Rook Ransomware Emerged as a Babuk-Derived Strain and Spawned NightSky Forks

Researchers found that Rook is a 64-bit Windows ransomware family built heavily from the leaked Babuk source code, reusing routines for service and process termination, shadow copy deletion, and core encryption logic while adding a more efficient multithreaded file-encryption model. The malware encrypts files with per-file AES keys protected by RSA-2048 through the Mbed TLS library, appends the .Rook or .ROOK extension, drops a ransom note named HowToRestoreYourFiles.txt, and targets local drives, mounted volumes, network resources, and operator-supplied paths. Analysts also observed Rook deleting volume shadow copies, attempting to stop backup, database, and security tools, storing victim key material in the Windows registry, hiding its executable in an NTFS alternate data stream named :ask, and deleting itself after execution without observed persistence.

Threat intelligence linked Rook’s early operations to data-theft extortion claims, including a reported first victim in Kazakhstan’s financial sector, where the operators said they stole 1,123 GB of data. Delivery has been associated mainly with third-party access frameworks such as Cobalt Strike, though phishing has also been reported, and samples have appeared packed with UPX or VMProtect. Separate reverse-engineering work concluded that NightSky is very likely a fork of Rook, sharing nearly identical key generation, threading, synchronization, encrypted file structure, and RSA/AES workflow, with the main cryptographic change being NightSky’s use of AES-128-CBC instead of Rook’s intermittent AES-128-ECB approach.