Security researchers have detailed a new ransomware strain that encrypts files across Windows computers, VMware ESXi servers, and network attached storage (NAS) devices, then pressures victims by threatening to publish stolen data. The malware, called EndPoint and previously tracked as Midnight, was analyzed by AhnLab's Security Intelligence Center (ASEC), which says it is built on the leaked Babuk source code. Babuk's code spilled online in 2021 and has fueled a steady stream of copycat encryptors ever since.
What's affected
EndPoint goes after three popular targets at once: Windows hosts, ESXi hypervisors (the software that runs virtual machines on a single physical server), and NAS appliances (the shared storage boxes many companies rely on for backups and file storage). It runs a "double extortion" scheme, meaning it both scrambles your files and threatens to leak data it has copied, giving victims two reasons to pay.
According to ASEC's writeup, an earlier EndPoint campaign reused a contact address, schipkealfred[at]gmail[.]com, that impersonated the director of South Korea's East Asia Institute. ASEC says the same address has been tied to North Korea linked threat activity since 2024. IntelFusions assesses, with moderate confidence, that this overlap points to at least opportunistic reuse of Babuk's code by actors operating from or aligned with the DPRK, though the public reporting does not name a specific group.
How the attack works
Once running, EndPoint clears the path for itself. It shuts down database, office, and mail programs, wipes Volume Shadow Copies (Windows automatic backup snapshots) with the command vssadmin.exe delete shadows /all /quiet, and forcibly stops backup and security tools including VSS, SQL, Veeam, Sophos, and Acronis. Attackers can also fine tune it from the command line: -paths= limits encryption to chosen folders, /n targets only network shares, and /e skips adding the .endpoint extension to locked files.
To avoid breaking the machine before the victim can read its demands, EndPoint leaves the Windows, Program Files, and AppData folders alone and skips critical files such as bootmgr and ntuser.dat. It runs one worker thread per CPU core and uses a marker named Mutexisfunnylocal so it does not run twice on the same host. A leftover debug.endpoint log file that records file operation failures suggests the developer is still ironing out bugs.
For the encryption itself, EndPoint uses ChaCha20 with a fresh key for each file, then locks that key away using a homegrown RSA implementation rather than a trusted library. It only encrypts part of each file to work faster, a common shortcut among Babuk descendants, and tucks the wrapped key and a SHA-256 hash into a footer on every locked file. The ransom note, How To Restore Your Files.txt, lands in every affected folder, offers three free decryptions as proof, and directs victims to negotiate over the Session messaging app.
What you should do
ASEC published four sample MD5 file fingerprints for the EndPoint encryptor: 34be5e70f1260da87096b80dc7b026ac, b77ad606ba04d2d0077130679a257c96, c00cc937e064946ee42776cfe80754d7, and e82bcf417f51acc6b2d8a94ceabd5e36. Defenders should keep offline or air gapped backups and test that they actually restore, make sure detection rules flag Volume Shadow Copy deletion via vssadmin, and watch for the sudden shutdown of Veeam, Sophos, or Acronis services, an early warning that an encryptor is starting. Hunting for the Mutexisfunnylocal marker on Windows machines can also catch an infection while it is still in progress.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.