EndPoint (formerly Midnight) Babuk-Derived Ransomware — Windows/ESXi/NAS Double Extortion with ChaCha20+RSA Encryption and North Korea-Linked Ransom-Note Lineage (CVE-less, ASEC) — Threadlinqs Intelligence
As of 2026-06-01, EndPoint (formerly Midnight) Babuk-Derived Ransomware — Windows/ESXi/NAS Double Extortion with ChaCha20+RSA Encryption and North Korea-Linked Ransom-Note Lineage (CVE-less, ASEC) is a high-severity malware threat attributed to a North Korea (suspected)-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-0652 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: North Korea (suspected) · FINANCIAL
EndPoint is a Babuk-source-leak-derived ransomware family — previously tracked as 'Midnight' — that targets Windows, ESXi, and NAS environments using double extortion (ChaCha20 file encryption plus
EndPoint is a cross-platform ransomware family analyzed by AhnLab Security Emergency response Center (ASEC) in May 2026 and identified as the renamed successor to the 'Midnight' ransomware. Both variants are built on the leaked Babuk ransomware framework, whose Windows, ESXi, and NAS builders were publicly leaked in mid-2021, seeding a wave of derivative families.
Unlike the original Babuk (which used HC-256 stream encryption with ECDH key exchange), EndPoint/Midnight reworks the cryptographic core: file contents are encrypted with the ChaCha20 stream cipher, and the per-file ChaCha20 session key is wrapped using an in-house-implemented RSA public-key operation. After encryption, the wrapped session key and a SHA-256 hash are appended to a fixed footer at the end of each file. The malware applies file-size-based intermittent (partial) encryption — encrypting only a portion of large files — inheriting Babuk's speed-over-completeness design. Gen Digital (Norton/Avast) researchers identified a flaw in the in-house RSA implementation (introduced while attempting to improve encryption speed/strength) and released a free Midnight decryptor on 28 October 2025; under certain conditions affected files can be recovered without paying.
On execution EndPoint guards against concurrent runs with the mutex 'Mutexisfunnylocal' and supports command-line arguments: '-paths=' (encrypt only specified paths), '/n' (encrypt only network shared folders), and '/e' (disable changing the .endpoint extension). It writes a debug log — 'debug.endpoint' (or 'Report.Midnight' depending on build) — in the executable path, logging FindFirstFileW and MoveFileExW failures. To inhibit recovery it runs 'vssadmin.exe delete shadows /all /quiet', stops backup/security/database services (VSS, SQL, Veeam, Sophos, Acronis), and terminates database, office, and mail-client processes. It avoids breaking the host by excluding the Windows, Program Files, and AppData directories; the bootmgr and ntuser.dat files; and the .exe, .dll, .msi, and .endpoint extensions.
The family operates a double-extortion model: data is exfiltrated before encryption and victims are threatened with publication. The ransom note offers free decryption of 3 files as proof and directs contact via a uTox ID and Session messenger. Attribution is supported by the reuse of the ransom-note email account schipkealfred@gmail.com, which previously impersonated the director of the East Asia Institute and has been tied to North Korea-linked threat actors since 2024; this is a ransom-note-lineage signal rather than a definitive named-group attribution.
Target sectors: enterprise, virtualization-infrastructure, storage-infrastructure, academia
Target regions: East Asia, South Korea, Global
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1588, T1059, T1106, T1083, T1135, T1007, T1562, T1070, T1005, T1567