HYFLOCK Ransomware's Partial Encryption Offers Limited Recovery Hope
A new build of the HYFLOCK ransomware encrypts only the first 4KB of larger files, potentially leaving the remainder accessible and offering a slim chance for data recovery.
Researchers have identified a significant modification in a recent build of the HYFLOCK ransomware, which now encrypts only the initial 4,096 bytes of larger files. This selective encryption leaves the latter portions of affected files intact, presenting a limited opportunity for victims to recover some data without paying the ransom.
While this partial encryption offers a glimmer of hope, it is crucial to note that a complete data recovery solution is not yet available. Security researchers were able to salvage specific components from encrypted Microsoft Office files, but they could not restore entire documents or develop a universal decryptor. This finding is based on an October 17 build of the malware; an earlier build from October posed a different, more severe risk, as a processing defect could lead to permanent data loss, potentially rendering files unrecoverable even with the correct decryption key.
The HYFLOCK ransomware, written in Rust, has been active since at least April 2026 and is promoted as a Ransomware-as-a-Service (RaaS) offering on underground forums. Threat intelligence firm Check Point's Exposure Management team discovered these updated builds through proactive threat hunting, tracing the evolution of HYFLOCK through four distinct generations between April and October 2026.
In controlled testing of the October 17 sample, researchers observed that out of 17 validated encrypted files, 14 larger files exhibited the partial encryption behavior, with only the first 4,096 bytes being encrypted. The remaining three smaller files were fully encrypted. This behavior contradicts the malware's configuration settings, which indicated full encryption, highlighting an inconsistency between the intended operation and the actual execution.
While partial encryption is not unique to HYFLOCK, with other ransomware families like Gunra offering configurable partial encryption options, the specific implementation in this HYFLOCK build is noteworthy. The untouched content recovered from Office files included internal components like worksheet and shared-string data, which passed integrity checks. However, this recovery of components does not equate to full decryption; the encrypted prefixes remain inaccessible without the corresponding encryption key or an exact, uncorrupted backup.
The risks associated with HYFLOCK extend beyond inaccessible file prefixes. The earlier October build's processing defects, which could discard file data, echo similar damaging implementation errors seen in other ransomware families. Furthermore, HYFLOCK is designed to continue encrypting even if key wrapping or backup storage mechanisms fail, creating additional obstacles to data recovery.
HYFLOCK has been advertised as a RaaS since March 2026, with its leak site claiming eight victims across various sectors by mid-October, including manufacturing, business services, government, retail, and telecommunications. While these claims are unverified, the malware's development shows a progression from an April Rust core to July's addition of a separate loader, an earlier October version using a Go carrier, and the return to a standalone Rust executable in the latest build. The malware also attempts to disrupt recovery processes by creating scheduled tasks and targeting network shares.
Defenders are advised to preserve affected files and execution evidence, and to scrutinize scheduled tasks, network share access, system segmentation, and existing recovery protections before attempting any restoration. Indicators of compromise include specific file extensions (.locked_<identifier>), staging paths (ProgramData\EdgeUpdate_<suffix>\eu.exe), and configuration files (eu.cfg, filesystem_config.dat).