Rook Ransomware (.Rook) - Babuk-derived ransomware with AES-128/RSA-2048 encryption linked to BRONZE STARLIGHT

Key facts for Rook ransomware family

Detection coverage for Rook ransomware family

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5285 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Rook Ransomware Ransom Note and .Rook/.tower Encrypted File Creation (T1486, T1083, T1135)

Detects Rook ransomware (Babuk-derived, TL-2026-5285) dropping HowToRestoreYourFiles.txt in traversed directories and renaming encrypted files to .Rook (early variants .tower). Aggregates by host and writing process so a single process producing multiple notes/encrypted files, or both artefact kinds, alerts. Because Rook walks local drives and network shares (WNetEnumResource, NetShareEnum) and writes a note per directory, a high unique-file or multi-folder count also evidences file/directory and share discovery. Behaviour-first: fires on the encryption stage regardless of hash or packer (UPX/VMProtect).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1486, T1083, T1135
• Data sources: sysmon:EventCode=11 (index=sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational), DeviceFileEvents, windows file_event
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 earliest=-24h (TargetFilename="*HowToRestoreYourFiles.txt" OR TargetFilename="*.Rook" OR TargetFilename="*.tower")
| eval fn=lower(TargetFilename)
| eval ioc=case(like(fn,"%howtorestoreyourfiles.txt"),"ransom_note", like(fn,"%.rook"),"rook_ext", like(fn,"%.tower"),"tower_ext")
| stats count AS events dc(TargetFilename) AS unique_files dc(ioc) AS ioc_kinds values(ioc) AS ioc_seen earliest(_time) AS first_seen latest(_time) AS last_seen BY host, Image, User
| where events>=5 OR ioc_kinds>=2
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table host Image User events unique_files ioc_seen first_seen last_seen

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileRenamed")
| where FileName =~ "HowToRestoreYourFiles.txt" or FileName endswith ".Rook" or FileName endswith ".tower"
| extend IocKind = case(FileName =~ "HowToRestoreYourFiles.txt", "ransom_note", FileName endswith ".Rook", "rook_ext", "tower_ext")
| summarize Events = count(), UniqueFolders = dcount(FolderPath), IocKinds = dcount(IocKind), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, InitiatingProcessSHA256
| where Events >= 5 or IocKinds >= 2
| project DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, InitiatingProcessSHA256, Events, UniqueFolders, IocKinds, FirstSeen, LastSeen

Sigma

title: Rook Ransomware Ransom Note or Encrypted File Extension Created
id: 5a1f0c3e-7b42-4d19-8e6a-3c9d1b2f4a01
status: experimental
description: Detects creation of HowToRestoreYourFiles.txt ransom notes or files with the .Rook / .tower extension used by Rook ransomware (Babuk-derived).
references:
  - https://www.sentinelone.com/labs/new-rook-ransomware-feeds-off-the-code-of-babuk/
  - https://www.chuongdong.com/reverse%20engineering/2022/01/06/RookRansomware/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
  - attack.impact
  - attack.t1486
  - attack.discovery
  - attack.t1083
  - attack.t1135
logsource:
  category: file_event
  product: windows
detection:
  selection_note:
    TargetFilename|endswith: '\HowToRestoreYourFiles.txt'
  selection_ext:
    TargetFilename|endswith:
      - '.Rook'
      - '.tower'
  condition: 1 of selection_*
falsepositives:
  - Security researchers or sandbox hosts detonating Rook samples
  - Backup or restore jobs that legitimately create files ending in .tower
level: high

Known false positives:

• Malware analysis sandboxes or detonation labs running Rook samples
• Unrelated software that legitimately uses a .tower file extension (single hit, no ransom note)

Tuning notes: Exclude known sandbox hosts via a host lookup. Lower the events>=5 threshold to 2 on file servers where high-volume encryption is the main risk. Pair with the vssadmin detection (TL-2026-5285-SPL-002) for higher-fidelity alerting.

• 🔒 Rook Ransomware Command-Line Switches (-shares / -paths / -debug) and Delivery Parent (T1566, T1059, T1204.002) · unlock with TL Creds
• 🔒 Rook Mass Backup, Database and AV Service Stop (T1489, T1562.001, T1007) · unlock with TL Creds
• 🔒 WMI Remote Process Creation and WmiPrvSE Child Shells Used for Lateral Movement (T1047, T1021.002, T1059.003) · unlock with TL Creds
• 🔒 Rook Ransomware Self-Hiding in the [indicator] Alternate Data Stream (T1564.004, T1070.004, T1027.002) · unlock with TL Creds
• 🔒 Rook Ransomware RookPublicKey / RookPrivateKey Registry Values (T1112, T1012, T1486) · unlock with TL Creds
• 🔒 Connection to Community-Observed Cobalt Strike Infrastructure Related to Rook Campaign (T1071.001, T1105, T1573) · unlock with TL Creds
• 🔒 Rook/Babuk Shadow Copy Deletion via vssadmin delete shadows /all /quiet (T1490, T1047, T1059.003) · unlock with TL Creds
• 🔒 Cobalt Strike Default Named Pipes Preceding Rook Deployment (T1021.002, T1559, T1071.002) · unlock with TL Creds

Indicators of compromise for Rook ransomware family

As of 2026-11-05, Threadlinqs Intelligence tracks 17 indicators of compromise for TL-2026-5285.

Sample indicators (3 of 17)

• File hash: c2d46d256b8f9490c9599eea11ecef19fde7d4fdd2dea93604cee3cea8e172ac
• File hash: 6d87be9212a1a0e92e58e1ed94c589f9
• File hash: f87be226e26e873275bde549539f70210ffe5e3a129448ae807a319cbdcf7789

Defanged, TLP:CLEAR. Full set of 17 indicators: unlock with TL Creds.

How Rook ransomware family works

Secureworks lists Rook among the post-intrusion ransomware families used by the China-linked BRONZE STARLIGHT cluster.

Rook was first seen in the wild at the end of November 2021, with a first reported victim being a Kazakh financial institution (2021-11-30) from which more than 1,000 GB (1,123 GB per SentinelOne) was reportedly stolen. Earlier variants used the .tower extension; the family later settled on .Rook. Delivery is reported (FortiGuard, SentinelOne) as Cobalt Strike hands-on deployment, phishing email, or untrustworthy torrent downloads. Operators run a Tor leak/victim portal and communicate via onionmail email addresses; the ransom note threatens to destroy private keys if security vendors or law enforcement become involved.

Technical behavior (Chuong Dong reverse-engineering report): on launch the sample initializes Mbed TLS CTR_DRBG, parses an embedded threat-actor RSA-2048 public key, and queries HKCU\Software for RookPublicKey / RookPrivateKey; if absent it generates a victim RSA key pair, encrypts the victim private key with the actor's public key and stores both in the registry. It then hides its own executable by moving it into an alternate data stream (:ask) via SetFileInformationByHandle and marking the file for deletion on handle close, leaving the primary stream empty. Optional command-line arguments are -debug <logfile>, -shares <list> and -paths <list>.

Before encryption it opens the Service Control Manager, enumerates dependent services and issues stop controls (30-second cap) against 24-25 backup/database/AV services, terminates 31 named processes (database engines, Office, mail clients, browsers) through ToolHelp32 and TerminateProcess, and deletes volume shadow copies with 'vssadmin.exe delete shadows /all /quiet' after disabling WOW64 file-system redirection. These routines are 'copied and pasted' from Babuk. Multithreading is a reimplementation and upgrade of Babuk v3: file-encryption threads equal 2x processor count and directory-enumeration threads use semaphores BEGIN_ACCESS_DIR_SEMAPHORE / END_ACCESS_DIR_SEMAPHORE so encryption proceeds while directories are still being walked.

Resources are traversed via WNetOpenEnumW/WNetEnumResourceW, GetLogicalDrives (skipping CD-ROMs, mounting unmounted volumes with SetVolumeMountPointW) and NetShareEnum (skipping IPC$, optionally targeting ADMIN$). Folders such as Windows, Program Files, AppData, ProgramData, Tor Browser and Mozilla, and files such as ntuser.dat, boot.ini and thumbs.db, are excluded, as are .exe, .dll and .Rook files. A HowToRestoreYourFiles.txt note is written in each directory. Each file is renamed with .Rook, then encrypted with a random 16-byte AES-128 key in ECB mode (whole file if <= 0x80000 bytes, otherwise up to three 0x80000-byte chunks at the start). A footer holds the file size, chunk count, the AES key encrypted with the victim public key (256 bytes) and the victim private key encrypted with the actor public key (2,304 bytes). Locked files trigger a Windows Restart Manager session (RmStartSession/RmRegisterResources/RmGetList) and the holding processes (other than Explorer and critical processes) are terminated before retrying. FortiGuard observed UPX and VMProtect packing; no persistence mechanism is documented and the sample self-deletes.

Attribution: Secureworks (June 2022) reports that BRONZE STARLIGHT (also DEV-0401, Cinnamon Tempest, Emperor Dragonfly, SLIME34), active since mid-2021, deploys post-intrusion ransomware including LockFile, AtomSilo, Rook, Night Sky and Pandora (Rook, Night Sky and Pandora being Babuk derivatives) and uses Cobalt Strike and WMI for lateral movement; Secureworks assesses the ransomware may serve as cover for espionage/IP theft. FortiGuard and SentinelOne's reporting on Rook itself named no specific actor. Severity and status are analyst-assigned; the primary source is dated 2022-01-06 and does not state current activity. No CVE, CVSS, domains or IPs are stated in the sources, so no BeaconBeagle lookups were applicable.

MITRE ATT&CK techniques by tactic:

Discovery

T1007 System Service Discovery; T1012 Query Registry; T1057 Process Discovery; T1082 System Information Discovery; T1135 Network Share Discovery

Defense Evasion

T1027.002 Software Packing; T1070.004 File Deletion; T1564.004 NTFS File Attributes

Execution

T1047 Windows Management Instrumentation; T1059 Command and Scripting Interpreter; T1106 Native API

defense-impairment

T1112 Modify Registry; T1685 Disable or Modify Tools

Impact

T1489 Service Stop; T1490 Inhibit System Recovery

Initial Access

T1566 Phishing

Remediation for Rook ransomware family

Immediate actions

• Hunt for HowToRestoreYourFiles.txt, *.Rook files and HKCU\Software\RookPublicKey / RookPrivateKey registry values
• Alert on 'vssadmin.exe delete shadows /all /quiet' and mass stop of backup/AV services (veeam, vss, GxVss, RTVscan, Acronis)
• Isolate hosts showing Cobalt Strike activity and block the sample hashes in EDR

Workarounds

• Block execution of unsigned binaries from user-writable paths
• Prevent downloads of software from untrusted torrent sources

Longer-term hardening

• Keep offline/immutable backups of file shares and databases
• Deploy EDR with behavioral ransomware detection, including alternate-data-stream self-relocation and Restart Manager abuse
• Restrict administrative shares (ADMIN$) and lateral movement paths such as WMI

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: Windows 32-bit and 64-bit (no specific version restriction stated)

Timeline of Rook ransomware family

• 2021-09-01 locked-ioc-15 ransomware source code leaks (September 2021, month-level date); locked-ioc-17 later reuses it.
• 2021-11-30 locked-ioc-17 first discovered in the wild at the end of November 2021 (FortiGuard); early variants used the .tower extension.
• 2021-11-30 First reported locked-ioc-17 victim: a Kazakh financial institution, with roughly 1,123 GB of data reportedly stolen (SentinelOne).
• 2021-12-27 FortiGuard Threat Signal and Anti-Malware.ru publish reports on the new locked-ioc-17 ransomware.
• 2022-01-06 Chuong Dong publishes a full reverse-engineering analysis documenting locked-ioc-15 code reuse, AES-128/RSA-2048 crypto, ADS self-hiding and registry key storage.
• 2022-06-23 Secureworks links locked-ioc-17, with LockFile, AtomSilo, Night Sky and Pandora, to China-linked locked-ioc-11, assessing the ransomware may mask espionage.

Sources cited for Rook ransomware family

• Rook Ransomware (Chuong Dong) chuongdong.com · Research · 2022-01-06
• New Rook Ransomware Feeds Off the Code of Babuk (SentinelOne Labs) SentinelOne · Vendor report
• Meet Rook Ransomware (FortiGuard Threat Signal) FortiGuard Labs · Vendor report · 2021-12-27
• Ransomware - Rook (WatchGuard Ransomware Tracker) watchguard.com · Research
• Rook ransomware removal guide (PCrisk) pcrisk.com · Blog
• Шифровальщик Rook: наследник Babuk (Anti-Malware.ru) anti-malware.ru · News · 2021-12-27
• State-Backed Hackers Using Ransomware as a Decoy for Cyber Espionage Attacks (The Hacker News) The Hacker News · News · 2022-06-23
• China-linked APT Bronze Starlight deploys ransomware as a smokescreen (Security Affairs) securityaffairs.com · News · 2022-06-23

More in ransomware

• Halcyon August 2026 Ransomware Report: 10 of Top 15 Families New vs. July; Manufacturing Top Target
• Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing
• BlackNevas and The Gentlemen Ransomware Cases Against ESXi and Proxmox Virtualization Environments
• HYFLOCK Ransomware-as-a-Service: Partial (First 4KB) Encryption of Larger Files
• Vexy Ransomware claims ZipAI (Vietnam, Technology) - 15.73 GB exfiltrated

Previous and next in ransomware

• LockBit 2.0 Ransomware (Bitwise Spider) - Technical Reverse Engineering Analysis Previous report
• DIAVOL Ransomware – Reverse Engineering Analysis (Wizard Spider-linked, .lock64) Next report