Article
A Vulnerability Detected in Hive Ransomware Allows Recovering Encrypted Files
A vulnerability has been identified in the encryption algorithm used by the Hive Ransomware software that could allow decryption of encrypted data.
Read more
Ransomware group profile
Hive
Hive was a ransomware as a service operation active from June 2021.
- Disrupted
In short
Hive was a ransomware as a service operation active from June 2021. A joint advisory (AA22-321A) from the FBI, CISA and HHS says it hit over 1,300 companies and received about 100 million US dollars in ransom. The UK National Crime Agency reports its servers were taken offline in an FBI and German-led operation on 26 January 2023.
- StatusDisruptedas reported
- Entry Routes4ways inPhishing with attachments
- Techniques5mapped to MITRE ATT&CKExternal Remote Services · Indicator Removal
- Defences6first steps listedRequire phishing-resistant MFA · Secure and monitor RDP
Overview
Hive was a ransomware service that ran from June 2021 until law enforcement took over its servers on 26 January 2023. A joint advisory (AA22-321A, last revised November 25, 2022) from the FBI, CISA and the Department of Health and Human Services (HHS) says Hive actors had hit over 1,300 companies worldwide and received about 100 million US dollars in ransom payments, according to FBI information.
How the model worked
Hive followed the ransomware as a service (RaaS) model. Developers build and update the malware. Affiliates, who are the people who break into networks, run the attacks. The advisory says how a network was entered depended on which affiliate was involved. The sectors named include government facilities, communications, critical manufacturing, information technology and, especially, healthcare and public health.
How they got in
Hive actors gained access with single factor logins, meaning just a password, on Remote Desktop Protocol (RDP), virtual private networks (VPNs) and similar remote access. In some cases the actors got around multifactor authentication (MFA) on FortiOS servers using CVE-2020-12812, a flaw that let someone skip the second login step by changing the case of the username. They also used phishing emails with malicious attachments and flaws in Microsoft Exchange Server (CVE-2021-31207, CVE-2021-34473 and CVE-2021-34523).
Before the encryption
Hive stopped backup, antivirus and file-copy processes, deleted Windows shadow copies (the built-in restore points) and wiped the System, Security and Application event logs. It switched off Windows Defender in the registry. Data was likely copied out with Rclone, a cloud sync tool, and the Mega.nz storage service. Variants existed for Windows, Linux, VMware ESXi and FreeBSD.
Extortion style
Each affected folder got a note named HOW_TO_DECRYPT.txt with a link to a live chat panel on Tor. Some victims also got calls or emails. Demands were in US dollars, from several thousand to millions, payable in Bitcoin. Victims who refused were threatened with publication on the HiveLeaks site. The advisory says Hive actors have reinfected victims who restored their systems without paying.
The takedown
The UK National Crime Agency (NCA) says servers of Hive were taken offline on 26 January 2023 in an operation led by the FBI and German law enforcement, supported by NCA investigators. Visitors to the Hive sites now see a law-enforcement notice. The NCA says the FBI developed the capability to circumvent Hive encryption. The NCA counts about 50 corporate victims in the UK, in housing, haulage, commercial and education sectors.
- April 2021First identifiedThe NCA says Hive was first identified in April 2021.
- June 2021Attacks counted from hereThe advisory and the NCA both count Hive attacks and ransom payments from June 2021.
- November 2022FBI data cut-offThe advisory reports FBI investigation data as recently as November 2022.
- November 25, 2022Advisory revisedJoint advisory AA22-321A last revised.
- January 26, 2023Servers taken offlineLaw enforcement took Hive servers offline and posted a notice on its sites.
- Active
- June 2021 to January 2023
- Main advisory
- AA22-321A, last revised November 25, 2022
- Victims
- Over 1,300 companies (FBI, November 2022)
- Ransom received
- About 100 million USD
- Platforms
- Windows, Linux, VMware ESXi, FreeBSD
- Leak site
- HiveLeaks
- Payment
- Bitcoin
How they get in
-
01
Single factor RDP and VPN logins
Hive actors used single factor logins on Remote Desktop Protocol, virtual private networks and other remote connection methods.
-
02
FortiOS MFA bypass (CVE-2020-12812)
In some cases actors skipped the second login factor on FortiOS servers by changing the case of the username.
-
03
Microsoft Exchange Server flaws
The advisory lists CVE-2021-31207, CVE-2021-34473 and CVE-2021-34523 as used against Exchange servers.
-
04
Phishing with attachments
Phishing emails with malicious attachments were also used.
How they extort
Double extortion, per the advisory: data is copied out, then systems are encrypted. A note named HOW_TO_DECRYPT.txt links to a live chat panel on Tor. Victims who refuse are threatened with publication on the HiveLeaks site. Demands are in US dollars, paid in Bitcoin. Some victims were also contacted by phone or email.
Who they target
-
01
Government facilities
See the industry page -
02
Communications
See the industry page -
03
Critical manufacturing
See the industry page -
04
Information technology
See the industry page -
05
Healthcare and public health
See the industry page
Techniques
- Technique Data Encrypted for Impact Data Encrypted for Impact is when attackers encrypt files or whole systems so the owner can no longer use them, and then hold back the key. T1486 · Impact
- Technique Exploit Public-Facing Application Exploit Public-Facing Application is when an attacker abuses a weakness in a system that is reachable from the Internet to get into a network. T1190 · Initial Access
- Technique External Remote Services External Remote Services is a technique where an attacker uses a remote access service that faces the internet, such as a VPN or Citrix, to enter a network or to keep access to it. T1133 · Persistence, Initial Access
- Technique Indicator Removal Indicator Removal is a technique where an attacker deletes or changes the traces that their activity leaves behind. T1070 · Stealth
- Technique Phishing (T1566): ATT&CK Technique Phishing is when an attacker sends a message that tricks someone into opening a malicious file, following a link or giving away a password. T1566 · Initial Access
Notable incidents
How to defend
-
Require phishing-resistant MFA
Use it for as many services as possible, especially webmail, VPNs and accounts that manage backups.
-
Secure and monitor RDP
Restrict where RDP can be reached from, require MFA, log attempts, lock accounts after repeated failures and close port 3389 where it is not needed.
-
Patch VPNs and remote access first
Prioritize VPN servers, remote access software, virtual machine software and known exploited vulnerabilities.
-
Keep offline, immutable backups
Maintain offline backups, test restores, and make sure backup data is encrypted, cannot be altered and is not already infected.
-
Turn on PowerShell logging
Enable module logging, script block logging and transcription, and consider an enhanced monitoring tool such as Sysmon.
-
Remove tools you do not need
The advisory says some tools Hive used are legitimate applications, and recommends removing any not needed for day-to-day work.
Questions
What was Hive ransomware?
Hive was a ransomware as a service operation active from June 2021 until January 2023. Developers built the malware and affiliates ran the attacks. The FBI says it hit over 1,300 companies and received about 100 million US dollars in ransom.
How did Hive get into networks?
Per advisory AA22-321A, Hive actors used single factor logins on RDP and VPNs, bypassed MFA on FortiOS with CVE-2020-12812, sent phishing emails with malicious attachments, and exploited Microsoft Exchange Server flaws.
What happened to Hive?
The UK National Crime Agency says Hive servers were taken offline on 26 January 2023 in an operation led by the FBI and German law enforcement. Visitors to the Hive sites now see a law-enforcement notice.
How did Hive extort victims?
Each affected folder got a note named HOW_TO_DECRYPT.txt with a link to a Tor chat panel. Demands were in US dollars, payable in Bitcoin. Victims who refused were threatened with publication on the HiveLeaks site.
How can organizations defend against Hive-style attacks?
The advisory recommends phishing-resistant MFA, secured and monitored RDP, patching VPNs and remote access first, offline immutable backups with tested restores, PowerShell logging, and removing tools you do not need.
In our research
Sources
- #StopRansomware: Hive Ransomware (AA22-321A) CISA, FBI and HHS
- HIVE takedown: NCA in international operation to shut down $100m ransomware threat UK National Crime Agency
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.