Hive Ransomware Rebuilt in Rust With Stronger Encryption and Evasion
Threat Actor Intelligence · 6 sources · Updated 3mo ago · First seen Jul 5, 2022
Microsoft reported that the Hive ransomware operation deployed a heavily reworked variant rewritten from Go to Rust, introducing a more complex encryption scheme and stealth improvements that initially helped some samples avoid detection. Analysts said the new build was uncovered after unusual .key files lacked the victim identifier normally associated with Hive, leading to the discovery of multiple related samples. The malware now requires ransom-site credentials through the command line, decrypts strings at runtime to hinder analysis, and uses updated cryptography built on Curve25519 ECDH and XChaCha20-Poly1305.
The updated payload also attempts to maximize impact by stopping security, backup, database, and business application services before launching recovery-disruption commands to remove shadow copies and backups. Microsoft said Hive continued to operate as a ransomware-as-a-service threat seen in intrusions affecting sectors including healthcare and software, with activity linked to affiliate DEV-0237, now tracked as Pistachio Tempest. The company published indicators of compromise, detections, and mitigation guidance to help defenders identify and contain Hive-related attacks.
