RookMalware
According to PCrisk, Rook is ransomware (an updated variant of Babuk) that prevents victims from accessing/opening files by encrypting them. It also modifies filenames and creates a text file/ransom note ("HowToRestoreYourFiles.txt"). Rook renames files by appending the ". Rook" extension. For example, it renames "1.jpg" to "1.jpg. Rook", "2.jpg" to "2.jpg. Rook".From MISP Galaxy
Last reported 4 months ago, by ESET WeLiveSecurity (ES)2 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1542.003Bootkit
“…Boots y MoKhargosh, demostraron tanto capacidades de ciberespionaje como potencial destructivo —incluido el despliegue de un wiper tipo bootkit y la retención de herramientas destructivas para su uso posterior—, mientras que un tercero, MOØN Badr, parece haber estad…”
- T1195Supply Chain Compromise
“…yptocurrency ecosystem with social engineering schemes that can yield both direct financial gain and opportunities for software supply-chain compromise.”
- T1485Data Destruction
“Particularly notable was a December 2025 data destruction incident affecting a Polish energy company, which we attribute to Sandworm with medium confidence.”
- T1684Social Engineering
“Multiple groups continued targeting developers and the cryptocurrency ecosystem with social engineering schemes that can yield both direct financial gain and opportunities for software supply-chain compromise.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Reporte de Actividad APT del cuarto trimestre de 2025 al primero de 2026“…detectamos el resurgimiento de Andariel en Corea del Sur, donde el grupo desplegó TigerRAT e intentó propagar el ransomware Rook dentro de una empresa de ingeniería que aparentemente fabrica equipos relevantes para el manejo de hidrógeno líquido…”
-
ESET APT Activity Report Q4 2025–Q1 2026“We also uncovered the reemergence of Andariel in South Korea, where the group deployed TigerRAT and attempted to spread Rook ransomware within an engineering company that appears to manufacture equipment relevant to liquid hydrogen handling and the nuclear industry – technologies…”
Thanks — we review every report.