Hive (also known as the Hive ransomware group) was a ransomware as a service (RaaS) operation carried out by the eponymous cybercrime organization between June 2021 and January 2023. The group's purpose was to attack mainly public institutions to subsequently demand ransom for release of hijacked data. In January 2023, following a joint US–German investigation involving 13 law enforcement agencies, the United States announced that the FBI had "hacked the hackers" over several months, resulting in seizure of the Hive ransomware group's servers, effectively shuttering the criminal enterprise. The Hive ransomware group had extorted over $100 million from about 1,500 victims in more than 80 countries when dismantled by law enforcement. The investigation continued, with the US State Department adding a $US10 million bounty for information linking Hive ransomware to any foreign government.
Method of operation Hive employed a wide variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense and mitigation. According to the Federal Bureau of Investigation (FBI), it functioned as affiliate-based ransomware, using multiple mechanisms to compromise business networks, including phishing emails with malicious attachments to gain access, and Remote Desktop Protocol (RDP) once a network was infiltrated. Using locker malware and operating as a RaaS platform, Hive used Double Extortion techniques, in which operators install locker malware to take the data of a victim entity, then encrypt it so that it becomes useless to the victims for conducting business. Group operators then threaten to publish the stolen data on its dark web Tor site – HiveLeaks – unless the ransom is paid. The group has also used "triple extortion" tactics, seeking to extort money from anyone affected by a data disclosure of the victim organization's data. The Hive mainly targets energy, healthcare, financial, media, and education sectors, and became notorious for attacking and crippling critical infrastructure. According to cybersecurity firm Paloaltonetworks in late 2022, the ransomware drops two batch scripts: hive.bat, which tries to delete itself, then shadow.bat, which deletes any shadow copies of the system. It then adds a .hive extension to encrypted files, along with its ransom note, entitled "HOW_TO_DECRYPT.txt", which lists instructions for preventing data loss. A generated login credential is included to instigate online communications between the victim and Hive hackers, labelled as its "sales department". A Tor link directs the victim to a login page submit the provided credentials, which opens a chat room.
History
Emergence and growing profile Hive ransomware first became apparent in June 2021. Two months later, ZDNet reported that Hive had attacked at least 28 healthcare organizations in the United States, including clinics and hospitals across Ohio and West Virginia. In August 2021, the FBI released urgent updates warning of the risks from Hive ransomware, as did INCIBE in Spain, the following January. Also in August 2021, the FBI released a flash alert on the Hive ransomware attacks that includes technical details and indicators of compromise associated with the operations of the gang. In December 2021, Group-IB Threat Intelligence analysts determined that the Hive ransomware group communicated in Russian, though without information regarding its operational location, and that, as of October 16, 2021, at least 355 companies had been victims of Hive ransomware during the previous six months, the majority being in the United States, with ransom obtained from over 100 victims undertaking to regain control of digital infrastructures. Hive's administrator panel showed that its affiliates had breached more than 350 organizations over four months with an average of three companies attacked every day since Hive operations were revealed in late June. Chainalysis ranked Hive eighth on the list of highest ransomware revenue in February 2022. In July 2022, Malwarebytes ranked Hive as the third-most active ransomware group, noting that the group was evolving and that Microsoft had issued a warning stating that HIVE had upgraded the malware to the Rust programming language, upgrading to a more complex encryption method.
Conti links
According to Advanced Intelligent Systems expert Yelisey Boguslavskiy and BleepingComputer, Hive had links to Conti ransomware group since at least November 2021, with some Hive members working for both groups. According to Boguslavskiy, Hive was actively using the initial attack access provided by Conti. In May 2022, BleepingComputer reported that Conti had partnered with Hive and several other well-known ransomware gangs, including HelloKitty, AvosLocker, BlackCat and BlackByte, with some of the Conti hackers migrating to these organizations, including Hive, though the rival group has denied having any connection with Conti despite which, once the process of closing operations began and its hackers reached Hive, it then began to employ the tactic of publishing leaked data on the deep web, just as Conti had. Later in May, Conti announced that they would begin a shutdown process, days after the DOJ announced two indictments of an active Conti operator and Russian national on May 16, 2022, then partnered with Hive to attack the Costa Rica public health service and Costa Rican Social Security Fund (CCSS) the following week. Unlike the Conti Group, Hive was not associated with direct support for the Russian invasion of Ukraine, even though the ransom payment to Hive is likely to be received by the same people within Conti who claimed the group's collective alignment with the Russian government. Boguslavskiy then told BleepingComputer that evidence of HIVE actively via both the initial attack accesses secured from Conti, and via the services of Conti's pen-testers.
… excerpt ends here. Continue reading the full article.
