Threat video1:00
HYFLOCK RaaS 4KB Partial Encryption: Detection & IOCs
HYFLOCK encrypts only the first 4,096 bytes of larger files, leaving the remainder accessible: 9 detection rules, 14 IOCs and a free Splunk SPL rule.
Read the full threat intel for HYFLOCK RaaS 4KB Partial Encryption: Detection & IOCs →
Chapters
- 0:00The hookOnly 4,096 bytes actually encrypted.
- 0:04The storyHYFLOCK emerged in four builds.
- 0:10Attack pathReportedly a staged copy accessed network shares.
- 0:22AttributionNo threat actor is attributed.
- 0:26Indicators of compromise11 indicators to hunt: 1 domain, 1 SHA-256 hash and 1 hash, and more.
- 0:34MITRE ATT&CK techniques6 ATT&CK techniques, from persistence to impact.
- 0:38Remediation4 steps now: Hunt for ProgramData\EdgeUpdate_* directories containing eu.exe, eu.cfg or system_config.dat.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Only 4,096 bytes actually encrypted.
0:05HYFLOCK emerged in four builds.
0:07Partial encryption.
0:10Reportedly a staged copy accessed network shares.
0:14Partial encryption leaves files readable.
0:16Data may still be recoverable.
0:22No threat actor is attributed. Confidence: low.
0:2611 indicators to hunt: 1 domain, 1 SHA-256 hash and 1 hash, and more.
0:346 ATT&CK techniques, from persistence to impact.
0:394 steps now: Hunt for ProgramData\EdgeUpdate_* directories containing eu.exe, eu.cfg or system_config.dat.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.