Hive Ransomware is a ransomware-as-a-service operation first observed in June 2021. Researchers found a flaw in its encryption algorithm. They recovered 95% of the master key without the attacker’s RSA private key and decrypted infected data. This post explains the flaw, how Hive operators attack and how to reduce the risk.
What is Hive Ransomware?
A vulnerability has been identified in the encryption algorithm used by the Hive Ransomware software that could allow decryption of encrypted data. Hive Ransomware operations have been active since June 2021 and use the Ransomware Software as a Service (RaaS) model. Hive operators demand ransom by threatening targets to publish the intercepted data on leak sites (HiveLeaks).
How does the Hive encryption flaw let files be decrypted?
The vulnerability detected in the encryption algorithm used by the Hive Ransomware software allows data to be decrypted without knowing the private key used by the group to encrypt the files. In this way, 95% of the master key used by Hive operators to generate the file encryption key was recovered, and encrypted files were decrypted.
How do Hive operators attack, and how can you protect yourself?
In August 2021, the FBI released a report containing technical details on Hive Ransomware operations. Hive operators use various attack methods, including malicious spam campaigns, vulnerable RDP servers, and compromised VPN credentials. To not affect by possible Ransomware attacks, it is recommended not to interact with e-mails and links from unknown parties, use reliable security solutions, Restrict RDP accesses, download files or applications over known/trusted connections and sources.
Our incident page on the 2021 Newfoundland and Labrador health system attack describes a case in which an official investigation found the ransomware was Hive.