HYFLOCK ransomware encrypts only first 4KB of larger files
Original title: HYFLOCK Ransomware Encrypts Only First 4KB of Larger Files, Leaves Parts of Victims’ Files Accessible
Check Point recovered selected Office components from an October 17 build but found no general decryptor or keys.
Check Point Exposure Management researchers found that an October 17 HYFLOCK build encrypted only the first 4,096 bytes of larger files in testing, leaving later content readable. They recovered 73 internal components from seven encrypted Microsoft Office files, but not complete documents, a plaintext key, or an RSA private key. An earlier October build could discard file data during processing. HYFLOCK, promoted as ransomware-as-a-service since March 2026, had eight unverified leak-site victim claims by October 13.
Unconfirmed: Eight leak-site victim claims are unverified, and partial encryption applies only to the tested October 17 files.
- Fourteen of 17 validated files had a 4,096-byte encrypted prefix.
- Each validated file kept its original body and added a 556-byte trailer.
- The encryptor uses 16-byte keys, AES counter mode, and RSA-wrapped recovery material.
- Testing saw a scheduled task, share processing, and incomplete recovery disruption.
- IoCs include eu.exe under ProgramData\EdgeUpdate, .locked extensions, and HFLKEY01.
Impact: Partial encryption leaves later portions of larger files readable
- 1.Preserve affected files and execution evidence before attempting restoration.
- 2.Review scheduled tasks, share access, segmentation, and recovery protections.
- 3.Hunt for ProgramData\EdgeUpdate staging, .locked extensions, and HFLKEY01 trailers.
- Malware
- HYFLOCK
- Organizations
- Check Point
From the original article
3 min read at cybersecuritynews.com
HYFLOCK ransomware has an encryption weakness that leaves parts of larger files readable, giving affected organizations a limited chance to recover data without paying attackers. In the October 17 build, the malware encrypted only the first 4,096 bytes of larger files examined during testing, leaving content beyond that section accessible. The finding does not mean […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.