, while the October 17 build returned to a standalone Rust executable that copied itself into an update-like directory.

During controlled testing, the newer build registered a scheduled task, processed network-share resources, and attempted to disrupt recovery.

It generated 500 successful ransomware-extension renames, although only 17 collected files were independently validated as encrypted. Those counts describe different observations and should not be treated as interchangeable measures of damage.

Recovery interference is also documented in Gentlemen ransomware’s backup disruption, but HYFLOCK’s results require qualification.

Its recovery-sabotage commands had varied outcomes, and complete deletion of recovery objects was not proven. Likewise, administrative-share activity did not establish compromise of another computer.

Successful domain-wide propagation was not observed, and Group Policy spreading was disabled in the recovered configuration. Advertised vulnerable-driver attacks and reliable execution after remote desktop sessions ended also remained unverified.

Defenders should preserve affected files and execution evidence, then review scheduled tasks, share access, segmentation, and recovery protections before attempting restoration.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.