HYFLOCK Ransomware Flaws Leave File Content Recoverable but Risk Permanent Data Loss

Check Point researchers identified encryption defects in HYFLOCK ransomware that can leave portions of encrypted files accessible or cause irreversible data loss. Testing of the October 17, 2026 build found that it encrypted only the first 4,096 bytes of larger examined files, despite settings indicating full encryption. Researchers recovered 73 intact internal components from seven encrypted Microsoft Office files without a key, but did not restore complete documents or produce a general decryptor. An earlier October build could permanently discard file data, and HYFLOCK can continue encrypting after failures in key wrapping or recovery-material storage, potentially undermining restoration.

HYFLOCK emerged on underground forums in March as a ransomware-as-a-service operation and progressed through four generations between April and October. Researchers confirmed file encryption, scheduled-task registration, network-share processing, and attempts to disrupt recovery, but did not establish successful domain-wide propagation, complete deletion of recovery objects, or several other advertised capabilities. Its leak site published eight unverified victim claims across multiple sectors on October 13. The findings highlight that recoverability depends on the build and affected file: accessible fragments do not establish that complete restoration is possible.