Hackers Develop New HYFLOCK Ransomware That Encrypts Files and Attempts to Block Recovery

The report analyzes the HYFLOCK Ransomware-as-a-Service operation active in 2026, detailing four analyzed generations (Rust-based encryptors and Go-based carriers), confirmed file encryption, scheduled-task persistence, and network-share access; researchers also observed operator recruitment and public victim claims but did not verify domain-wide spreading or advertised vulnerable-driver security-bypass techniques. Importantly, build-specific implementation flaws were found — including a defect that can permanently discard file content and an October build that only encrypts the first 4,096 bytes of large files — which materially affect recovery prospects and risk assessments.