HYFLOCK Ransomware Encryption Flaw Lets Researchers Recover Data Without a Decryption Key

Check Point researchers analyzed HYFLOCK, a Ransomware-as-a-Service active March–October 2026, and found implementation flaws in multiple builds: an October 17 Rust encryptor only encrypted the first 4,096 bytes of large Office files (enabling partial recovery of 73 CRC-valid components without the key), while earlier versions could permanently discard file data; HYFLOCK evolved through Rust/Go loaders, scheduled-task persistence, network-share activity, and public extortion postings, but researchers did not observe confirmed domain-wide propagation or produce a universal decryptor.