{"id":117287,"date":"2022-07-05T09:00:00","date_gmt":"2022-07-05T16:00:00","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?p=117287"},"modified":"2023-10-13T07:31:57","modified_gmt":"2023-10-13T14:31:57","slug":"hive-ransomware-gets-upgrades-in-rust","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2022\/07\/05\/hive-ransomware-gets-upgrades-in-rust\/","title":{"rendered":"Hive ransomware gets upgrades in Rust"},"content":{"rendered":"\n
\n

April 2023 update<\/strong> \u2013 Microsoft Threat Intelligence has shifted to a new threat actor naming taxonomy aligned around the theme of weather. DEV-0237 <\/strong>is now tracked as Pistachio Tempest<\/strong>.<\/p>\n\n\n\n

To learn about how the new taxonomy represents the origin, unique traits, and impact of threat actors, and to get a complete mapping of threat actor names, read this blog: Microsoft shifts to a new threat actor naming taxonomy<\/strong><\/a>.<\/p>\n<\/blockquote>\n\n\n\n

Hive ransomware is only about one year old, having been first observed in June 2021, but it has grown into one of the most prevalent ransomware payloads in the ransomware as a service (RaaS)<\/a> ecosystem. With its latest variant carrying several major upgrades, Hive also proves it\u2019s one of the fastest evolving ransomware families, exemplifying the continuously changing ransomware ecosystem.<\/p>\n\n\n\n

The upgrades in the latest variant are effectively an overhaul: the most notable changes include a full code migration to another programming language and the use of a more complex encryption method. The impact of these updates is far-reaching, considering that Hive is a RaaS payload that Microsoft has observed in attacks against organizations in the healthcare and software industries by large ransomware affiliates like DEV-0237<\/a>.<\/p>\n\n\n\n

Microsoft Threat Intelligence Center (MSTIC) discovered the new variant while analyzing detected Hive ransomware techniques for dropping .key<\/em> files. We know that Hive drops its encryption keys file, which contains encrypted keys used to decrypt encrypted files, and uses a consistent naming pattern:<\/p>\n\n\n\n

[KEY_NAME].key.[VICTIM_IDENTIFIER] \n(e.g., BiKtPupMjgyESaene0Ge5d0231uiKq1PFMFUEBNhAYv_.key.ab123)<\/pre>\n\n\n\n
The said .key<\/em> files were missing the [VICTIM_IDENTIFIER] part of the file name, prompting deeper analysis of the Hive ransomware that dropped them. This analysis led to the discovery of the new Hive variant and its multiple versions, which exhibit slightly different available parameters in the command line and the executed processes.<\/p>\n\n\n\n
Analyzing these patterns in samples of the new variants, we discovered even more samples, all with a low detection rate and none being correctly identified as Hive. In this blog we will share our in-depth analysis of the new Hive variant, including its main features and upgrades, with the aim of equipping analysts and defenders with information to better identify and protect organizations against malware attacks relying on Hive.<\/p>\n\n\n\n
Analysis and key findings<\/h2>\n\n\n\n
The switch from GoLang to Rust<\/h3>\n\n\n\n
The main difference between the new Hive variant and old ones is the programming language used. The old variants were written in Go (also referred to as GoLang), while the new Hive variant is written in Rust.<\/p>\n\n\n\n
Hive isn\u2019t the first ransomware written in Rust\u2014BlackCat, another prevalent ransomware, was the first. By switching the underlying code to Rust, Hive benefits from the following advantages that Rust has over other programming languages:<\/p>\n\n\n\n