HYFLOCK — Ransomware Profile
HYFLOCK is a ransomware-as-a-service operation that Flare traced to a recruitment thread opened on the Duty-Free forum on 14 May 2026 by the handle hyflock123, whose operators claim prior work for LockBit and Qilin, a lineage Flare cannot corroborate. Cato Networks describes a Rust-based encryptor that deletes shadow copies, dismantles Windows Defender in stages and spreads through Group Policy, sold with what the operators advertise as an AI-driven command-and-control platform. PCrisk documented a sample in July 2026 that appends a .locked extension and steers victims to qTox over Tor. WatchGuard links the forum handle to the group's leak site, where HYFLOCK listed eight organisations in seven countries between September and October 2026, including Ecuador's National Police. These listings are the group's own claims.
IntelFusions coverage (1)
Tools & malware
- HYFLOCK encryptor Ransomware encryptor (Rust; appends .locked)
Recent claimed victims
Vendor research
Read the full analysis on IntelFusions