Loading malware…
Endpoint, also styled EndPoint and formerly known as Midnight, is a ransomware family targeting Windows, ESXi, and network-attached storage environments. It uses double extortion, combining file encryption with threats to disclose allegedly stolen data. Its ransom demands offer sample decryption and threaten increased payments for delayed responses; these claims do not establish that the ransomware itself performs data exfiltration.
The Windows payload terminates database, office, and mail-client processes, stops backup and security services, and deletes Volume Shadow Copies to impede recovery. It supports configurable encryption of selected locations or network shares, excludes selected system directories and executable file types, and uses multithreading and file-size-dependent partial encryption. Earlier Endpoint samples use ChaCha20 for file encryption, a custom RSA public-key operation to protect session keys, and encryption metadata stored in file footers. Later Endpoint and closely related Funhouse samples use HC-128 encryption with Curve25519 and SHA-512 in their key-generation workflow.
Endpoint has been deployed in campaigns attributed to Kimsuky, with Quasar RAT used in the delivery chain. Funhouse is a subsequently identified Endpoint variant that retains core encryption and file-format characteristics of later Endpoint samples. A Kimsuky-attributed Funhouse campaign used a résumé-themed Hangul document containing embedded components and a deceptive PDF hyperlink. Clicking the hyperlink initiated a multistage script-based infection chain involving a Python backdoor and Quasar RAT before ransomware execution.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The Funhouse ransomware, which is executed in the final stage, has been identified as a variant of the previously disclosed Endpoint ransomware.
8 distinct techniques documented for this family, organized by ATT&CK tactic.
depending on the file size, we use partial encryption, which encrypts only a portion of the file instead of the whole, to control processing speed and impact. | EndPoint is a ransomware variant formerly known as Midnight... uses a double extortion method that combines file encryption with Data exfiltration threats.
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a ransomware family in a report about ransomware evolution and Kimsuky-linked distribution cases. The supplied post provides no technical details or explicit family-specific actor attribution.
Ransomware previously distributed by Kimsuky in campaigns compared with the current Funhouse attack. The February 2026 sample used ChaCha20 encryption and the .Endpoint extension. The June sample used HC-128, Curve25519-based key generation, and the .Funhouse extension, sharing major implementation characteristics with the September Funhouse sample. February 2026 is the earliest campaign discussed, but the content does not establish Endpoint's original discovery date.
Babuk leaked source/framework 기반으로 개발된 랜섬웨어 변종으로, Windows뿐 아니라 ESXi와 NAS 환경도 겨냥하며 파일 암호화와 데이터 유출 협박을 결합한 이중 갈취(Double Extortion)를 수행한다. .endpoint 확장자를 추가하고 How To Restore Your Files.txt 랜섬노트를 생성하며, ChaCha20과 자체 RSA 공개키 연산, 부분 암호화를 사용한다.
Named as a ransomware family in the referenced AhnLab post title.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.