A relatively new ransomware-as-a-service operation called HYFLOCK has a quirk that could hand some of its victims a partial lifeline: in its most recent build, the malware only encrypts the first 4 kilobytes of larger files, leaving the rest of the content sitting untouched and potentially recoverable.

The finding comes from Check Point’s Exposure Management research team, which has been tracking HYFLOCK through four distinct generations of its encryptor since it first surfaced in underground forums in March 2026 as a ransomware-as-a-service offering. By mid-October, the group’s leak site was listing eight victim organizations spanning manufacturing, business services, government, retail and telecommunications — claims that researchers note remain unverified and whose initial intrusion routes have not been established.

A Narrow Window for Recovery

In testing the ransomware’s October 17 build, Check Point’s researchers validated seventeen encrypted files. Fourteen of the larger ones had only their first 4,096 bytes scrambled, while three smaller files were encrypted in their entirety. That’s notable because the malware’s own configuration settings indicated it was supposed to perform full encryption — the actual behavior on larger files simply didn’t match what the ransomware was configured to do.

Working with the untouched portions of affected files, researchers managed to recover 73 internal components from seven encrypted Microsoft Office documents, including worksheet and shared-string data that passed integrity checks. It’s important to be precise about what this means: this is partial content recovery, not a decryption breakthrough. The encrypted prefix of each file remains locked away without the correct key material, and no general-purpose decryptor exists. Victims with large Office files, in particular, may be able to salvage meaningful fragments of data that would otherwise be considered lost — but a full, clean recovery is not on the table.

Complicating the picture further, an earlier October build of HYFLOCK carried a separate and more dangerous defect: a processing bug that could permanently discard portions of file data during encryption, a failure mode that could prevent complete recovery even for a victim who pays and receives a legitimate decryption key.

Under the Hood

HYFLOCK’s encryption mechanics are fairly conventional on paper — 16-byte symmetric keys with AES in counter mode, wrapped with RSA for key recovery, and a 556-byte trailer appended to each encrypted file holding metadata and the wrapped key. The ransomware’s core has evolved across versions, starting as a Rust-based Windows executable in April, gaining a separate Go-based loader carrying the payload in July, and returning to a standalone Rust binary in the October 17 build that copies itself into a directory designed to look like a routine software update.

During controlled testing, the malware registered a scheduled task for persistence, probed network-attached shares, and attempted to interfere with backup and recovery mechanisms — though Check Point cautions that its sabotage commands produced inconsistent results, and claims of complete recovery-object deletion were not proven. Advertised capabilities such as exploiting vulnerable drivers and reliably executing after a remote desktop session ends also remain unverified marketing rather than confirmed behavior. Group Policy-based spreading was present in the code but disabled in the configuration researchers recovered, and no successful domain-wide propagation was observed in testing.

What This Means for Defenders

Organizations that suspect a HYFLOCK infection should resist the urge to immediately wipe affected systems. Instead, security teams should:

• Preserve encrypted files and any available execution evidence rather than deleting or overwriting them
• Check for the distinctive HFLKEY01 trailer marker and the .locked_<identifier> file extension pattern associated with the October 17 build
• Review scheduled tasks, network share access, and backup infrastructure for signs of tampering before attempting any restoration
• Engage experienced incident responders who can evaluate whether partial content recovery is feasible for Office-format files specifically

HYFLOCK is a useful case study in why ransomware families shouldn’t be judged purely by their marketing claims on leak sites. The gap between what an operation’s configuration says it does and what its code actually does in practice can sometimes work in a victim’s favor — but relying on an attacker’s bugs is never a substitute for solid backups and fast detection.