Malware

HYFLOCK

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Privilege Escalation

1 technique

T1484.001Group Policy ModificationEvidence1

“spreads across a Windows domain through Group Policy.”

Stealth

1 technique

T1070Indicator RemovalEvidence1

“then wipes its own traces.”

Defense Impairment

1 technique

T1484.001Group Policy ModificationEvidence1

“spreads across a Windows domain through Group Policy.”

Credential Access

1 technique

T1552Unsecured CredentialsEvidence1

“hunting for saved credentials” and Hyflock’s claimed ability to “hunt for credentials and sensitive data on its own.”

Discovery

2 techniques

T1046Network Service DiscoveryEvidence1

“mapping the network” and “hunting down network shares.”

T1135Network Share DiscoveryEvidence1

“hunting for saved credentials, working out which file servers held anything worth stealing” and “hunts down network shares.”

Lateral Movement

1 technique

T1021.002SMB/Windows Admin SharesEvidence1

“spreads across a Windows domain through Group Policy” and “reaching network shares.”

Collection

1 technique

T1119Automated CollectionEvidence1

The Hyflock AI agent “can… hunt for credentials and sensitive data on its own, analyze what it finds” and “sort stolen data into categories.”

Command and Control

1 technique

T1071Application Layer ProtocolEvidence1

“a command-and-control platform driven by a large language model” that can “interact with compromised Windows machines through a live shell and file browser.”

Impact

3 techniques

T1486Data Encrypted for ImpactEvidence1

“an unusually fast file encryptor,” “it prioritizes database files,” and “encrypt cloud-backed files.”

T1489Service StopEvidence1

“pauses 27 different cloud sync services so it can encrypt cloud-backed files.”

T1490Inhibit System RecoveryEvidence1

“deletes backup shadow copies” and “alerting on backup deletion.”

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

“dismantles Windows Defender in stages” and claims to assist with “evading security products.”

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app6 months ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

catonetworksNews

Sep 10, 2026

Ransomware's AI Adoption Curve| Cato Networks

A Rust-based ransomware operation with an AI/LLM-driven C2 and orchestration layer. Its encryptor prioritizes databases, enumerates network shares, spreads through Windows-domain Group Policy, deletes shadow copies, disables Windows Defender, pauses cloud-sync services, encrypts cloud-backed files, and removes traces. Its claimed AI agent can use a live shell and file browser, search for credentials and sensitive data, manage multiple victims, use supplied plug-ins, assist privilege escalation and defense evasion, categorize stolen data, and draft tailored extortion material. Several AI-agent claims remain unverified.

flareio blogNews

Jun 12, 2026

Ransomware-as-a-Service: LockBit Alumni Launch Competing Programs as E

A newly launched ransomware-as-a-service program advertised as featuring a fast encryptor, integrated access-broker marketplace, automated negotiation rooms, automated revenue sharing, AI-driven victim/data analysis, GPO deployment, and cloud-backup file encryption. It is pitched as cross-platform and designed to support affiliates through the intrusion lifecycle.

breakglass intelNews

Apr 4, 2026

HYFLOCK RaaS - Breakglass Intelligence Report - Breakglass Intelligence - Breakglass Intelligence

Previously unreported ransomware-as-a-service platform hosted on Tor that appears to provide affiliates with end-to-end ransomware operations capability, including payload generation, deployment, victim negotiation, leak-site management, and cryptocurrency payment handling.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

HYFLOCK

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Privilege Escalation

1 technique

T1484.001Group Policy ModificationEvidence1

“spreads across a Windows domain through Group Policy.”

Stealth

1 technique

T1070Indicator RemovalEvidence1

“then wipes its own traces.”

Defense Impairment

1 technique

T1484.001Group Policy ModificationEvidence1

“spreads across a Windows domain through Group Policy.”

Credential Access

1 technique

T1552Unsecured CredentialsEvidence1

“hunting for saved credentials” and Hyflock’s claimed ability to “hunt for credentials and sensitive data on its own.”

Discovery

2 techniques

T1046Network Service DiscoveryEvidence1

“mapping the network” and “hunting down network shares.”

T1135Network Share DiscoveryEvidence1

“hunting for saved credentials, working out which file servers held anything worth stealing” and “hunts down network shares.”

Lateral Movement

1 technique

T1021.002SMB/Windows Admin SharesEvidence1

“spreads across a Windows domain through Group Policy” and “reaching network shares.”

Collection

1 technique

T1119Automated CollectionEvidence1

The Hyflock AI agent “can… hunt for credentials and sensitive data on its own, analyze what it finds” and “sort stolen data into categories.”

Command and Control

1 technique

T1071Application Layer ProtocolEvidence1

“a command-and-control platform driven by a large language model” that can “interact with compromised Windows machines through a live shell and file browser.”

Impact

3 techniques

T1486Data Encrypted for ImpactEvidence1

“an unusually fast file encryptor,” “it prioritizes database files,” and “encrypt cloud-backed files.”

T1489Service StopEvidence1

“pauses 27 different cloud sync services so it can encrypt cloud-backed files.”

T1490Inhibit System RecoveryEvidence1

“deletes backup shadow copies” and “alerting on backup deletion.”

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

“dismantles Windows Defender in stages” and claims to assist with “evading security products.”

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app6 months ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

catonetworksNews

Sep 10, 2026

Ransomware's AI Adoption Curve| Cato Networks

flareio blogNews

Jun 12, 2026

Ransomware-as-a-Service: LockBit Alumni Launch Competing Programs as E

breakglass intelNews

Apr 4, 2026

HYFLOCK RaaS - Breakglass Intelligence Report - Breakglass Intelligence - Breakglass Intelligence

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.