Hive ransomware gang taken down after FBI hacks back

Hospital hit by Hive was forced to turn away patients

Despite its relative youth, the Hive ransomware cartel was firmly established as one of the more prolific and dangerous ransomware-as-a-service (RaaS) operations, operating a subscription-based model whereby it recruited affiliates to do its dirty work while taking a 20% cut of ransom payments for itself.

At one time the most prolific ransomware family observed by incident responders at Google Cloud’s Mandiant, accounting for 15% of intrusions to which it responded last year.

The ransomware locker itself was under active development and was notably entirely rewritten in the Rust programming language in mid-2022, likely in an attempt to hinder analysis and throw researchers and investigators off its trail. Rust is one of a number of multiplatform languages valued by RaaS operators for their flexibility and ability to quickly and easily target both Windows and Linux environments.

Hive was used by multiple actors, according to Mandiant, but one of the most enthusiastic Hive operators was UNC2727, also tracked as Gold Ulrick or Wizard Spider, which was previously known as the Conti ransomware operation that targeted the Irish Health Service Executive in May 2021.

The affiliates accessed their target networks using a number of tried-and-tested methods, often through single factor logins via the remote desktop protocol (RDP) tool, but also using virtual private networks (VPNs) and other remote network connection protocols, exploiting FortiToken vulnerabilities, and phishing emails containing malicious attachments. Hive affiliates are also known to have exploited the ProxyShell vulnerability chain in Microsoft Exchange Server.

The malware used the well-established double extortion technique which not only encrypted victims’ data and rendered it inaccessible, but also stole and published the data on a dark web leak site, causing further distress and embarrassment, and acting as an additional “incentive” for its victims to pay up. It caused major disruption to victims’ operations, in one case attacking a hospital that had to resort to analogue methods to treat existing patients, and was unable to accept new patients in the wake of its attack.

In the UK, the NCA said that Hive affiliates had hit approximately 50 victims, including in the housing, haulage, commercial and education sectors.

Cyber crime market will prove resilient

However, despite the success of the joint operation, experts tend to assess that the ransomware underground will take the disruption of Hive very much in its stride. Indeed, it is possible, even likely, that individuals associated with Hive are already firming up links with other operations – similarities have already been noted between Hive and an emerging ransomware, Play, thought to be behind the December 2022 attack on UK car dealer Arnold Clark.

John Hultquist, head of Mandiant Threat Intelligence, said: “The disruption of the Hive service won’t cause a serious drop in overall ransomware activity but it is a blow to a dangerous group that has endangered lives by attacking the healthcare system.

“Unfortunately, the criminal marketplace at the heart of the ransomware problem ensures a Hive competitor will be standing by to offer a similar service in their absence, but they may think twice before allowing their ransomware to be used to target hospitals.”

He continued: “Actions like this add friction to ransomware operations. Hive may have to regroup, retool, and even rebrand. When arrests aren’t possible, we’ll have to focus on tactical solutions and better defence. Until we can address the Russian safe haven and the resilient cyber crime marketplace, this will have to be our focus.”