EndPoint (formerly Midnight) Babuk-Derived Ransomware — Windows/ESXi/NAS Double Extortion with ChaCha20+RSA Encryption and North Korea-Linked Ransom-Note Lineage (CVE-less, ASEC)
EndPoint (formerly Midnight) Babuk-Derived Ransomware (TL-2026-0652), also tracked as EndPoint, is a high-severity malware campaign, first published 2026-06-01. It carries a reported North Korea nexus and is not formally attributed, affects Microsoft Windows, maps to 14 MITRE ATT&CK techniques (T1005, T1007, T1059), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-0652
- Threat ID
- TL-2026-0652
- Also known as
- EndPoint, Midnight
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-01
- Last reviewed
- 2026-06-01
- Attribution confidence
- NONE
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- enterprise, virtualization-infrastructure, storage-infrastructure, academia
- Target regions
- East Asia, South Korea, Global
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in EndPoint (formerly Midnight) Babuk-Derived Ransomware
Malware and tooling: EndPoint, Midnight, Babuk builder
EndPoint is a Babuk-source-leak-derived ransomware family — previously tracked as 'Midnight' — that targets Windows, ESXi, and NAS environments using double extortion (ChaCha20 file encryption plus data-exfiltration threats). Encrypted files receive the .endpoint extension and a 'How To Restore Your Files.txt' note; victims are directed to a uTox ID and Session messenger. The ransom-note email account previously used by the family (schipkealfred@gmail.com, impersonating the director of the East Asia Institute) has been identified as used by North Korea-linked threat actors since 2024.
How EndPoint (formerly Midnight) Babuk-Derived Ransomware works
EndPoint is a cross-platform ransomware family analyzed by AhnLab Security Emergency response Center (ASEC) in May 2026 and identified as the renamed successor to the 'Midnight' ransomware. Both variants are built on the leaked Babuk ransomware framework, whose Windows, ESXi, and NAS builders were publicly leaked in mid-2021, seeding a wave of derivative families.
Unlike the original Babuk (which used HC-256 stream encryption with ECDH key exchange), EndPoint/Midnight reworks the cryptographic core: file contents are encrypted with the ChaCha20 stream cipher, and the per-file ChaCha20 session key is wrapped using an in-house-implemented RSA public-key operation. After encryption, the wrapped session key and a SHA-256 hash are appended to a fixed footer at the end of each file. The malware applies file-size-based intermittent (partial) encryption — encrypting only a portion of large files — inheriting Babuk's speed-over-completeness design. Gen Digital (Norton/Avast) researchers identified a flaw in the in-house RSA implementation (introduced while attempting to improve encryption speed/strength) and released a free Midnight decryptor on 28 October 2025; under certain conditions affected files can be recovered without paying.
On execution EndPoint guards against concurrent runs with the mutex 'Mutexisfunnylocal' and supports command-line arguments: '-paths=' (encrypt only specified paths), '/n' (encrypt only network shared folders), and '/e' (disable changing the .endpoint extension). It writes a debug log — 'debug.endpoint' (or 'Report.Midnight' depending on build) — in the executable path, logging FindFirstFileW and MoveFileExW failures. To inhibit recovery it runs 'vssadmin.exe delete shadows /all /quiet', stops backup/security/database services (VSS, SQL, Veeam, Sophos, Acronis), and terminates database, office, and mail-client processes. It avoids breaking the host by excluding the Windows, Program Files, and AppData directories; the bootmgr and ntuser.dat files; and the .exe, .dll, .msi, and .endpoint extensions.
The family operates a double-extortion model: data is exfiltrated before encryption and victims are threatened with publication. The ransom note offers free decryption of 3 files as proof and directs contact via a uTox ID and Session messenger. Attribution is supported by the reuse of the ransom-note email account schipkealfred@gmail.com, which previously impersonated the director of the East Asia Institute and has been tied to North Korea-linked threat actors since 2024; this is a ransom-note-lineage signal rather than a definitive named-group attribution.
MITRE ATT&CK techniques used in TL-2026-0652
Collection
Discovery
T1007 System Service Discovery; T1083 File and Directory Discovery; T1135 Network Share Discovery
Execution
T1059 Command and Scripting Interpreter; T1106 Native API
Defense Evasion
Impact
T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery; T1657 Financial Theft
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
defense-impairment
Affected products and versions in EndPoint (formerly Midnight) Babuk-Derived Ransomware
- Microsoft — Windows
Vulnerable versions: Windows (all supported desktop/server builds running the EndPoint encryptor) - VMware (Broadcom) — ESXi
Vulnerable versions: ESXi hosts targeted by the Babuk-derived ESXi encryptor variant - Various — NAS (Network Attached Storage)
Vulnerable versions: NAS appliances targeted by the Babuk-derived NAS encryptor variant
Remediation for EndPoint (formerly Midnight) Babuk-Derived Ransomware
Immediate actions
- Isolate affected Windows, ESXi, and NAS hosts from the network to halt lateral encryption of shared folders
- Hunt for and terminate processes holding the mutex 'Mutexisfunnylocal'
- Search for the file artifacts 'debug.endpoint' / 'Report.Midnight' and files bearing the .endpoint extension
- Preserve encrypted samples and the file footer — recovery may be possible with the free Norton/Avast Midnight decryptor due to the RSA implementation flaw
Workarounds
- Attempt free recovery with the Norton/Avast Midnight Ransomware Decryptor (32-bit and 64-bit) before considering any ransom — contact decryptors@avast.com
- Block and alert on 'vssadmin.exe delete shadows /all /quiet' via attack-surface-reduction / tamper protection
Longer-term hardening
- Deploy EDR with behavioral detection for mass file-rename, shadow-copy deletion, and service-stop sequences
- Maintain offline, immutable backups segmented from production and tested for restore
- Enforce network segmentation between Windows, ESXi management, and NAS storage planes to limit /n network-share encryption
- Monitor for unauthorized data exfiltration ahead of encryption (double-extortion staging)
Timeline of EndPoint (formerly Midnight) Babuk-Derived Ransomware
- Babuk ransomware operators leak full source code and builders for Windows, ESXi, and NAS — seeding a wave of derivative families including Midnight/EndPoint.
- Ransom-note email account schipkealfred@gmail.com (impersonating the director of the East Asia Institute) identified as used by North Korea-linked threat actors.
- Gen Digital (Norton/Avast) discloses a flaw in Midnight's in-house RSA key-wrapping implementation and releases a free 32-bit/64-bit Midnight decryptor enabling file recovery without paying.
- ASEC publishes deep analysis ('Crypto Guest at Dawn') covering ChaCha20+RSA encryption, mutex, execution arguments, anti-recovery behavior, and North Korea-linked ransom-note lineage.
- ASEC documents the family renamed from 'Midnight' to 'EndPoint', encrypting files with the .endpoint extension and dropping 'How To Restore Your Files.txt'.
Sources cited for EndPoint (formerly Midnight) Babuk-Derived Ransomware
- Crypto Guest at Dawn — EndPoint (Midnight) ransomware analysis
- Decrypted: Midnight Ransomware
- Free Midnight ransomware decryption tool
- Midnight Ransomware Decryption Flaw: Babuk Successor's RSA Implementation Mistake Allows Free File Recovery
- Norton Researchers Crack Midnight Ransomware, Release Free Decryptor
- Threat analysis: Babuk ransomware
Threats related to EndPoint (formerly Midnight) Babuk-Derived Ransomware
Detection coverage for TL-2026-0652
As of 2026-06-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0652 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.