HYFLOCK Ransomware-as-a-Service: Partial (First 4KB) Encryption of Larger Files

Key facts for HYFLOCK RaaS partial encryption

Detection coverage for HYFLOCK RaaS partial encryption

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5367 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: HYFLOCK Inhibit System Recovery: Shadow Copy and Backup Deletion

Detects vssadmin, wmic, wbadmin, bcdedit and PowerShell commands that destroy shadow copies, backup catalogs or boot recovery. HYFLOCK attempts to disrupt recovery during execution; a ProgramData parent process raises confidence.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1490, T1047, T1059.001
• Data sources: sysmon
• Severity: critical
• Confidence: high

Splunk SPL

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
```HYFLOCK TL-2026-5367 recovery disruption: shadow copy, backup catalog and boot recovery tampering```
| eval cl=lower(CommandLine), img=lower(Image)
| where (match(img, "vssadmin[.]exe$") AND match(cl, "delete +shadows")) OR (match(img, "wmic[.]exe$") AND match(cl, "shadowcopy +delete")) OR (match(img, "wbadmin[.]exe$") AND match(cl, "delete +(catalog|systemstatebackup|backup)")) OR (match(img, "bcdedit[.]exe$") AND match(cl, "recoveryenabled +no|bootstatuspolicy +ignoreallfailures")) OR (match(img, "(powershell|pwsh)[.]exe$") AND match(cl, "win32_shadowcopy") AND match(cl, "delete|remove-ciminstance|remove-wmiobject"))
| eval parent_in_programdata=if(match(lower(coalesce(ParentImage, "")), "programdata.[^ ]+"), "yes", "no")
| stats min(_time) as first_seen max(_time) as last_seen count as commands values(CommandLine) as command_lines values(ParentImage) as parent_images values(parent_in_programdata) as parent_in_programdata by host, User
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ 'vssadmin.exe' and ProcessCommandLine has_all ('delete', 'shadows'))
    or (FileName =~ 'wmic.exe' and ProcessCommandLine has_all ('shadowcopy', 'delete'))
    or (FileName =~ 'wbadmin.exe' and ProcessCommandLine has 'delete' and ProcessCommandLine has_any ('catalog', 'systemstatebackup', 'backup'))
    or (FileName =~ 'bcdedit.exe' and ProcessCommandLine matches regex @'(?i)recoveryenabled +no|bootstatuspolicy +ignoreallfailures')
    or (FileName in~ ('powershell.exe', 'pwsh.exe') and ProcessCommandLine has 'Win32_ShadowCopy' and ProcessCommandLine has_any ('Delete', 'Remove-CimInstance', 'Remove-WmiObject'))
| extend ParentInProgramData = InitiatingProcessFolderPath matches regex @'(?i)^[a-z]:.programdata.'
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessFolderPath, ParentInProgramData
| order by Timestamp desc

Sigma

title: HYFLOCK Recovery Inhibition via Shadow Copy and Boot Recovery Tampering
id: c5e82b17-94d0-4a3f-8b61-0d7f3e9a2c45
status: experimental
description: Detects shadow copy deletion, backup catalog deletion and boot recovery disabling, the recovery disruption behaviour HYFLOCK performs in controlled execution.
references:
    - https://cybersecuritynews.com/hyflock-ransomware/
    - https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/hyflock
    - https://intel.threadlinqs.com
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
    - attack.impact
    - attack.t1490
    - attack.execution
    - attack.t1047
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_ps_delete:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains|all:
            - 'Win32_ShadowCopy'
            - 'Delete'
    selection_ps_remove:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains|all:
            - 'Win32_ShadowCopy'
            - 'Remove-'
    selection_vss:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'shadows'
    selection_wmic:
        Image|endswith: '\wmic.exe'
        CommandLine|contains|all:
            - 'shadowcopy'
            - 'delete'
    selection_wbadmin_catalog:
        Image|endswith: '\wbadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'catalog'
    selection_wbadmin_state:
        Image|endswith: '\wbadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'systemstatebackup'
    selection_bcdedit:
        Image|endswith: '\bcdedit.exe'
        CommandLine|contains:
            - 'recoveryenabled no'
            - 'ignoreallfailures'
    condition: 1 of selection_*
falsepositives:
    - Backup software or administrators legitimately pruning shadow copies
    - Disk cleanup and imaging tooling
level: high

Known false positives:

• Backup administrators pruning shadow copies or backup catalogs
• Imaging or provisioning tools that disable recovery during deployment

Tuning notes: Suppress known backup-management hosts and service accounts. Treat parent_in_programdata=yes as an escalation signal. Sysmon EventCode 1 must capture full command lines.

• 🔒 HYFLOCK Ransom Note and [indicator] Artifact Creation · unlock with TL Creds
• 🔒 HYFLOCK Mass File Rename to [indicator]_ Extension · unlock with TL Creds
• 🔒 HYFLOCK Network Share Processing: SMB Fan-out from ProgramData Binary · unlock with TL Creds
• 🔒 HYFLOCK [indicator] Masquerading as Edge Updater in ProgramData · unlock with TL Creds
• 🔒 HYFLOCK Remote Encryption Activity Against Network Shares · unlock with TL Creds
• 🔒 HYFLOCK Extortion Channel: qTox, Tor Client or Leak-Site Onion Lookup · unlock with TL Creds
• 🔒 HYFLOCK Ransomware Staging Artifacts in ProgramData EdgeUpdate Folder (TL-2026-5367) · unlock with TL Creds
• 🔒 HYFLOCK Scheduled Task Persistence Launching [indicator] from ProgramData · unlock with TL Creds

Indicators of compromise for HYFLOCK RaaS partial encryption

As of 2026-11-06, Threadlinqs Intelligence tracks 14 indicators of compromise for TL-2026-5367.

Sample indicators (2 of 14)

• Domain: yhgphvfgaecacgtlbn67u7yfhafe6evnj4gs4s2oyb3hzjnlhq45azqd[.]onion
• File hash: 80c474154b1df816cf513ae978936875b6dd77f47ef6bce78dda83ab1b89525b

Defanged, TLP:CLEAR. Full set of 14 indicators: unlock with TL Creds.

How HYFLOCK RaaS partial encryption works

Its leak site listed eight unverified victim claims as of October 13, 2026.

HYFLOCK is a Windows ransomware family operated as a Ransomware-as-a-Service (RaaS). A forum user 'hyflock123' reportedly posted an affiliate recruitment notice on the 'Duty-Free' forum on May 14, 2026, offering a 90% revenue share and claiming prior LockBit and Qilin experience; a secondary report states an 'official partnership' with BreachForums followed. WatchGuard's ransomware tracker lists the alias 'Nishi' and a claimed Babuk-variant lineage, and cites a first-seen date of February 2026, which differs from the March 2026 promotion date in the source article. These lineage and affiliation claims come from secondary or attacker-controlled material and are low confidence.

Per the Check Point Exposure Management analysis summarized by Cyber Security News (2026-11-05), the family went through four generations: an initial Windows core written in Rust (April 2026); a separate loader carrying the payload, configuration and key material (July 2026); a Go carrier build (early October 2026); and a return to a standalone Rust executable on October 17, 2026. The October 17 build uses AES counter-mode processing with 16-byte symmetric keys, with RSA-protected recovery material. For larger files it encrypts only the first 4,096 bytes, leaving the rest of the file body readable. Each encrypted file keeps its original-length body plus a 556-byte trailer holding metadata and the wrapped key; the marker HFLKEY01 identifies a validly encrypted file. Files are renamed with the extension .locked_<identifier>. The sample uses a staged copy at ProgramData\EdgeUpdate_<suffix>\eu.exe, which imitates a browser-updater location, with settings in eu.cfg and a protected key backup in system_config.dat. A .hyflock_claim artifact is used in share-coordination handling.

In controlled execution the sample registered a scheduled task, processed network-share resources and attempted to disrupt recovery. In the same testing it produced 500 successful ransomware-extension renames, but only 17 collected files were independently validated as encrypted. This is a reminder that renamed files are not necessarily fully encrypted, and that partial-encryption victims may be able to recover file content. Earlier-generation samples described by consumer-security sites append .locked, drop an HTML note named 'How to Restore My Files.html', demand contact within 48 hours via qTox/Tor, and claim HC-128 in the note, which contradicts the AES-128-CTR plus RSA-4096 stated in recruitment material; neither claim has been independently audited. No public decryptor was reported as of July 16, 2026.

The leak site (Tor) listed eight victim claims between September 9 and October 13, 2026. These are unverified. The source article describes them as spanning manufacturing, business services, government, retail and telecommunications, while WatchGuard's tracker categorizes them differently (accounting, engineering, chemical, food and beverage, telecommunications, government, healthcare) across Malaysia, Brazil, Saudi Arabia, India, Bangladesh, Ecuador and Türkiye. No CVEs are associated with the sources reviewed, and initial access is not established; one secondary report suggests affiliates favor network-edge exploitation and access brokers, and consumer-security sites list generic phishing and trojan delivery, so treat initial access as unconfirmed. This record rests on a single primary technical source (not directly retrieved; the original Check Point report could not be located) and has not been cross-verified.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027.009 Embedded Payloads; T1036.005 Match Legitimate Resource Name or Location

Persistence

T1053.005 Scheduled Task

Discovery

T1135 Network Share Discovery

Impact

T1490 Inhibit System Recovery; T1657 Financial Theft

Remediation for HYFLOCK RaaS partial encryption

Immediate actions

• Hunt for ProgramData\EdgeUpdate_* directories containing eu.exe, eu.cfg or system_config.dat
• Search file shares for .locked_* extensions, .hyflock_claim artifacts and files ending with the HFLKEY01 trailer marker
• Review newly registered scheduled tasks that launch binaries from ProgramData
• Isolate affected hosts and preserve disk images; partially encrypted files may be partly recoverable

Workarounds

• Block execution from ProgramData subdirectories via application control
• Enforce MFA on all remote access pathways

Longer-term hardening

• Maintain offline, immutable backups and test restores
• Restrict write access to network shares and monitor mass-rename activity
• Alert on attempts to delete shadow copies or disable recovery features
• Deploy EDR with behavioral ransomware detection

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: Windows endpoints and servers (64-bit samples reported)

Timeline of HYFLOCK RaaS partial encryption

• 2026-04-01 April 2026 (day not stated): first tracked generation, an initial Windows core written in Rust.
• 2026-05-14 User 'locked-ioc-8' reportedly posts a RaaS affiliate recruitment notice on the 'Duty-Free' forum offering a 90% revenue share (secondary report; BreachForums partnership claimed shortly after).
• 2026-07-01 July 2026 (day not stated): a separate loader is added that carries the payload, configuration and key material.
• 2026-07-16 Consumer-security sites document a locked-ioc-11 sample (locked-ioc-10 extension, 'locked-ioc-4' note, 48-hour deadline); no public decryptor available.
• 2026-09-09 Earliest extortion date in WatchGuard's tracker for leak-site victim claims.
• 2026-10-13 Leak site lists eight unverified victim claims.
• 2026-10-17 Standalone Rust build encrypts only the first 4,096 bytes of larger files and appends a 556-byte locked-ioc-9 trailer; early October Go carrier build preceded it.
• 2026-11-05 Cyber Security News publishes the Check Point Exposure Management findings on the partial-encryption weakness.

Sources cited for HYFLOCK RaaS partial encryption

• HYFLOCK Ransomware (PCrisk removal guide) pcrisk.com · Research · 2026-07-16
• WatchGuard Ransomware Tracker: HYFLOCK watchguard.com · Research · 2026-10-13
• HYFLOCK Ransomware: .locked File Recovery and Removal (GridinSoft) blog.gridinsoft.com · Blog · 2026-07-16
• After Operation Cronos, new ransomware (Hyflock recruitment and BreachForums partnership) aishielddaily.blogspot.com · Blog · 2026-06-16
• HYFLOCK Ransomware Virus: How to Remove It and Recover .locked Files Safely (MalwareTips) malwaretips.com · Blog
• HYFLOCK Ransomware Encrypts Only First 4KB of Larger Files, Leaves Parts of Victims' Files Accessible cybersecuritynews.com · News · 2026-11-05
• dexpose.io HYFLOCK victim tracking dexpose.io · News

More in ransomware

• Vexy Ransomware claims ZipAI (Vietnam, Technology) - 15.73 GB exfiltrated
• Queens Public Library Ransomware Attack Disrupts Wi-Fi, On-Site Computers and Digital Services
• Higher Education Sector Under Ransomware and Extortion Pressure: Interlock (CCBC, Springfield Public Schools) and ShinyHunters (Instructure Canvas) with AI Data-Exposure Risk
• The State of Ransomware in Financial Services 2026 (Sophos survey)
• Nova (formerly RALord) Ransomware-as-a-Service Group