Endpoint(Midnight) Ransomware · 2026-04
Endpoint, also called Midnight, is a ransomware campaign reported against South Korean small and medium-sized businesses, with manufacturing victims specifically noted by South Korean authorities. The activity uses malicious email lures, supplier or IT service trust paths, remote-control malware, credential and internal data theft, and double extortion before file encryption; AhnLab separately describes the malware as a Babuk-derived family targeting Windows, ESXi, and NAS environments with ChaCha20 encryption, shadow-copy deletion, and backup or security service termination. AhnLab notes a prior ransom-note email was identified as used by North Korea-linked actors after 2024, but the available reports do not attribute Endpoint itself to a specific DPRK actor.
Guest at Midnight: Analysis of EndPoint (Midnight) · 2026-05-21
excerpt: Summary EndPoint is a ransomware variant formerly known as Midnight, which is believed to be built on the Babuk ransomware framework. It targets not only Windows environments, but also ESXi and NAS environments, and uses a double extortion method that combines file encryption with Data exfiltration threats. Overview Since the Babuk source code leak, several […] | attribution sentence: in the past, the schipkealfred@gmail.com account in the ransom note impersonated the director of the East Asia Institute, which has been identified as being used by North Korea-linked threat actors since 2024. | target sentence: It targets not only Windows environments, but also ESXi and NAS environments, and uses a double extortion method that combines file encryption with Data exfiltration threats.
새벽에 온 암호화 손님 Endpoint(Midnight) 랜섬웨어 분석 · 2026-06-02
excerpt: 요약 EndPoint는 이전에 Midnight으로 알려졌던 랜섬웨어 변종으로, Babuk 랜섬웨어 프레임워크를 기반으로 개발된 것으로 알려져 있다. Windows 환경뿐 아니라 ESXi와 NAS 환경도 겨냥하며, 파일 암호화와 데이터 유출 협박을 함께 수행하는 Double Extortion 방식을 사용한다. 개요 Babuk 소스코드 유출 이후 여러 파생 랜섬웨어가 등장했으며, EndPoint도 그중 하나로 확인된다. 감염 파일에는 .endpoint 확장자가 부여되며, 랜섬노트에는 피해자와 연락하기 위한 […] | target sentence: 효율성과 은폐성을 함께 고려해 빠른 피해 확산과 복구 방해를 노리는 위협으로 평가된다.
actors: not attributed to a specific DPRK actor
AhnLab notes a prior ransom-note email was identified as used by North Korea-linked actors after 2024, but the available reports do not attribute Endpoint itself to a specific DPRK actor.