Description
Rook is a ransomware family descended from an updated Babuk variant that prevents victims from accessing their files by encryption. It renames files with the .Rook extension and drops a ransom note named HowToRestoreYourFiles.txt.
Stats
- First seen
- May 2022
- Last seen
- October 2026
Alert name variants
| Alert Name |
|---|
| Gen:Variant.Ransom.Rook.2 |
| Gen:Variant.Ransom.Rook.4 |
| Trojan.Ransom.Rook.1 |
| Trojan.Ransom.Rook.A |
| Trojan.Ransom.Rook.B |
| Trojan.Ransom.Rook.C |
| Trojan.Ransom.Rook.D |
| Win64.Ransomware.Rook |
