# EndPoint (Midnight) Ransomware — Babuk-derived double-extortion targeting Windows, ESXi, and NAS

> EndPoint, previously tracked as Midnight, is a Babuk-framework-derived ransomware that uses ChaCha20 for file content and RSA to wrap the per-file ChaCha20 key, applying intermittent/partial encryption with multi-threading and double extortion across Windows, ESXi, and NAS targets. It deletes volume shadow copies, terminates backup and security services, and appends a configurable extension (.endpoint or .Midnight). The ransom note contact infrastructure is associated by ASEC with North Korea-linked threat actors active since 2024; implementation errors in RSA key handling and padding have allowed researchers to build a free decryptor.

- **Published:** 2026-06-09T00:00:00Z
- **Last reviewed:** 2026-06-09T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0742
- **ID:** TL-2026-0742
- **Severity:** CRITICAL
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

EndPoint (Midnight) is a ransomware family built on the leaked Babuk source code. Babuk first appeared in early 2021 as a ransomware-as-a-service operation; after its operators shut down in mid-2021 and leaked the full source code, multiple derivatives emerged including ESXiArgs, Rorschach, and Midnight/EndPoint. Gen Digital (Avast/Norton) researchers first publicly detailed Midnight on 2025-10-27, and AhnLab Security Emergency Response Center (ASEC) published its EndPoint variant analysis on 2026-05-21, attributing the ransom-note contact infrastructure to North Korea-linked threat actors active since 2024.

Encryption architecture: EndPoint uses ChaCha20 as the symmetric file-content cipher and protects the per-file ChaCha20 session key with an RSA public key. The RSA-encrypted session key together with its SHA-256 hash is appended to the footer of each encrypted file. To control processing speed and maximize throughput against large data stores, the malware uses partial/intermittent encryption — encrypting only a portion of each file rather than the whole — combined with multi-threaded execution. Earlier variants prioritized database and backup file types (.mdf, .ndf, .bak, .dbf, .sql, .rman); newer samples encrypt nearly all file types except executables and self-artifacts (.exe, .dll, .msi, .endpoint).

Cryptographic flaw: although EndPoint inherits Babuk's core structure and execution flow, its cryptographic layer was significantly reworked. Implementation errors in RSA key handling and data padding inadvertently weakened the scheme, allowing Gen analysts to reconstruct a working decryptor that bypasses the attacker's private key entirely. Free decryptors for 32-bit and 64-bit Windows have been released, enabling file recovery without ransom payment under certain conditions.

Impact behavior: on execution the malware enforces single-instance operation via the mutex 'Mutexisfunnylocal' (also reported as 'Mutexisfunnylocam'), deletes volume shadow copies with 'vssadmin.exe delete shadows /all /quiet' to inhibit recovery, and terminates VSS, SQL, Veeam, Sophos, Acronis and other backup/security services to unlock files and disable defenses. It avoids encrypting system-critical paths (Windows, Program Files, AppData) and files (bootmgr, ntuser.dat). A ransom note titled 'How To Restore Your Files.txt' is dropped in every affected directory, and an optional debug log ('debug.endpoint' or 'Report.Midnight') may be written to the executable directory. Operators run a double-extortion model that combines on-host encryption with the threat of leaking exfiltrated data, and provide victim contact via email, uTox ID, and Session messenger.

Command-line operation: the binary supports '-paths=' / '--paths=' to target specific directories, '/n' to enable network-volume/share encryption, and '/e' controlling the extension-append behavior on encrypted file content.

## MITRE ATT&CK

- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1480 Execution Guardrails
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1083 File and Directory Discovery
- T1135 Network Share Discovery
- T1057 Process Discovery
- T1080 Taint Shared Content
- T1567 Exfiltration Over Web Service
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop

## Sources

- [EndPoint (Midnight) Ransomware analysis](https://asec.ahnlab.com/en/93932/)
- [Decrypted: Midnight Ransomware](https://www.gendigital.com/blog/insights/research/midnight-ransomware)
- [Midnight Ransomware Decryption Flaw: Babuk Successor's RSA Implementation Mistake Allows Free File Recovery](https://securityonline.info/midnight-ransomware-decryption-flaw-babuk-successors-rsa-implementation-mistake-allows-free-file-recovery/)
- [Critical Bug in Midnight Ransomware Tool Unlocks File Recovery](https://gbhackers.com/midnight-ransomware/)
- [Midnight Ransomware Decrypter Flaws Opens the Door to File Recovery](https://cybersecuritynews.com/midnight-ransomware-decrypter-flaws/)
- [Novel Midnight ransomware decrypted](https://www.scworld.com/brief/novel-midnight-ransomware-decrypted)
- [Norton Crack Midnight Ransomware, Release Free Decryptor](https://hackread.com/norton-midnight-ransomware-free-decryptor/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0742