Rook is a crime-origin ransomware group operating as an updated Babuk variant targeting individual users and organizations.
Rook is a crime-origin ransomware group operating as an updated variant of the Babuk ransomware. It targets individual users and organizations by encrypting files and appending the .Rook extension to filenames. After encryption, it creates a ransom note named 'HowToRestoreYourFiles.txt' to demand payment from victims. Defenders should monitor for suspicious file encryption activity, the appearance of the .Rook extension, and the presence of the ransom note, while maintaining isolated backups.
According to PCrisk, Rook is ransomware (an updated variant of Babuk) that prevents victims from accessing/opening files by encrypting them. It also modifies filenames and creates a text file/ransom note (HowToRestoreYourFiles.txt). Rook renames files by appending the .Rook extension. For example, it renames 1.jpg to 1.jpg.Rook, 2.jpg to 2.jpg.Rook.
Encrypted files are appended with the .Rook extension. For example, '1.jpg' becomes '1.jpg.Rook'.
The ransom note is created as a text file named 'HowToRestoreYourFiles.txt'.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.