EndPoint (Midnight) Ransomware — Babuk-derived double-extortion targeting Windows, ESXi, and NAS
EndPoint (Midnight) Ransomware (TL-2026-0742), also tracked as Midnight ransomware, is a critical-severity ransomware operation, first published 2026-06-09. It is linked to a North Korea-nexus actor with medium confidence, affects Microsoft Windows, maps to 15 MITRE ATT&CK techniques (T1057, T1059, T1070), and is covered by 9 detection rules and 19 indicators of compromise.
Key facts for TL-2026-0742
- Threat ID
- TL-2026-0742
- Also known as
- Midnight ransomware, EndPoint ransomware
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- 2026-06-09
- Last reviewed
- 2026-06-09
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- enterprise, data centers, virtualization, storage, backup-dependent organizations
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in EndPoint (Midnight) Ransomware
Malware and tooling: EndPoint, Midnight
EndPoint, previously tracked as Midnight, is a Babuk-framework-derived ransomware that uses ChaCha20 for file content and RSA to wrap the per-file ChaCha20 key, applying intermittent/partial encryption with multi-threading and double extortion across Windows, ESXi, and NAS targets. It deletes volume shadow copies, terminates backup and security services, and appends a configurable extension (.endpoint or .Midnight). The ransom note contact infrastructure is associated by ASEC with North Korea-linked threat actors active since 2024; implementation errors in RSA key handling and padding have allowed researchers to build a free decryptor.
How EndPoint (Midnight) Ransomware works
EndPoint (Midnight) is a ransomware family built on the leaked Babuk source code. Babuk first appeared in early 2021 as a ransomware-as-a-service operation; after its operators shut down in mid-2021 and leaked the full source code, multiple derivatives emerged including ESXiArgs, Rorschach, and Midnight/EndPoint. Gen Digital (Avast/Norton) researchers first publicly detailed Midnight on 2025-10-27, and AhnLab Security Emergency Response Center (ASEC) published its EndPoint variant analysis on 2026-05-21, attributing the ransom-note contact infrastructure to North Korea-linked threat actors active since 2024.
Encryption architecture: EndPoint uses ChaCha20 as the symmetric file-content cipher and protects the per-file ChaCha20 session key with an RSA public key. The RSA-encrypted session key together with its SHA-256 hash is appended to the footer of each encrypted file. To control processing speed and maximize throughput against large data stores, the malware uses partial/intermittent encryption — encrypting only a portion of each file rather than the whole — combined with multi-threaded execution. Earlier variants prioritized database and backup file types (.mdf, .ndf, .bak, .dbf, .sql, .rman); newer samples encrypt nearly all file types except executables and self-artifacts (.exe, .dll, .msi, .endpoint).
Cryptographic flaw: although EndPoint inherits Babuk's core structure and execution flow, its cryptographic layer was significantly reworked. Implementation errors in RSA key handling and data padding inadvertently weakened the scheme, allowing Gen analysts to reconstruct a working decryptor that bypasses the attacker's private key entirely. Free decryptors for 32-bit and 64-bit Windows have been released, enabling file recovery without ransom payment under certain conditions.
Impact behavior: on execution the malware enforces single-instance operation via the mutex 'Mutexisfunnylocal' (also reported as 'Mutexisfunnylocam'), deletes volume shadow copies with 'vssadmin.exe delete shadows /all /quiet' to inhibit recovery, and terminates VSS, SQL, Veeam, Sophos, Acronis and other backup/security services to unlock files and disable defenses. It avoids encrypting system-critical paths (Windows, Program Files, AppData) and files (bootmgr, ntuser.dat). A ransom note titled 'How To Restore Your Files.txt' is dropped in every affected directory, and an optional debug log ('debug.endpoint' or 'Report.Midnight') may be written to the executable directory. Operators run a double-extortion model that combines on-host encryption with the threat of leaking exfiltrated data, and provide victim contact via email, uTox ID, and Session messenger.
Command-line operation: the binary supports '-paths=' / '--paths=' to target specific directories, '/n' to enable network-volume/share encryption, and '/e' controlling the extension-append behavior on encrypted file content.
MITRE ATT&CK techniques used in TL-2026-0742
Discovery
T1057 Process Discovery; T1083 File and Directory Discovery; T1135 Network Share Discovery
Execution
T1059 Command and Scripting Interpreter; T1106 Native API
Defense Evasion
Lateral Movement
stealth
Impact
T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
T1587 Develop Capabilities; T1588 Obtain Capabilities
defense-impairment
Affected products and versions in EndPoint (Midnight) Ransomware
- Microsoft — Windows
Vulnerable versions: Windows (32-bit and 64-bit endpoints/servers) - VMware — ESXi
Vulnerable versions: ESXi hypervisor hosts - NAS vendors (generic) — Network Attached Storage
Vulnerable versions: Network-attached storage appliances and shares
Remediation for EndPoint (Midnight) Ransomware
Patches
- Apply current patches and disable unnecessary management interfaces on VMware ESXi hosts and NAS appliances
Immediate actions
- Isolate affected Windows, ESXi, and NAS hosts from the network to halt lateral encryption (/n network-volume mode)
- Block the ransom-note contact email schipkealfred@gmail.com at the mail gateway and hunt for it in mailboxes
- Hunt for the mutex 'Mutexisfunnylocal'/'Mutexisfunnylocam', files with the .endpoint/.Midnight extension, and 'How To Restore Your Files.txt' ransom notes
- Preserve encrypted samples and footers — a free decryptor exists due to the RSA implementation flaw; do not pay ransom
Workarounds
- Use the Gen/Avast/Norton free Midnight decryptor (32-bit and 64-bit Windows) to recover files where the flaw applies
- Enable shadow-copy tamper protection and protected/credential-guarded backup service accounts
Longer-term hardening
- Deploy EDR with behavioral detection for mass file modification and service-termination patterns
- Maintain offline, immutable, and tested backups segmented from production credentials
- Restrict and monitor vssadmin / shadow-copy deletion via tamper protection
- Enforce network segmentation between Windows, ESXi management, and NAS storage planes
Weaknesses (CWE) in EndPoint (Midnight) Ransomware
CWE-326, CWE-327, CWE-1240
Timeline of EndPoint (Midnight) Ransomware
- Babuk ransomware-as-a-service first appeared in early 2021, establishing the framework later inherited by Midnight/EndPoint.
- Babuk operators shut down and leaked the full source code (including the ESXi/Linux encryptor) in mid-2021, spawning a wave of derivatives that reuse its framework.
- ESXiArgs, a Babuk-derived ESXi encryptor, was used in a mass campaign against unpatched VMware ESXi hosts, demonstrating the leaked framework's reach into hypervisor targets later shared by EndPoint.
- Rorschach (BabLock), another Babuk-lineage family, was documented using partial/intermittent encryption — the same throughput technique EndPoint inherits.
- ASEC associates the ransom-note contact infrastructure with North Korea-linked threat actors active since 2024.
- Gen released free 32-bit and 64-bit Windows decryptors after identifying RSA key-handling and padding flaws that bypass the attacker's private key.
- Gen Digital (Avast/Norton) researchers publicly detailed Midnight ransomware and its Babuk lineage.
- Multiple outlets (securityonline, gbhackers, cybersecuritynews, SC Media, HackRead) reported the decryptor and cryptographic flaw.
- ASEC published analysis of the EndPoint variant, documenting .endpoint extension, intermittent encryption, service termination, and IOCs.
Sources cited for EndPoint (Midnight) Ransomware
- EndPoint (Midnight) Ransomware analysis
- Decrypted: Midnight Ransomware
- Midnight Ransomware Decryption Flaw: Babuk Successor's RSA Implementation Mistake Allows Free File Recovery
- Critical Bug in Midnight Ransomware Tool Unlocks File Recovery
- Midnight Ransomware Decrypter Flaws Opens the Door to File Recovery
- Novel Midnight ransomware decrypted
- Norton Crack Midnight Ransomware, Release Free Decryptor
Threats related to EndPoint (Midnight) Ransomware
- EndPoint (formerly Midnight) Babuk-Derived Ransomware — Windows/ESXi/NAS Double Extortion with ChaCha20+RSA Encryption and North Korea-Linked Ransom-Note Lineage (CVE-less, ASEC)
- Payload Ransomware Targeting Windows and VMware ESXi with Babuk-Derived Curve25519/ChaCha20 Encryption
- Spirals Ransomware: Rust-Based Double-Extortion Family Breaches South Asian IT Services Firm via IIS Web Shell in Under 24 Hours
Detection coverage for TL-2026-0742
As of 2026-06-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0742 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.