# HYFLOCK Ransomware-as-a-Service: Partial (First 4KB) Encryption of Larger Files

> HYFLOCK is a Windows Ransomware-as-a-Service operation promoted in underground channels in 2026, with four generations tracked from April through October 2026. The October 17 build encrypts only the first 4,096 bytes of larger files, leaving the remainder accessible, and appends a 556-byte trailer marked HFLKEY01. Its leak site listed eight unverified victim claims as of October 13, 2026.

- **Published:** 2026-11-06T03:23:55Z
- **Last reviewed:** 2026-11-06T03:23:55Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5367
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5367.png
- **ID:** TL-2026-5367
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 14 (2 shown free below)

## Description

HYFLOCK is a Windows ransomware family operated as a Ransomware-as-a-Service (RaaS). A forum user 'hyflock123' reportedly posted an affiliate recruitment notice on the 'Duty-Free' forum on May 14, 2026, offering a 90% revenue share and claiming prior LockBit and Qilin experience; a secondary report states an 'official partnership' with BreachForums followed. WatchGuard's ransomware tracker lists the alias 'Nishi' and a claimed Babuk-variant lineage, and cites a first-seen date of February 2026, which differs from the March 2026 promotion date in the source article. These lineage and affiliation claims come from secondary or attacker-controlled material and are low confidence.

Per the Check Point Exposure Management analysis summarized by Cyber Security News (2026-11-05), the family went through four generations: an initial Windows core written in Rust (April 2026); a separate loader carrying the payload, configuration and key material (July 2026); a Go carrier build (early October 2026); and a return to a standalone Rust executable on October 17, 2026. The October 17 build uses AES counter-mode processing with 16-byte symmetric keys, with RSA-protected recovery material. For larger files it encrypts only the first 4,096 bytes, leaving the rest of the file body readable. Each encrypted file keeps its original-length body plus a 556-byte trailer holding metadata and the wrapped key; the marker HFLKEY01 identifies a validly encrypted file. Files are renamed with the extension .locked_<identifier>. The sample uses a staged copy at ProgramData\EdgeUpdate_<suffix>\eu.exe, which imitates a browser-updater location, with settings in eu.cfg and a protected key backup in system_config.dat. A .hyflock_claim artifact is used in share-coordination handling.

In controlled execution the sample registered a scheduled task, processed network-share resources and attempted to disrupt recovery. In the same testing it produced 500 successful ransomware-extension renames, but only 17 collected files were independently validated as encrypted. This is a reminder that renamed files are not necessarily fully encrypted, and that partial-encryption victims may be able to recover file content. Earlier-generation samples described by consumer-security sites append .locked, drop an HTML note named 'How to Restore My Files.html', demand contact within 48 hours via qTox/Tor, and claim HC-128 in the note, which contradicts the AES-128-CTR plus RSA-4096 stated in recruitment material; neither claim has been independently audited. No public decryptor was reported as of July 16, 2026.

The leak site (Tor) listed eight victim claims between September 9 and October 13, 2026. These are unverified. The source article describes them as spanning manufacturing, business services, government, retail and telecommunications, while WatchGuard's tracker categorizes them differently (accounting, engineering, chemical, food and beverage, telecommunications, government, healthcare) across Malaysia, Brazil, Saudi Arabia, India, Bangladesh, Ecuador and Türkiye. No CVEs are associated with the sources reviewed, and initial access is not established; one secondary report suggests affiliates favor network-edge exploitation and access brokers, and consumer-security sites list generic phishing and trojan delivery, so treat initial access as unconfirmed. This record rests on a single primary technical source (not directly retrieved; the original Check Point report could not be located) and has not been cross-verified.

## MITRE ATT&CK

- T1490 Inhibit System Recovery
- T1657 Financial Theft
- T1053.005 Scheduled Task
- T1135 Network Share Discovery
- T1036.005 Match Legitimate Resource Name or Location
- T1027.009 Embedded Payloads

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**HYFLOCK Inhibit System Recovery: Shadow Copy and Backup Deletion** (`TL-2026-5367-SPL-003`)

Detects vssadmin, wmic, wbadmin, bcdedit and PowerShell commands that destroy shadow copies, backup catalogs or boot recovery. HYFLOCK attempts to disrupt recovery during execution; a ProgramData parent process raises confidence.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1490, T1047, T1059.001
- **Data sources:** sysmon
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

````spl
index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
```HYFLOCK TL-2026-5367 recovery disruption: shadow copy, backup catalog and boot recovery tampering```
| eval cl=lower(CommandLine), img=lower(Image)
| where (match(img, "vssadmin[.]exe$") AND match(cl, "delete +shadows")) OR (match(img, "wmic[.]exe$") AND match(cl, "shadowcopy +delete")) OR (match(img, "wbadmin[.]exe$") AND match(cl, "delete +(catalog|systemstatebackup|backup)")) OR (match(img, "bcdedit[.]exe$") AND match(cl, "recoveryenabled +no|bootstatuspolicy +ignoreallfailures")) OR (match(img, "(powershell|pwsh)[.]exe$") AND match(cl, "win32_shadowcopy") AND match(cl, "delete|remove-ciminstance|remove-wmiobject"))
| eval parent_in_programdata=if(match(lower(coalesce(ParentImage, "")), "programdata.[^ ]+"), "yes", "no")
| stats min(_time) as first_seen max(_time) as last_seen count as commands values(CommandLine) as command_lines values(ParentImage) as parent_images values(parent_in_programdata) as parent_in_programdata by host, User
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ 'vssadmin.exe' and ProcessCommandLine has_all ('delete', 'shadows'))
    or (FileName =~ 'wmic.exe' and ProcessCommandLine has_all ('shadowcopy', 'delete'))
    or (FileName =~ 'wbadmin.exe' and ProcessCommandLine has 'delete' and ProcessCommandLine has_any ('catalog', 'systemstatebackup', 'backup'))
    or (FileName =~ 'bcdedit.exe' and ProcessCommandLine matches regex @'(?i)recoveryenabled +no|bootstatuspolicy +ignoreallfailures')
    or (FileName in~ ('powershell.exe', 'pwsh.exe') and ProcessCommandLine has 'Win32_ShadowCopy' and ProcessCommandLine has_any ('Delete', 'Remove-CimInstance', 'Remove-WmiObject'))
| extend ParentInProgramData = InitiatingProcessFolderPath matches regex @'(?i)^[a-z]:.programdata.'
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessFolderPath, ParentInProgramData
| order by Timestamp desc
```

### Sigma

```yaml
title: HYFLOCK Recovery Inhibition via Shadow Copy and Boot Recovery Tampering
id: c5e82b17-94d0-4a3f-8b61-0d7f3e9a2c45
status: experimental
description: Detects shadow copy deletion, backup catalog deletion and boot recovery disabling, the recovery disruption behaviour HYFLOCK performs in controlled execution.
references:
    - https://cybersecuritynews.com/hyflock-ransomware/
    - https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/hyflock
    - https://intel.threadlinqs.com
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
    - attack.impact
    - attack.t1490
    - attack.execution
    - attack.t1047
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_ps_delete:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains|all:
            - 'Win32_ShadowCopy'
            - 'Delete'
    selection_ps_remove:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains|all:
            - 'Win32_ShadowCopy'
            - 'Remove-'
    selection_vss:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'shadows'
    selection_wmic:
        Image|endswith: '\wmic.exe'
        CommandLine|contains|all:
            - 'shadowcopy'
            - 'delete'
    selection_wbadmin_catalog:
        Image|endswith: '\wbadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'catalog'
    selection_wbadmin_state:
        Image|endswith: '\wbadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'systemstatebackup'
    selection_bcdedit:
        Image|endswith: '\bcdedit.exe'
        CommandLine|contains:
            - 'recoveryenabled no'
            - 'ignoreallfailures'
    condition: 1 of selection_*
falsepositives:
    - Backup software or administrators legitimately pruning shadow copies
    - Disk cleanup and imaging tooling
level: high

```

**Known false positives:**

- Backup administrators pruning shadow copies or backup catalogs
- Imaging or provisioning tools that disable recovery during deployment

**Tuning notes:** Suppress known backup-management hosts and service accounts. Treat parent_in_programdata=yes as an escalation signal. Sysmon EventCode 1 must capture full command lines.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- HYFLOCK Ransom Note and [indicator] Artifact Creation (locked: unlock with TL Creds)
- HYFLOCK Mass File Rename to [indicator]_ Extension (locked: unlock with TL Creds)
- HYFLOCK Network Share Processing: SMB Fan-out from ProgramData Binary (locked: unlock with TL Creds)
- HYFLOCK [indicator] Masquerading as Edge Updater in ProgramData (locked: unlock with TL Creds)
- HYFLOCK Remote Encryption Activity Against Network Shares (locked: unlock with TL Creds)
- HYFLOCK Extortion Channel: qTox, Tor Client or Leak-Site Onion Lookup (locked: unlock with TL Creds)
- HYFLOCK Ransomware Staging Artifacts in ProgramData EdgeUpdate Folder (TL-2026-5367) (locked: unlock with TL Creds)
- HYFLOCK Scheduled Task Persistence Launching [indicator] from ProgramData (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 14)

Defanged, TLP:CLEAR.

- Domain: `yhgphvfgaecacgtlbn67u7yfhafe6evnj4gs4s2oyb3hzjnlhq45azqd[.]onion`
- File hash: `80c474154b1df816cf513ae978936875b6dd77f47ef6bce78dda83ab1b89525b`

Full set of 14 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [HYFLOCK Ransomware Encrypts Only First 4KB of Larger Files, Leaves Parts of Victims' Files Accessible](https://cybersecuritynews.com/hyflock-ransomware/)
- [HYFLOCK Ransomware (PCrisk removal guide)](https://www.pcrisk.com/removal-guides/35596-hyflock-ransomware)
- [HYFLOCK Ransomware: .locked File Recovery and Removal (GridinSoft)](https://blog.gridinsoft.com/hyflock-ransomware/)
- [WatchGuard Ransomware Tracker: HYFLOCK](https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/hyflock)
- [After Operation Cronos, new ransomware (Hyflock recruitment and BreachForums partnership)](https://aishielddaily.blogspot.com/2026/06/after-operation-cronos-new-ransomware.html)
- [HYFLOCK Ransomware Virus: How to Remove It and Recover .locked Files Safely (MalwareTips)](https://malwaretips.com/blogs/hyflock-ransomware-virus-how-to-remove-it-and-recover-locked-files-safely/)
- [dexpose.io HYFLOCK victim tracking](https://www.dexpose.io/tag/hyflock/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5367