Hive Ransomware Gang Rapidly Evolves with Complex Encryption, Rust Code

[upnorth]

Content source

https://www.theregister.com/2022/07/06/hive-ransomware-rust-microsoft/

The Hive group, which has become one of the most prolific ransomware-as-a-service (RaaS) operators, has significantly overhauled its malware, including migrating the code to the Rust programming language and using a more complex file encryption process.

Researchers at the Microsoft Threat Intelligence Center (MSTIC) uncovered the Hive variant while analyzing a change in the group's methods. "With its latest variant carrying several major upgrades, Hive also proves it's one of the fastest evolving ransomware families, exemplifying the continuously changing ransomware ecosystem," the researchers said in a write-up this week.

Hive was first detected in June 2021, with the data-encrypting software being offered to affiliates that pay to use the ransomware in their own campaigns. The number of ransomware infections continues to grow, with Panda Security seeing a 62 percent year-over-year jump in extortionware use in 2021, which accounted for 10 percent of all cyber-attacks. According to third-party risk management firm UpGuard, which has seen similar numbers, a key driver has been the rise of RaaS. Affiliates can earn as much as 80 percent of each ransom payment, according to UpGuard.

Like most of the newer ransomware groups, the Hive operators run double-extortion campaigns: siphoning data, encrypting the files, and telling the victims their stolen information will be leaked if they refuse to pay the ransom. According to Trend Micro, energy companies have been a top target for Hive followed by healthcare facilities, financial services institutions, and the media. Between June and December 2021, the gang compromised 355 enterprises and the group has hit an average of three companies per day since first being detected, the researchers wrote in a report in March. The FBI issued an advisory about the group in August 2021. The Hive gang garnered attention when it hit Costa Rica's national public health services agency in May.

Hive ransomware gang turns to Rust, more complex encryption

RaaS malware devs have been busy bees

www.theregister.com