# EndPoint (formerly Midnight) Babuk-Derived Ransomware — Windows/ESXi/NAS Double Extortion with ChaCha20+RSA Encryption and North Korea-Linked Ransom-Note Lineage (CVE-less, ASEC)

> EndPoint is a Babuk-source-leak-derived ransomware family — previously tracked as 'Midnight' — that targets Windows, ESXi, and NAS environments using double extortion (ChaCha20 file encryption plus data-exfiltration threats). Encrypted files receive the .endpoint extension and a 'How To Restore Your Files.txt' note; victims are directed to a uTox ID and Session messenger. The ransom-note email account previously used by the family (schipkealfred@gmail.com, impersonating the director of the East Asia Institute) has been identified as used by North Korea-linked threat actors since 2024.

- **Published:** 2026-06-01T00:00:00Z
- **Last reviewed:** 2026-06-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0652
- **ID:** TL-2026-0652
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

EndPoint is a cross-platform ransomware family analyzed by AhnLab Security Emergency response Center (ASEC) in May 2026 and identified as the renamed successor to the 'Midnight' ransomware. Both variants are built on the leaked Babuk ransomware framework, whose Windows, ESXi, and NAS builders were publicly leaked in mid-2021, seeding a wave of derivative families.

Unlike the original Babuk (which used HC-256 stream encryption with ECDH key exchange), EndPoint/Midnight reworks the cryptographic core: file contents are encrypted with the ChaCha20 stream cipher, and the per-file ChaCha20 session key is wrapped using an in-house-implemented RSA public-key operation. After encryption, the wrapped session key and a SHA-256 hash are appended to a fixed footer at the end of each file. The malware applies file-size-based intermittent (partial) encryption — encrypting only a portion of large files — inheriting Babuk's speed-over-completeness design. Gen Digital (Norton/Avast) researchers identified a flaw in the in-house RSA implementation (introduced while attempting to improve encryption speed/strength) and released a free Midnight decryptor on 28 October 2025; under certain conditions affected files can be recovered without paying.

On execution EndPoint guards against concurrent runs with the mutex 'Mutexisfunnylocal' and supports command-line arguments: '-paths=' (encrypt only specified paths), '/n' (encrypt only network shared folders), and '/e' (disable changing the .endpoint extension). It writes a debug log — 'debug.endpoint' (or 'Report.Midnight' depending on build) — in the executable path, logging FindFirstFileW and MoveFileExW failures. To inhibit recovery it runs 'vssadmin.exe delete shadows /all /quiet', stops backup/security/database services (VSS, SQL, Veeam, Sophos, Acronis), and terminates database, office, and mail-client processes. It avoids breaking the host by excluding the Windows, Program Files, and AppData directories; the bootmgr and ntuser.dat files; and the .exe, .dll, .msi, and .endpoint extensions.

The family operates a double-extortion model: data is exfiltrated before encryption and victims are threatened with publication. The ransom note offers free decryption of 3 files as proof and directs contact via a uTox ID and Session messenger. Attribution is supported by the reuse of the ransom-note email account schipkealfred@gmail.com, which previously impersonated the director of the East Asia Institute and has been tied to North Korea-linked threat actors since 2024; this is a ransom-note-lineage signal rather than a definitive named-group attribution.

## MITRE ATT&CK

- T1588 Obtain Capabilities
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1083 File and Directory Discovery
- T1135 Network Share Discovery
- T1007 System Service Discovery
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1005 Data from Local System
- T1567 Exfiltration Over Web Service
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1657 Financial Theft

## Sources

- [Crypto Guest at Dawn — EndPoint (Midnight) ransomware analysis](https://asec.ahnlab.com/en/93932/)
- [Decrypted: Midnight Ransomware](https://www.gendigital.com/blog/insights/research/midnight-ransomware)
- [Free Midnight ransomware decryption tool](https://us.norton.com/blog/malware/free-midnight-ransomware-decryption-tool)
- [Midnight Ransomware Decryption Flaw: Babuk Successor's RSA Implementation Mistake Allows Free File Recovery](https://securityonline.info/midnight-ransomware-decryption-flaw-babuk-successors-rsa-implementation-mistake-allows-free-file-recovery/)
- [Norton Researchers Crack Midnight Ransomware, Release Free Decryptor](https://hackread.com/norton-midnight-ransomware-free-decryptor/)
- [Threat analysis: Babuk ransomware](https://www.acronis.com/en/blog/posts/babuk-ransomware/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0652