Description Summary
According to PCrisk, Rook is ransomware (an updated variant of Babuk) that prevents victims from accessing/opening files by encrypting them. It also modifies filenames and creates a text file/ransom note (HowToRestoreYourFiles.txt). Rook renames files by appending the .Rook extension. For example, it renames 1.jpg to 1.jpg.Rook, 2.jpg to 2.jpg.Rook.
Threat Actor
Built on the leaked Babuk source code; delivered via Cobalt Strike and often QakBot.
Technical Indicators
Encryption Extension
.Rook
Encryption Algorithm
AES + ECDH (Babuk-derived)
Ransom Note Name
HowToRestoreYourFiles.txt
Targeted Industries
Cross-sector
First Seen
December 2021
Last Seen
2022 (lineage continued as Night Sky / Pandora)
Geographical Location
Worldwide
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |