Hive Ransomware Intrusions Used ProxyShell, Fake Installers, and Safe Mode Evasion

Hive ransomware affiliates used multiple intrusion paths to compromise enterprise networks, including unpatched Microsoft Exchange ProxyShell vulnerabilities and fake software installers delivered through malicious Google Ads and typosquatted download sites. Incident reports describe attackers planting web shells on Exchange servers, launching PowerShell payloads and Cobalt Strike beacons, stealing credentials with tools such as Mimikatz and LSASS dumping, and moving laterally through RDP, PsExec, and pass-the-hash. In several cases, the actors also conducted broad internal reconnaissance, exfiltrated data with tools including Rclone and WinSCP, and created new administrator accounts before deploying Hive’s Golang encryptor and dropping the ransom note HOW_TO_DECRYPT.txt.

Researchers also documented unusually aggressive defense-evasion and deployment tactics designed to maximize disruption. Rapid7 observed Hive operators using BITSAdmin, Active Directory Group Policy changes, and PsExec to distribute payloads, then forcing hosts into Safe Mode with minimal services via BCDEdit, enabling auto-logon for a local administrator account, and replacing the Windows shell with a malicious batch file so encryption could run after reboot with security tools disabled. Across the reported intrusions, the ransomware deleted shadow copies and other recovery artifacts, disabled or weakened endpoint defenses, cleared logs, encrypted local and network-accessible files, and used Tor-based negotiation and leak sites to pressure victims into paying.