Loading malware…
Rook is a Windows ransomware family that emerged in late 2021 and is widely assessed to be derived from the leaked Babuk source code. It is associated with double-extortion operations in which victim data is stolen and victims are pressured with both file encryption and threatened public disclosure. Public reporting has also noted attempted deployment of Rook in at least one intrusion attributed to the North Korean Andariel cluster, while other reporting characterizes it as a for-purchase ransomware tool reused by different operators.
Rook is typically delivered after initial compromise through third-party post-exploitation frameworks such as Cobalt Strike, although phishing-based delivery has also been reported. Samples are commonly packed with UPX and some variants have used other protectors. The malware focuses on maximizing encryption impact by terminating processes and services that may lock files or support backup, database, and security functions. It deletes volume shadow copies to inhibit recovery, traverses local drives, mounted volumes, network resources, and operator-supplied paths or shares, and drops ransom notes in affected directories. Analyses have found no meaningful persistence mechanism in examined samples, and the malware can self-delete after execution.
Technically, Rook shows substantial code and design overlap with Babuk, including service and process termination logic, use of Windows Restart Manager APIs to identify locking processes, shadow-copy deletion workflow, and drive-enumeration patterns. Reverse engineering has shown a hybrid cryptographic design using Mbed TLS, with per-file symmetric encryption keys protected by RSA key material. Rook appends a dedicated extension to encrypted files and stores metadata needed for decryption within the encrypted file structure. It excludes selected system directories, boot-related files, and some executable formats to preserve system operability during extortion.
Rook has also been linked by multiple researchers to closely related ransomware families including Pandora and NightSky. Pandora has been assessed by several analysts as a likely rebrand or close derivative of Rook, and NightSky has been described as a probable fork sharing highly similar cryptographic and threading logic. Overall, Rook exemplifies the rapid proliferation of ransomware families built from leaked source code and reused across multiple criminal or state-linked intrusion sets.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
We also uncovered the reemergence of Andariel in South Korea, where the group deployed TigerRAT and attempted to spread Rook ransomware within an engineering company
"ESET APT Activity Report Q4 2025–Q1 2026" published by ESET. #Andariel, #DangerousPassword, #DeceptiveDevelopment, #DreamJob, #Rook, #ScarCruft, #DPRK, #CTI
Their payloads are sometimes rebuilt from existing for-purchase ransomware tools like Rook, which shares code similarity with the Babuk ransomware family.
17 distinct techniques documented for this family, organized by ATT&CK tactic.
Individual samples are typically UPX packed, although alternate packers/crypters have been observed such as VMProtect.
After hiding itself, ROOK also calls SetFileInformationByHandle again to set the file to be deleted once all handles are closed at the end.
Babuk and Rook use EnumDependentServicesA API to retrieve the name and status of each service that depends on the specified service before terminating. They enumerate all services in the system and stop all of those which exist in a hardcoded list in the malware.
both Rook and Babuk use the functions CreateToolhelp32Snapshot , Process32FirstW , Process32NextW , OpenProcess , and TerminateProcess to enumerate running processes and kill any found to match those in a hardcoded list.
Both Babuk and Rook check if the sample is executed in a 64-bit OS, then delete the shadow volumes of the user machine.
Finally, the malware calls GetLogicalDrives to iterate through all the drives in the system and traverse them.
Rook embraces a dual-pronged extortion approach: an initial demand for payment to unlock encrypted files, followed by public threats via the operators’ website to leak exfiltrated data should the victim fail to comply with the ransom demand.
For each dependent service, the malware calls OpenServiceA to retrieve its handle and ControlService to send a control stop code to stop it. | For each process whose name is in the list of processes to be terminated, the malware calls OpenProcess to retrieve the process’s handle and TerminateProcess to terminate it.
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as a ransomware variant developed from leaked Babuk source code.
"ESET APT Activity Report Q4 2025–Q1 2026" published by ESET. #Andariel, #DangerousPassword, #DeceptiveDevelopment, #DreamJob, #Rook, #ScarCruft, #DPRK, #CTI
A ransomware family that Andariel attempted to spread within a South Korean engineering company.
Named malware/tool listed alongside RokRAT in an ESET APT activity report; no further detail is provided in the content.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.