# Rook Ransomware (.Rook) - Babuk-derived ransomware with AES-128/RSA-2048 encryption linked to BRONZE STARLIGHT

> Rook is a Windows ransomware family built on the leaked Babuk source code. It reuses Babuk's service/process kill and shadow-copy deletion routines, reimplements Babuk v3 multithreading, and encrypts files with AES-128 ECB plus RSA-2048 (Mbed TLS), appending .Rook and dropping HowToRestoreYourFiles.txt. Secureworks lists Rook among the post-intrusion ransomware families used by the China-linked BRONZE STARLIGHT cluster.

- **Published:** 2026-11-05T01:30:16Z
- **Last reviewed:** 2026-11-05T01:30:16Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5285
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5285.png
- **ID:** TL-2026-5285
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Cinnamon Tempest (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 17 (3 shown free below)

## Description

Rook was first seen in the wild at the end of November 2021, with a first reported victim being a Kazakh financial institution (2021-11-30) from which more than 1,000 GB (1,123 GB per SentinelOne) was reportedly stolen. Earlier variants used the .tower extension; the family later settled on .Rook. Delivery is reported (FortiGuard, SentinelOne) as Cobalt Strike hands-on deployment, phishing email, or untrustworthy torrent downloads. Operators run a Tor leak/victim portal and communicate via onionmail email addresses; the ransom note threatens to destroy private keys if security vendors or law enforcement become involved.

Technical behavior (Chuong Dong reverse-engineering report): on launch the sample initializes Mbed TLS CTR_DRBG, parses an embedded threat-actor RSA-2048 public key, and queries HKCU\Software for RookPublicKey / RookPrivateKey; if absent it generates a victim RSA key pair, encrypts the victim private key with the actor's public key and stores both in the registry. It then hides its own executable by moving it into an alternate data stream (:ask) via SetFileInformationByHandle and marking the file for deletion on handle close, leaving the primary stream empty. Optional command-line arguments are -debug <logfile>, -shares <list> and -paths <list>.

Before encryption it opens the Service Control Manager, enumerates dependent services and issues stop controls (30-second cap) against 24-25 backup/database/AV services, terminates 31 named processes (database engines, Office, mail clients, browsers) through ToolHelp32 and TerminateProcess, and deletes volume shadow copies with 'vssadmin.exe delete shadows /all /quiet' after disabling WOW64 file-system redirection. These routines are 'copied and pasted' from Babuk. Multithreading is a reimplementation and upgrade of Babuk v3: file-encryption threads equal 2x processor count and directory-enumeration threads use semaphores BEGIN_ACCESS_DIR_SEMAPHORE / END_ACCESS_DIR_SEMAPHORE so encryption proceeds while directories are still being walked.

Resources are traversed via WNetOpenEnumW/WNetEnumResourceW, GetLogicalDrives (skipping CD-ROMs, mounting unmounted volumes with SetVolumeMountPointW) and NetShareEnum (skipping IPC$, optionally targeting ADMIN$). Folders such as Windows, Program Files, AppData, ProgramData, Tor Browser and Mozilla, and files such as ntuser.dat, boot.ini and thumbs.db, are excluded, as are .exe, .dll and .Rook files. A HowToRestoreYourFiles.txt note is written in each directory. Each file is renamed with .Rook, then encrypted with a random 16-byte AES-128 key in ECB mode (whole file if <= 0x80000 bytes, otherwise up to three 0x80000-byte chunks at the start). A footer holds the file size, chunk count, the AES key encrypted with the victim public key (256 bytes) and the victim private key encrypted with the actor public key (2,304 bytes). Locked files trigger a Windows Restart Manager session (RmStartSession/RmRegisterResources/RmGetList) and the holding processes (other than Explorer and critical processes) are terminated before retrying. FortiGuard observed UPX and VMProtect packing; no persistence mechanism is documented and the sample self-deletes.

Attribution: Secureworks (June 2022) reports that BRONZE STARLIGHT (also DEV-0401, Cinnamon Tempest, Emperor Dragonfly, SLIME34), active since mid-2021, deploys post-intrusion ransomware including LockFile, AtomSilo, Rook, Night Sky and Pandora (Rook, Night Sky and Pandora being Babuk derivatives) and uses Cobalt Strike and WMI for lateral movement; Secureworks assesses the ransomware may serve as cover for espionage/IP theft. FortiGuard and SentinelOne's reporting on Rook itself named no specific actor. Severity and status are analyst-assigned; the primary source is dated 2022-01-06 and does not state current activity. No CVE, CVSS, domains or IPs are stated in the sources, so no BeaconBeagle lookups were applicable.

## MITRE ATT&CK

- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1047 Windows Management Instrumentation
- T1564.004 NTFS File Attributes
- T1070.004 File Deletion
- T1027.002 Software Packing
- T1112 Modify Registry
- T1685 Disable or Modify Tools
- T1057 Process Discovery
- T1007 System Service Discovery
- T1082 System Information Discovery
- T1135 Network Share Discovery
- T1012 Query Registry
- T1490 Inhibit System Recovery
- T1489 Service Stop

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Rook Ransomware Ransom Note and .Rook/.tower Encrypted File Creation (T1486, T1083, T1135)** (`TL-2026-5285-SPL-001`)

Detects Rook ransomware (Babuk-derived, TL-2026-5285) dropping HowToRestoreYourFiles.txt in traversed directories and renaming encrypted files to .Rook (early variants .tower). Aggregates by host and writing process so a single process producing multiple notes/encrypted files, or both artefact kinds, alerts. Because Rook walks local drives and network shares (WNetEnumResource, NetShareEnum) and writes a note per directory, a high unique-file or multi-folder count also evidences file/directory and share discovery. Behaviour-first: fires on the encryption stage regardless of hash or packer (UPX/VMProtect).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1486, T1083, T1135
- **Data sources:** sysmon:EventCode=11 (index=sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational), DeviceFileEvents, windows file_event
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 earliest=-24h (TargetFilename="*HowToRestoreYourFiles.txt" OR TargetFilename="*.Rook" OR TargetFilename="*.tower")
| eval fn=lower(TargetFilename)
| eval ioc=case(like(fn,"%howtorestoreyourfiles.txt"),"ransom_note", like(fn,"%.rook"),"rook_ext", like(fn,"%.tower"),"tower_ext")
| stats count AS events dc(TargetFilename) AS unique_files dc(ioc) AS ioc_kinds values(ioc) AS ioc_seen earliest(_time) AS first_seen latest(_time) AS last_seen BY host, Image, User
| where events>=5 OR ioc_kinds>=2
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table host Image User events unique_files ioc_seen first_seen last_seen
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileRenamed")
| where FileName =~ "HowToRestoreYourFiles.txt" or FileName endswith ".Rook" or FileName endswith ".tower"
| extend IocKind = case(FileName =~ "HowToRestoreYourFiles.txt", "ransom_note", FileName endswith ".Rook", "rook_ext", "tower_ext")
| summarize Events = count(), UniqueFolders = dcount(FolderPath), IocKinds = dcount(IocKind), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, InitiatingProcessSHA256
| where Events >= 5 or IocKinds >= 2
| project DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, InitiatingProcessSHA256, Events, UniqueFolders, IocKinds, FirstSeen, LastSeen
```

### Sigma

```yaml
title: Rook Ransomware Ransom Note or Encrypted File Extension Created
id: 5a1f0c3e-7b42-4d19-8e6a-3c9d1b2f4a01
status: experimental
description: Detects creation of HowToRestoreYourFiles.txt ransom notes or files with the .Rook / .tower extension used by Rook ransomware (Babuk-derived).
references:
  - https://www.sentinelone.com/labs/new-rook-ransomware-feeds-off-the-code-of-babuk/
  - https://www.chuongdong.com/reverse%20engineering/2022/01/06/RookRansomware/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/05
tags:
  - attack.impact
  - attack.t1486
  - attack.discovery
  - attack.t1083
  - attack.t1135
logsource:
  category: file_event
  product: windows
detection:
  selection_note:
    TargetFilename|endswith: '\HowToRestoreYourFiles.txt'
  selection_ext:
    TargetFilename|endswith:
      - '.Rook'
      - '.tower'
  condition: 1 of selection_*
falsepositives:
  - Security researchers or sandbox hosts detonating Rook samples
  - Backup or restore jobs that legitimately create files ending in .tower
level: high
```

**Known false positives:**

- Malware analysis sandboxes or detonation labs running Rook samples
- Unrelated software that legitimately uses a .tower file extension (single hit, no ransom note)

**Tuning notes:** Exclude known sandbox hosts via a host lookup. Lower the events>=5 threshold to 2 on file servers where high-volume encryption is the main risk. Pair with the vssadmin detection (TL-2026-5285-SPL-002) for higher-fidelity alerting.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Rook Ransomware Command-Line Switches (-shares / -paths / -debug) and Delivery Parent (T1566, T1059, T1204.002) (locked: unlock with TL Creds)
- Rook Mass Backup, Database and AV Service Stop (T1489, T1562.001, T1007) (locked: unlock with TL Creds)
- WMI Remote Process Creation and WmiPrvSE Child Shells Used for Lateral Movement (T1047, T1021.002, T1059.003) (locked: unlock with TL Creds)
- Rook Ransomware Self-Hiding in the [indicator] Alternate Data Stream (T1564.004, T1070.004, T1027.002) (locked: unlock with TL Creds)
- Rook Ransomware RookPublicKey / RookPrivateKey Registry Values (T1112, T1012, T1486) (locked: unlock with TL Creds)
- Connection to Community-Observed Cobalt Strike Infrastructure Related to Rook Campaign (T1071.001, T1105, T1573) (locked: unlock with TL Creds)
- Rook/Babuk Shadow Copy Deletion via vssadmin delete shadows /all /quiet (T1490, T1047, T1059.003) (locked: unlock with TL Creds)
- Cobalt Strike Default Named Pipes Preceding Rook Deployment (T1021.002, T1559, T1071.002) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 17)

Defanged, TLP:CLEAR.

- File hash: `c2d46d256b8f9490c9599eea11ecef19fde7d4fdd2dea93604cee3cea8e172ac`
- File hash: `6d87be9212a1a0e92e58e1ed94c589f9`
- File hash: `f87be226e26e873275bde549539f70210ffe5e3a129448ae807a319cbdcf7789`

Full set of 17 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Rook Ransomware (Chuong Dong)](https://www.chuongdong.com/reverse%20engineering/2022/01/06/RookRansomware/)
- [New Rook Ransomware Feeds Off the Code of Babuk (SentinelOne Labs)](https://www.sentinelone.com/labs/new-rook-ransomware-feeds-off-the-code-of-babuk/)
- [Meet Rook Ransomware (FortiGuard Threat Signal)](https://fortiguard.com/threat-signal-report/4359)
- [Шифровальщик Rook: наследник Babuk (Anti-Malware.ru)](https://www.anti-malware.ru/news/2021-12-27-114534/37859)
- [State-Backed Hackers Using Ransomware as a Decoy for Cyber Espionage Attacks (The Hacker News)](https://thehackernews.com/2022/06/state-backed-hackers-using-ransomware.html)
- [China-linked APT Bronze Starlight deploys ransomware as a smokescreen (Security Affairs)](https://securityaffairs.com/wordpress/132624/apt/bronze-starlight-deploy-ransomware.html)
- [Ransomware - Rook (WatchGuard Ransomware Tracker)](https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/rook)
- [Rook ransomware removal guide (PCrisk)](https://pcrisk.com/removal-guides/22425-rook-ransomware)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5285