EndPoint (Midnight) Ransomware — Babuk-derived double-extortion targeting Windows, ESXi, and NAS — Threadlinqs Intelligence
As of 2026-06-09, EndPoint (Midnight) Ransomware — Babuk-derived double-extortion targeting Windows, ESXi, and NAS is a critical-severity ransomware threat attributed to North Korea-linked operators (North Korea), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 19 indicators of compromise.
Threat ID: TL-2026-0742 · Severity: CRITICAL · Status: ACTIVE · Category: RANSOMWARE
Attribution: North Korea-linked operators · North Korea · FINANCIAL
EndPoint, previously tracked as Midnight, is a Babuk-framework-derived ransomware that uses ChaCha20 for file content and RSA to wrap the per-file ChaCha20 key, applying intermittent/partial
EndPoint (Midnight) is a ransomware family built on the leaked Babuk source code. Babuk first appeared in early 2021 as a ransomware-as-a-service operation; after its operators shut down in mid-2021 and leaked the full source code, multiple derivatives emerged including ESXiArgs, Rorschach, and Midnight/EndPoint. Gen Digital (Avast/Norton) researchers first publicly detailed Midnight on 2025-10-27, and AhnLab Security Emergency Response Center (ASEC) published its EndPoint variant analysis on 2026-05-21, attributing the ransom-note contact infrastructure to North Korea-linked threat actors active since 2024.
Encryption architecture: EndPoint uses ChaCha20 as the symmetric file-content cipher and protects the per-file ChaCha20 session key with an RSA public key. The RSA-encrypted session key together with its SHA-256 hash is appended to the footer of each encrypted file. To control processing speed and maximize throughput against large data stores, the malware uses partial/intermittent encryption — encrypting only a portion of each file rather than the whole — combined with multi-threaded execution. Earlier variants prioritized database and backup file types (.mdf, .ndf, .bak, .dbf, .sql, .rman); newer samples encrypt nearly all file types except executables and self-artifacts (.exe, .dll, .msi, .endpoint).
Cryptographic flaw: although EndPoint inherits Babuk's core structure and execution flow, its cryptographic layer was significantly reworked. Implementation errors in RSA key handling and data padding inadvertently weakened the scheme, allowing Gen analysts to reconstruct a working decryptor that bypasses the attacker's private key entirely. Free decryptors for 32-bit and 64-bit Windows have been released, enabling file recovery without ransom payment under certain conditions.
Impact behavior: on execution the malware enforces single-instance operation via the mutex 'Mutexisfunnylocal' (also reported as 'Mutexisfunnylocam'), deletes volume shadow copies with 'vssadmin.exe delete shadows /all /quiet' to inhibit recovery, and terminates VSS, SQL, Veeam, Sophos, Acronis and other backup/security services to unlock files and disable defenses. It avoids encrypting system-critical paths (Windows, Program Files, AppData) and files (bootmgr, ntuser.dat). A ransom note titled 'How To Restore Your Files.txt' is dropped in every affected directory, and an optional debug log ('debug.endpoint' or 'Report.Midnight') may be written to the executable directory. Operators run a double-extortion model that combines on-host encryption with the threat of leaking exfiltrated data, and provide victim contact via email, uTox ID, and Session messenger.
Command-line operation: the binary supports '-paths=' / '--paths=' to target specific directories, '/n' to enable network-volume/share encryption, and '/e' controlling the extension-append behavior on encrypted file content.
Weaknesses (CWE)
CWE-326, CWE-327, CWE-1240
Target sectors: enterprise, data centers, virtualization, storage, backup-dependent organizations
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 19 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
RANSOMWARE, CRITICAL, threat intelligence, cybersecurity, T1587, T1588, T1059, T1106, T1480, T1562, T1070, T1083, T1135, T1057