IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Microsoft identifies sophisticated Hive ransomware variant written in Rust

The move away from Go and an encryption redesign makes the new strain even more of a threat to business targets

The threat actors behind Hive ransomware have made major changes to the payload in a new variant exposed by Microsoft Threat Intelligence Center (MSTIC).

Most notable among the updates is the migration of the ransomware’s code to a new language, and the employment of a more sophisticated encryption method.

Related Resource

Securing endpoints amid new threats

Ensuring employees have the flexibility and security to work remotely

Whitepaper cover with image of female employee working at home on laptopFree Download

These changes provide the ransomware with better control over low-level resources, a more user-friendly syntax for threat actors and a structure more conducive to efficient encryption.

The new encryption method means certain countermeasures against Hive have become less effective. Instead of embedding an encrypted key in each file that the payload affects, the new variant employs a novel method of encryption that is far harder to remedy.

MSTIC explains that it “generates two sets of keys in memory, uses them to encrypt files, and then encrypts and writes the sets to the root of the drive it encrypts, both with .key extension.”

MSTIC also warns that the new variant does not contain the ‘help’ menu available for attackers in previous versions, which means that although attackers must now memorise parameters themselves, it also makes the task of discovering parameters harder for security researchers.

Hive ransomware was first discovered in June 2021, and since has been used for numerous attacks such as that suffered recently by the Costa Rican healthcare service. Like other ransomware, once deployed its payload works to disable system processes and services that might contain it or allow the victim to prevent it from encrypting key files. 

It also deletes backups to prevent the victim from safely recovering their files, and then produces a ransom note in plain text format. MSTIC credits it with large-scale attacks in the software and healthcare sectors.

Another piece of ransomware coded in Rust, called BlackCat, was flagged by the FBI earlier this year as having breached over 60 organisations worldwide.

Ransomware-as-a-service (RaaS) models, in which threat actors lease ransomware software from malicious developers rather than developing and deploying their own software, are increasingly popular and threatening to businesses.

In the Sophos 2022 Threat Report, the security company asserts that going forward, “the RaaS business model will continue to dominate the threat landscape for ransomware attacks, as this model permits experts in ransomware construction to continue to build and improve their product while giving experts in “initial access” break-ins the ability to focus on this task with increasing intensity.”

Featured Resources

The state of Salesforce: Future of business

Three articles that look forward into the changing state of Salesforce and the future of business

Free Download

The mighty struggle to migrate SAP to the cloud may be over

A simplified and unified approach to delivering Enterprise Transformation in the cloud

Free Download

The business value of the transformative mainframe

Modernising on the mainframe

Free Download

The Total Economic Impact™ Of IBM FlashSystem

Cost savings and business benefits enabled by FlashSystem

Free Download

Recommended

Microsoft blocking Tutanota users from Teams registration, claims fix unfeasible
Business operations

Microsoft blocking Tutanota users from Teams registration, claims fix unfeasible

8 Aug 2022
Ransomware now strikes one in 40 organisations per week, Check Point finds
ransomware

Ransomware now strikes one in 40 organisations per week, Check Point finds

27 Jul 2022
Microsoft wins five-year digital transformation deal with Australia’s largest telco
digital transformation

Microsoft wins five-year digital transformation deal with Australia’s largest telco

26 Jul 2022
Slack Connect vs Microsoft Teams Connect: Better than email?
collaboration

Slack Connect vs Microsoft Teams Connect: Better than email?

20 Jul 2022

Most Popular

Cyber attack on software supplier causes "major outage" across the NHS
cyber attacks

Cyber attack on software supplier causes "major outage" across the NHS

8 Aug 2022
Why convenience is the biggest threat to your security
Sponsored

Why convenience is the biggest threat to your security

8 Aug 2022
Electrical explosion reported at Google's Iowa data centre
data centres

Electrical explosion reported at Google's Iowa data centre

9 Aug 2022