Microsoft identifies sophisticated Hive ransomware variant written in Rust

The threat actors behind Hive ransomware have made major changes to the payload in a new variant exposed by Microsoft Threat Intelligence Center (MSTIC).

Most notable among the updates is the migration of the ransomware’s code to a new language, and the employment of a more sophisticated encryption method.

These changes provide the ransomware with better control over low-level resources, a more user-friendly syntax for threat actors and a structure more conducive to efficient encryption.

The new encryption method means certain countermeasures against Hive have become less effective. Instead of embedding an encrypted key in each file that the payload affects, the new variant employs a novel method of encryption that is far harder to remedy.

MSTIC explains that it “generates two sets of keys in memory, uses them to encrypt files, and then encrypts and writes the sets to the root of the drive it encrypts, both with .key extension.”

MSTIC also warns that the new variant does not contain the ‘help’ menu available for attackers in previous versions, which means that although attackers must now memorise parameters themselves, it also makes the task of discovering parameters harder for security researchers.

Hive ransomware was first discovered in June 2021, and since has been used for numerous attacks such as that suffered recently by the Costa Rican healthcare service. Like other ransomware, once deployed its payload works to disable system processes and services that might contain it or allow the victim to prevent it from encrypting key files.

It also deletes backups to prevent the victim from safely recovering their files, and then produces a ransom note in plain text format. MSTIC credits it with large-scale attacks in the software and healthcare sectors.

Another piece of ransomware coded in Rust, called BlackCat, was flagged by the FBI earlier this year as having breached over 60 organisations worldwide.

Ransomware-as-a-service (RaaS) models, in which threat actors lease ransomware software from malicious developers rather than developing and deploying their own software, are increasingly popular and threatening to businesses.

In the Sophos 2022 Threat Report, the security company asserts that going forward, “the RaaS business model will continue to dominate the threat landscape for ransomware attacks, as this model permits experts in ransomware construction to continue to build and improve their product while giving experts in “initial access” break-ins the ability to focus on this task with increasing intensity.”