Microsoft identifies sophisticated Hive ransomware variant written in Rust

An abstract image showing a person trying to connect to a computer which has a large padlock attached to it, as a ghost wearing a fedora floats menacingly out of it and demands money
(Image credit: Shutterstock)

The threat actors behind Hive ransomware have made major changes to the payload in a new variant exposed by Microsoft Threat Intelligence Center (MSTIC).

Most notable among the updates is the migration of the ransomware’s code to a new language, and the employment of a more sophisticated encryption method.


Securing endpoints amid new threats

Ensuring employees have the flexibility and security to work remotely


These changes provide the ransomware with better control over low-level resources, a more user-friendly syntax for threat actors and a structure more conducive to efficient encryption.

The new encryption method means certain countermeasures against Hive have become less effective. Instead of embedding an encrypted key in each file that the payload affects, the new variant employs a novel method of encryption that is far harder to remedy.

MSTIC explains that it “generates two sets of keys in memory, uses them to encrypt files, and then encrypts and writes the sets to the root of the drive it encrypts, both with .key extension.”

MSTIC also warns that the new variant does not contain the ‘help’ menu available for attackers in previous versions, which means that although attackers must now memorise parameters themselves, it also makes the task of discovering parameters harder for security researchers.

Hive ransomware was first discovered in June 2021, and since has been used for numerous attacks such as that suffered recently by the Costa Rican healthcare service. Like other ransomware, once deployed its payload works to disable system processes and services that might contain it or allow the victim to prevent it from encrypting key files.

It also deletes backups to prevent the victim from safely recovering their files, and then produces a ransom note in plain text format. MSTIC credits it with large-scale attacks in the software and healthcare sectors.

Another piece of ransomware coded in Rust, called BlackCat, was flagged by the FBI earlier this year as having breached over 60 organisations worldwide.

Ransomware-as-a-service (RaaS) models, in which threat actors lease ransomware software from malicious developers rather than developing and deploying their own software, are increasingly popular and threatening to businesses.

In the Sophos 2022 Threat Report, the security company asserts that going forward, “the RaaS business model will continue to dominate the threat landscape for ransomware attacks, as this model permits experts in ransomware construction to continue to build and improve their product while giving experts in “initial access” break-ins the ability to focus on this task with increasing intensity.”

Rory Bathgate
Features and Multimedia Editor

Rory Bathgate is Features and Multimedia Editor at ITPro, overseeing all in-depth content and case studies. He can also be found co-hosting the ITPro Podcast with Jane McCallion, swapping a keyboard for a microphone to discuss the latest learnings with thought leaders from across the tech sector.

In his free time, Rory enjoys photography, video editing, and good science fiction. After graduating from the University of Kent with a BA in English and American Literature, Rory undertook an MA in Eighteenth-Century Studies at King’s College London. He joined ITPro in 2022 as a graduate, following four years in student journalism. You can contact Rory at or on LinkedIn.