Loading story…
Microsoft reported that the Hive ransomware operation deployed a heavily reworked variant rewritten from Go to Rust, introducing a more complex encryption scheme and stealth improvements that initially helped some samples avoid detection. Analysts said the new build was uncovered after unusual .key files lacked the victim identifier normally associated with Hive, leading to the discovery of multiple related samples. The malware now requires ransom-site credentials through the command line, decrypts strings at runtime to hinder analysis, and uses updated cryptography built on Curve25519 ECDH and XChaCha20-Poly1305.
The updated payload also attempts to maximize impact by stopping security, backup, database, and business application services before launching recovery-disruption commands to remove shadow copies and backups. Microsoft said Hive continued to operate as a ransomware-as-a-service threat seen in intrusions affecting sectors including healthcare and software, with activity linked to affiliate DEV-0237, now tracked as Pistachio Tempest. The company published indicators of compromise, detections, and mitigation guidance to help defenders identify and contain Hive-related attacks.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft Threat Intelligence published analysis of the new Hive variant, describing its Rust rewrite, runtime string decryption, revised cryptography, and recovery-disabling behavior. Microsoft also released indicators of compromise, detections, and defensive guidance for customers.
Microsoft said it first observed the new Hive variant in its threat data on February 22, 2022. The variant represented a major overhaul, including a migration from Go to Rust and updated encryption behavior.
Microsoft reported that the new Hive ransomware variant was first uploaded to VirusTotal on February 21, 2022, marking an early public sample of the overhauled malware.
Microsoft said Hive ransomware was first observed in June 2021 and went on to become one of the more prevalent ransomware-as-a-service payloads.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
docs.microsoft.com
Open sourcedocs.microsoft.com
Open sourcedocs.microsoft.com
Open sourcemicrosoft.com
Open sourcemicrosoft.com
Open sourcedocs.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hive emerged as a prolific ransomware-as-a-service operation that heavily targeted healthcare and other enterprises, using **double extortion** to steal data and encrypt systems. Reporting tied the group to intrusions involving phishing, vulnerable RDP, stolen VPN credentials, and possible exploitation of Microsoft Exchange `ProxyShell`, followed by lateral movement with RDP and WMI, use of Cobalt Strike, shadow-copy deletion, and exfiltration through tools such as 7-Zip and anonymous file-sharing services. The group expanded beyond Windows with Linux and FreeBSD encryptors, including VMware ESXi-focused variants, and was linked to major disruptions at hospitals and other organizations. At the same time, academics from Kookmin University published a decryption method that exploited weaknesses in Hive’s custom XOR-based file-encryption design, reporting recovery of more than **95%** of the master key and decryption of roughly **82% to 98%** of affected files without the attackers’ private key. Subsequent public research and proof-of-concept tooling documented Hive version-specific decryptors and analysis resources, while the ransomware operators responded by hardening their malware, including rewriting the Linux ESXi encryptor in **Rust** and moving ransom-site credentials out of embedded samples and into runtime command-line arguments to reduce analysis and monitoring opportunities.
Aug 15, 2026
Hive ransomware affiliates used multiple intrusion paths to compromise enterprise networks, including unpatched Microsoft Exchange `ProxyShell` vulnerabilities and fake software installers delivered through malicious Google Ads and typosquatted download sites. Incident reports describe attackers planting web shells on Exchange servers, launching PowerShell payloads and Cobalt Strike beacons, stealing credentials with tools such as Mimikatz and LSASS dumping, and moving laterally through `RDP`, `PsExec`, and pass-the-hash. In several cases, the actors also conducted broad internal reconnaissance, exfiltrated data with tools including `Rclone` and `WinSCP`, and created new administrator accounts before deploying Hive’s Golang encryptor and dropping the ransom note `HOW_TO_DECRYPT.txt`. Researchers also documented unusually aggressive defense-evasion and deployment tactics designed to maximize disruption. Rapid7 observed Hive operators using `BITSAdmin`, Active Directory Group Policy changes, and `PsExec` to distribute payloads, then forcing hosts into Safe Mode with minimal services via `BCDEdit`, enabling auto-logon for a local administrator account, and replacing the Windows shell with a malicious batch file so encryption could run after reboot with security tools disabled. Across the reported intrusions, the ransomware deleted shadow copies and other recovery artifacts, disabled or weakened endpoint defenses, cleared logs, encrypted local and network-accessible files, and used Tor-based negotiation and leak sites to pressure victims into paying.
Aug 15, 2026
Researchers reported that **Hive ransomware** affiliates used a new obfuscation method dubbed **"IPfuscation"** to conceal malware payloads inside 64-bit Windows loaders. The technique stores shellcode as arrays of ASCII-formatted network identifiers—primarily IPv4 addresses—which are converted at runtime through Windows string-to-address APIs and then executed to launch a **Cobalt Strike Beacon** stager. Analysts observed execution methods including direct system calls and callback abuse through `EnumUILanguagesA`, making the loaders harder to detect with traditional static signatures. Sentinel Labs also identified related variants that encoded payloads as **IPv6 addresses, UUIDs, base64-encoded UUIDs, and MAC addresses**, along with a Golang loader that shared development artifacts suggesting a common author. The activity aligned with known Hive intrusion tradecraft, including use of **PowerShell**, BAT scripts, **ADFind**, **SharpView**, **BloodHound**, **SharpHashSpray**, **SharpDomainSpray**, **Rubeus**, Group Policy Objects, and scheduled tasks. Researchers said defenders should prioritize **behavioral detection**, endpoint telemetry correlation, and broader security analytics over signature-only approaches, and they published malware hashes, C2 indicators, and YARA rules tied to the IPfuscation family.
Aug 15, 2026