HYFLOCK ransomware encrypts file prefixes; no general decryptor
First merged summary.
An October 17 HYFLOCK build encrypts only the first 4,096 bytes of larger files; Check Point found no general decryptor or keys.
HYFLOCK, promoted as ransomware-as-a-service since March 2026, is a Windows encryptor with four generations analyzed between April and October 2026. Check Point Exposure Management tested an October 17 build that encrypted only the first 4,096 bytes of larger files, left later content readable, and added a 556-byte trailer. Researchers recovered 73 internal components from seven encrypted Microsoft Office files, but not complete documents, a plaintext key, or an RSA private key. GBHackers reports partial recovery of some Office documents in one build; Cyber Security News says recovered material was components, not complete documents, and an earlier October build could discard file data. Network-share access was confirmed, but group-policy and domain-wide propagation were not. Eight leak-site victim claims by October 13 remain unverified.
- October 17 build encrypts a 4,096-byte prefix on larger files.
- Fourteen of 17 validated files kept original bodies and 556-byte trailers.
- Encryptor uses 16-byte keys, AES counter mode, and RSA-wrapped material.
- Four Windows encryptor generations were analyzed from April to October 2026.
- IoCs include eu.exe under ProgramData\EdgeUpdate, .locked extensions, and HFLKEY01.
- No general decryptor, plaintext key, or RSA private key was recovered.
Timeline
dated events in the reporting · oldest first- Oct 13, 2026Eight unverified leak-site victim claims recorded · Cyber Security News
- Oct 17, 2026Tested build encrypts first 4,096 bytes of larger files · Cyber Security News
- Nov 5, 2026Outlets publish Check Point analysis of HYFLOCK builds · Cyber Security News
What each outlet adds
beyond the shared facts- Cyber Security News4KB prefix, trailer size, crypto details, IoCs, and eight claims
- GBHackersFour generations and disabled group-policy, domain-wide propagation
- Vendors
- Check Point
- Malware
- HYFLOCK
- Organizations
- Check Point
Coverage
oldest first · one row per article · UTC- · 6d ago
GBHackersFirst report
HYFLOCK ransomware encrypts files and blocks recovery
Partial recovery of some Office documents possible but certain builds corrupt files permanently.
- · 6d ago
Cyber Security News
HYFLOCK ransomware encrypts only first 4KB of larger files
Check Point recovered selected Office components from an October 17 build but found no general decryptor or keys.