Signalis
sign in--:--:--UTC
Threat actors

Hyflock

☆ pin
Reports
12
First seen
Oct 13, 2026
Last seen
Oct 13, 2026
Motivation
Financial

Relationships

CVE-2022-40684, in 4 of Hyflock's reports, exploited in the wild×4CVE-2022-40684Reports targeting GovernmentGovernmentReports targeting Retail & E-commerceRetail & E-commerceReports targeting Professional ServicesProfessional ServicesHyflock

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors
Government ×2Retail & E-commerce ×2Professional Services ×2Healthcare ×1Telecommunications ×1Manufacturing ×1Technology ×1
Victim regions
×1
×3
India×3
Ecuador×2
Malaysia×2
Türkiye×1
Bangladesh×1
Saudi Arabia×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1133 External Remote Services ×2T1078 Valid Accounts ×1T1486 Data Encrypted for Impact ×1

Indicators

domain ×30url ×5cve ×4hash_md5 ×4ip_v4 ×2hash_sha1 ×2

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2022-40684 (exploited)

Recent reports

High

Hyflock ransomware claims YYC Advisors breach

ransomware.liveHigh

Hyflock ransomware gang publishes YYC Advisors as victim

ransomware.liveHigh

Hyflock ransomware gang publishes Cooper Tec Solutions as victim

ransomware.liveHigh

Hyflock ransomware gang publishes Cooper Tec Solutions as victim

ransomware.liveHigh

Hyflock claims Nodhom (Saudi Arabia ERP provider) as ransomware victim

ransomware.liveHigh

Hyflock claims IGPL (India Glycols Ltd) as ransomware victim

ransomware.liveHigh

Hyflock ransomware claims Ocean Beverages victim

ransomware.liveHigh

Hyflock claims Ocean Beverages (India) ransomware victim

ransomware.liveHigh

Hyflock ransomware claims attack on T Dot Net (Bangladesh ISP)

ransomware.liveHigh

Hyflock claims Ecuador National Police headquarters breach

ransomware.liveHigh

Hyflock ransomware claims Ecuador National Police headquarters as victim

ransomware.liveHigh

Hyflock ransomware claims Merkez İlaç, Turkish pharmaceutical manufacturer

ransomware.live

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans