Researchers Exploit Hive Encryption Flaws as Ransomware Crew Refines Tooling

Hive emerged as a prolific ransomware-as-a-service operation that heavily targeted healthcare and other enterprises, using double extortion to steal data and encrypt systems. Reporting tied the group to intrusions involving phishing, vulnerable RDP, stolen VPN credentials, and possible exploitation of Microsoft Exchange ProxyShell, followed by lateral movement with RDP and WMI, use of Cobalt Strike, shadow-copy deletion, and exfiltration through tools such as 7-Zip and anonymous file-sharing services. The group expanded beyond Windows with Linux and FreeBSD encryptors, including VMware ESXi-focused variants, and was linked to major disruptions at hospitals and other organizations.

At the same time, academics from Kookmin University published a decryption method that exploited weaknesses in Hive’s custom XOR-based file-encryption design, reporting recovery of more than 95% of the master key and decryption of roughly 82% to 98% of affected files without the attackers’ private key. Subsequent public research and proof-of-concept tooling documented Hive version-specific decryptors and analysis resources, while the ransomware operators responded by hardening their malware, including rewriting the Linux ESXi encryptor in Rust and moving ransom-site credentials out of embedded samples and into runtime command-line arguments to reduce analysis and monitoring opportunities.