Loading story…
Researchers reported that Hive ransomware affiliates used a new obfuscation method dubbed "IPfuscation" to conceal malware payloads inside 64-bit Windows loaders. The technique stores shellcode as arrays of ASCII-formatted network identifiers—primarily IPv4 addresses—which are converted at runtime through Windows string-to-address APIs and then executed to launch a Cobalt Strike Beacon stager. Analysts observed execution methods including direct system calls and callback abuse through EnumUILanguagesA, making the loaders harder to detect with traditional static signatures.
Sentinel Labs also identified related variants that encoded payloads as IPv6 addresses, UUIDs, base64-encoded UUIDs, and MAC addresses, along with a Golang loader that shared development artifacts suggesting a common author. The activity aligned with known Hive intrusion tradecraft, including use of PowerShell, BAT scripts, ADFind, SharpView, BloodHound, SharpHashSpray, SharpDomainSpray, Rubeus, Group Policy Objects, and scheduled tasks. Researchers said defenders should prioritize behavioral detection, endpoint telemetry correlation, and broader security analytics over signature-only approaches, and they published malware hashes, C2 indicators, and YARA rules tied to the IPfuscation family.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
SC Media reported on Sentinel Labs' findings that Hive used the IPfuscation technique to conceal payloads that ultimately downloaded Cobalt Strike beacons. The article also noted observed IPv6, MAC, and UUID variants and the recommendation for behavioral and AI-assisted detection.
BleepingComputer reported that researchers had described IPfuscation as a new malware obfuscation technique observed in a Hive ransomware incident. The coverage highlighted that static signatures alone were insufficient and emphasized behavioral and broader endpoint detection approaches.
SentinelOne publicly released a report detailing IPfuscation, associated malware samples, related Hive intrusion tradecraft, and detection content including hashes, infrastructure, and YARA rules. The report described how the loaders reconstructed and executed Cobalt Strike Beacon payloads on 64-bit Windows systems.
The analysis found related loader variants that reconstructed payloads from other encoded formats, including IPv6 addresses, UUIDs, base64-encoded UUIDs, and MAC addresses. Execution methods included EnumUILanguagesA callbacks, direct syscalls via Hell's Gate, and EnumWindows callbacks.
Sentinel Labs identified a novel obfuscation method used in a Hive ransomware incident, in which payload data was disguised as ASCII-formatted IPv4 addresses and reconstructed into shellcode to deliver a Cobalt Strike stager. The researchers named the technique 'IPfuscation.'
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 64 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
scmagazine.com
Open sourcebleepingcomputer.com
Open sourcesentinelone.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hive ransomware affiliates used multiple intrusion paths to compromise enterprise networks, including unpatched Microsoft Exchange `ProxyShell` vulnerabilities and fake software installers delivered through malicious Google Ads and typosquatted download sites. Incident reports describe attackers planting web shells on Exchange servers, launching PowerShell payloads and Cobalt Strike beacons, stealing credentials with tools such as Mimikatz and LSASS dumping, and moving laterally through `RDP`, `PsExec`, and pass-the-hash. In several cases, the actors also conducted broad internal reconnaissance, exfiltrated data with tools including `Rclone` and `WinSCP`, and created new administrator accounts before deploying Hive’s Golang encryptor and dropping the ransom note `HOW_TO_DECRYPT.txt`. Researchers also documented unusually aggressive defense-evasion and deployment tactics designed to maximize disruption. Rapid7 observed Hive operators using `BITSAdmin`, Active Directory Group Policy changes, and `PsExec` to distribute payloads, then forcing hosts into Safe Mode with minimal services via `BCDEdit`, enabling auto-logon for a local administrator account, and replacing the Windows shell with a malicious batch file so encryption could run after reboot with security tools disabled. Across the reported intrusions, the ransomware deleted shadow copies and other recovery artifacts, disabled or weakened endpoint defenses, cleared logs, encrypted local and network-accessible files, and used Tor-based negotiation and leak sites to pressure victims into paying.
Aug 15, 2026
Hive emerged as a prolific ransomware-as-a-service operation that heavily targeted healthcare and other enterprises, using **double extortion** to steal data and encrypt systems. Reporting tied the group to intrusions involving phishing, vulnerable RDP, stolen VPN credentials, and possible exploitation of Microsoft Exchange `ProxyShell`, followed by lateral movement with RDP and WMI, use of Cobalt Strike, shadow-copy deletion, and exfiltration through tools such as 7-Zip and anonymous file-sharing services. The group expanded beyond Windows with Linux and FreeBSD encryptors, including VMware ESXi-focused variants, and was linked to major disruptions at hospitals and other organizations. At the same time, academics from Kookmin University published a decryption method that exploited weaknesses in Hive’s custom XOR-based file-encryption design, reporting recovery of more than **95%** of the master key and decryption of roughly **82% to 98%** of affected files without the attackers’ private key. Subsequent public research and proof-of-concept tooling documented Hive version-specific decryptors and analysis resources, while the ransomware operators responded by hardening their malware, including rewriting the Linux ESXi encryptor in **Rust** and moving ransom-site credentials out of embedded samples and into runtime command-line arguments to reduce analysis and monitoring opportunities.
Aug 15, 2026
Microsoft reported that the **Hive** ransomware operation deployed a heavily reworked variant rewritten from **Go** to **Rust**, introducing a more complex encryption scheme and stealth improvements that initially helped some samples avoid detection. Analysts said the new build was uncovered after unusual `.key` files lacked the victim identifier normally associated with Hive, leading to the discovery of multiple related samples. The malware now requires ransom-site credentials through the command line, decrypts strings at runtime to hinder analysis, and uses updated cryptography built on `Curve25519` ECDH and `XChaCha20-Poly1305`. The updated payload also attempts to maximize impact by stopping security, backup, database, and business application services before launching recovery-disruption commands to remove shadow copies and backups. Microsoft said Hive continued to operate as a **ransomware-as-a-service** threat seen in intrusions affecting sectors including healthcare and software, with activity linked to affiliate **DEV-0237**, now tracked as **Pistachio Tempest**. The company published indicators of compromise, detections, and mitigation guidance to help defenders identify and contain Hive-related attacks.
Aug 15, 2026