Four ransomware generations. Six months of development. Eight victim claims published in a single day. HYFLOCK spent much of 2026 building its ransomware operation, recruiting participants through underground forums and promoting increasingly sophisticated attack capabilities. By October, the group had begun publicly naming victims, and its ransomware had undergone significant changes. Through threat hunting, Check Point Exposure Management researchers identified updated HYFLOCK ransomware builds and traced their development from April through October. The investigation revealed changes in how the malware launches, runs in the background, and interacts with network resources. Researchers also uncovered encryption weaknesses that could affect victims’ ability […]
Read the original article:
HYFLOCK Ransomware Evolves with New Builds and Encryption Weaknesses