Check Point published an analysis of HYFLOCK on 4 November 2026 and summarized it in its 9 November threat intelligence report. The author is Uriel Sigal. The research traces four generations of the ransomware and reports encryption weaknesses in the October builds. Check Point says these allowed partial recovery of data from encrypted files without a key. The post is eleven days old, but we found no earlier coverage on this site. This article relies on that blog post; we did not open the full HYFLOCK report it points to for indicators.
Who is HYFLOCK
Check Point says HYFLOCK first appeared on underground forums in March 2026, advertising a ransomware-as-a-service (RaaS) platform. Recruitment posts promoted encryption performance, access procurement, technical help and shared negotiation tools for affiliates. By October the group had announced version 2.0 and was presenting itself as a more integrated organization.
Four builds, as reported
- April. A Windows ransomware core written in Rust, with file encryption, network targeting and attempts to interfere with security and recovery tools. Check Point says it could identify several capabilities only in the code, because runtime analysis was limited.
- July. A new launch method: a separate loader delivered the malware together with its configuration and key material. Check Point says the underlying Rust foundation was unchanged.
- An earlier October build (Check Point gives no date). A Go-based carrier that extracted and launched a revised payload, which tried to run in the background through a scheduled task.
- 17 October. A standalone Rust encryptor. It staged a copy of itself under a directory resembling a legitimate software update component and registered a scheduled task. It showed extensive file processing, encryption and network-share activity.
In controlled analysis of the 17 October build, Check Point observed 500 successful ransomware-extension renames and 17 validated encrypted files.
The encryption weaknesses
Check Point reports two flaws:
- Earlier October build: a processing defect could permanently discard portions of a file. Check Point says this could prevent full recovery even with the correct key.
- 17 October build: for larger files, only the first 4,096 bytes were encrypted, leaving the remainder accessible.
The post does not name the encryption algorithm or key scheme, so we do not describe them.
What was and was not recovered
Researchers recovered 73 CRC-valid internal components from seven encrypted Office files, including worksheet and shared-string data, without an encryption key. Check Point is explicit that recovery was partial. It did not restore complete files and did not develop a general decryption method for HYFLOCK. We found no evidence of a public HYFLOCK decryptor as of 15 November in the Check Point blog or its 9 November report.
In our judgement, this is a research finding and not a decryptor. Victims should not read it as a route to restoring files. Its practical value is limited to forensic and recovery specialists who may be able to extract data from affected files, and the flaws may not be present in every build an affiliate deploys.
Capabilities Check Point could not confirm
- Network deployment functionality exists in the malware, but successful domain-wide propagation was not observed, and Group Policy spreading was disabled in the recovered configuration.
- Reliable execution after remote desktop sessions end remains unverified.
- Use of vulnerable drivers to disable security tools remains unverified.
Victim claims (unverified)
Check Point says HYFLOCK published eight victim claims on its leak site on 13 October, in manufacturing, business services, government, retail and telecommunications. It describes these as unverified actor claims. We have not independently verified any of them and name no victims. Check Point says the investigation did not establish how the organizations were initially compromised or why they were targeted. Nothing in the post tells us how many claims reflect real intrusions.
What defenders can take from this
These points are our judgement, not Check Point’s recommendations.
- Preserve encrypted files. Because the October builds left data recoverable in some cases, keep copies of affected files and disk images before any cleanup, and give them to a recovery specialist.
- Do not assume all builds share the flaw. Check Point’s recovery result rests on seven Office files from the 17 October build, and affiliates may use other versions. Our reading is that RaaS operators tend to fix such bugs quickly, but that is a general pattern and not something this post reports.
- Treat scheduled-task creation as a signal. Check Point says the earlier October build attempted background execution through a scheduled task, and that the 17 October build staged a copy of itself under a directory resembling a legitimate software update component and registered a scheduled task. Review new scheduled tasks pointing at unexpected update-style paths.
- Keep offline, tested backups. Partial recovery does not replace them. See our ransomware negotiation tactics, timelines and outcomes analysis for why recovery plans matter before an incident.
For wider activity context, see our coverage of Comparitech’s Q3 2026 record.
Sources
- Check Point Blog, “HYFLOCK Ransomware Evolves with New Builds and Encryption Weaknesses” (4 November 2026): https://blog.checkpoint.com/security/hyflock-ransomware-evolves-with-new-builds-and-encryption-weaknesses/
- Check Point Research, “9th November Threat Intelligence Report”: https://research.checkpoint.com/2026/9th-november-threat-intelligence-report/