Check Point researchers have identified encryption vulnerabilities in the HYFLOCK ransomware, enabling them to recover data without obtaining decryption keys This article explores vulnerabilities hyflock ransomware. . The team extracted 73 internal components from seven encrypted Office files, revealing a flaw in how one ransomware build processes larger files.
During this period, HYFLOCK altered its delivery methods, background execution techniques, and network activity, expanding its public extortion operations.
On October 13, the leak site published eight victim claims across various industries including manufacturing, business services, government, retail, and telecommunications. The April sample included a Windows ransomware core written in Rust, supporting encryption, network targeting, and attempts to disrupt security and recovery tools, although runtime testing was limited.
Changes in HYFLOCK’s ransomware execution and deployment across four analyzed generations (Source: checkpoint) resulted in a July version that introduced a separate loader that delivered the ransomware, configuration, and encryption key material while retaining the underlying Rust/Nishi foundation. An earlier October build utilized a Go-based carrier to extract and launch a revised payload, which attempted background execution via a scheduled task. No successful domain-wide propagation was detected.
An older version contained a processing defect that could permanently discard file data, indicating complete recovery may not be possible even with the correct decryption key.
