Netskopeの SASE Summitにご参加ください 、あなたの近くの都市に来てください!今すぐご登録ください

  • セキュリティサービスエッジ製品

    高度なクラウド対応の脅威から保護し、あらゆるベクトルにわたってデータを保護します。

  • Borderless SD-WAN

    すべてのリモートユーザー、デバイス、サイト、クラウドへの安全で高性能なアクセスを自信を持って提供します。

  • プラットフォーム

    世界最大のセキュリティプライベートクラウドでの比類のない可視性とリアルタイムデータおよび脅威保護。

未来のプラットフォームはネツコペです

インテリジェントセキュリティサービスエッジ(SSE)、クラウドアクセスセキュリティブローカー(CASB)、クラウドファイアウォール、次世代セキュアWebゲートウェイ(SWG)、およびZTNAのプライベートアクセスは、単一のソリューションにネイティブに組み込まれており、セキュアアクセスサービスエッジ(SASE)アーキテクチャへの道のりですべてのビジネスを支援します。

製品概要に移動
Netskopeの動画
ボーダレスSD-WAN:ボーダレスエンタープライズの新時代を先導

NetskopeボーダレスSD-WANは、ゼロトラストの原則と保証されたアプリケーションパフォーマンスを統合するアーキテクチャを提供し、すべてのサイト、クラウド、リモートユーザー、およびIoTデバイスに前例のない安全で高性能な接続を提供します。

Read the article
Borderless SD-WAN
Netskope は、データと脅威の保護、および安全なプライベートアクセスを実現するための機能を統合した、最新のクラウドセキュリティスタックを提供します。

プラットフォームを探索する
大都市の俯瞰図
  • 変身

    デジタルトランスフォーメーションを保護します。

  • セキュリティの近代化

    今日と明日のセキュリティの課題に対応します。

  • フレームワーク

    サイバーセキュリティを形作る規制の枠組みを採用する。

  • 業界ソリューション

    Netskopeは、クラウドに安全に移行するためのプロセスを世界最大規模の企業に提供しています。

最小の遅延と高い信頼性を備えた、市場をリードするクラウドセキュリティサービスに移行します。

NewEdgeの詳細
Lighted highway through mountainside switchbacks
アプリケーションのアクセス制御、リアルタイムのユーザーコーチング、クラス最高のデータ保護により、生成型AIアプリケーションを安全に使用できるようにします。

ジェネレーティブ AI の使用を保護する方法を学ぶ
Safely Enable ChatGPT and Generative AI
SSEおよびSASE展開のためのゼロトラストソリューション

Learn about Zero Trust
Boat driving through open sea
Netskopeは、クラウドサービス、アプリ、パブリッククラウドインフラストラクチャを採用するための安全でクラウドスマートかつ迅速な旅を可能にします。

Learn about Industry Solutions
Wind turbines along cliffside
  • 導入企業

    Netskopeは、フォーチュン100の25以上を含む世界中の2,000以上の顧客にサービスを提供しています。

  • カスタマーソリューション

    お客様のため、Netskopeでお客様の成功を確実にすべく、あらゆるステップを共に歩んでまいります。

  • トレーニングと認定

    Netskope training will help you become a cloud security expert.

私たちは、お客様が何にでも備えることができるように支援します

お客様を見る
Woman smiling with glasses looking out window
Netskopeの有能で経験豊富なプロフェッショナルサービスチームは、実装を成功させるための規範的なアプローチを提供します。

Learn about Professional Services
Netskopeプロフェッショナルサービス
Netskopeトレーニングで、デジタルトランスフォーメーションの旅を保護し、クラウド、ウェブ、プライベートアプリケーションを最大限に活用してください。

Learn about Training and Certifications
Group of young professionals working
  • リソース

    クラウドへ安全に移行する上でNetskopeがどのように役立つかについての詳細は、以下をご覧ください。

  • ブログ

    Netskopeがセキュリティサービスエッジ(SSE)を通じてセキュリティとネットワークの変革を可能にする方法を学びましょう。

  • イベント&ワークショップ

    最新のセキュリティトレンドを先取りし、仲間とつながりましょう。

  • 定義されたセキュリティ

    サイバーセキュリティ百科事典で知っておくべきことすべて。

セキュリティビジョナリーポッドキャスト

ボーナスエピソード2:SSEのマジッククアドラントとSASEを正しく取得する
MikeとSteveが、ガートナー®社のマジック・クアドラント™のセキュリティ・サービス・エッジ(SSE)、Netskopeの位置づけ、現在の経済情勢がSASEの取り組みに与える影響について語ります。

ポッドキャストを再生する
ボーナスエピソード2:SSEのマジッククアドラントとSASEを正しく取得する
最新のブログ

Netskopeがセキュリティサービスエッジ(SSE)機能を通じてゼロトラストとSASEの旅を可能にする方法。

ブログを読む
Sunrise and cloudy sky
ネツコペAWSイマージョンデイワールドツアー2023

Netskopeは、Netskope製品の使用とデプロイについてAWSのお客様を教育および支援するために、さまざまなハンズオンラボ、ワークショップ、詳細なウェビナー、およびデモを開発しました。

Learn about AWS Immersion Day
AWS パートナー
セキュリティサービスエッジとは何ですか?

SASEのセキュリティ面、ネットワークとクラウドでの保護の未来を探ります。

Learn about Security Service Edge
Four-way roundabout
  • 会社概要

    クラウド、データ、ネットワークセキュリティの課題の先取りをサポート

  • ネットスコープが選ばれる理由

    クラウドの変革とどこからでも機能することで、セキュリティの機能方法が変わりました。

  • リーダーシップ

    ネットスコープの経営陣はお客様を成功に導くために全力を尽くしています。

  • パートナー

    私たちはセキュリティリーダーと提携して、クラウドへの旅を保護します。

データセキュリティによる持続可能性のサポート

Netskope は、持続可能性における民間企業の役割についての認識を高めることを目的としたイニシアチブであるビジョン2045に参加できることを誇りに思っています。

詳しくはこちら
Supporting Sustainability Through Data Security
Highest in Execution. Furthest in Vision.

ネットスコープは2023年Gartner®社のセキュリティ・サービス・エッジ(SSE)のマジック・クアドラント™でリーダーの1社として評価されました。

レポートを読む
ネットスコープは2023年Gartner®社のセキュリティ・サービス・エッジ(SSE)のマジック・クアドラント™でリーダーの1社として評価されました。
思想家、建築家、夢想家、革新者。 一緒に、私たちはお客様がデータと人々を保護するのを助けるために最先端のクラウドセキュリティソリューションを提供します。

当社のチーム紹介
Group of hikers scaling a snowy mountain
Netskopeのパートナー中心の市場開拓戦略により、パートナーは企業のセキュリティを変革しながら、成長と収益性を最大化できます。

Learn about Netskope Partners
Group of diverse young professionals smiling

Hive Ransomware: Actively Targeting Hospitals

Sep 10 2021

Summary

Most ransomware groups operating in the RaaS (Ransomware-as-a-Service) model have an internal code of ethics that includes avoiding breaching some specific sectors, such as hospitals or critical infrastructure, thus avoiding great harm to society and consequently drawing less attention from law enforcement. For example, the BlackMatter ransomware states they are not willing to attack hospitals, critical infrastructure, defense industry, non-profit companies, and oil and gas industry targets, having learned from the mistakes of other groups, such as DarkSide, who shut down its operations after the Colonial Pipeline attack.

However, this code of ethics is not always adopted by attackers, as is the case with Hive, a new family of ransomware discovered in June 2021. On August 15, 2021, Hive ransomware was responsible for an attack against the Memorial Health System, a non-profit integrated health system with three hospitals in Ohio and West Virginia (Marietta Memorial Hospital, Selby General Hospital, and Sistersville General Hospital), causing radiology exams and surgical cases to be canceled. According to the FBI, the group uses phishing emails with malicious attachments to gain access into networks, allowing the attackers to move laterally over the network to steal data and infect more machines.

HiveLeaks

In addition to encrypting files, Hive also steals sensitive data from networks, threatening to publish everything in their HiveLeak website, hosted on the deep web, which is a common practice among ransomware working in this double extortion scheme.

There are two websites maintained by the group, the first one is protected by username and password, accessible only by the victims who obtain the credentials in the ransom note.

Figure 01. Hive ransomware private website

Once authenticated, the victim can see:

  1. The name of the infected organization;
  2. A live chat, where the victim can interact with the attackers;
  3. A file upload system, where the victim can send files to the attackers;
  4. A link to Hive’s decryption software, if the ransom is paid by the victims.
Figure 02. Victim’s private website by Hive ransomware

The second website, “HiveLeaks,” is where the attackers publish data about their targets and is publicly accessible.

Figure 03. “HiveLeaks” logo.

For each target, you can see the name, a small description, the website, the revenue, and the number of employees at the company. Also, you can see two dates, when the files were encrypted and when the attack was made public. Curiously enough, there are also two social media buttons where you can share this information.

Figure 04. Information about the infected company on the “HiveLeaks” website.

If any data is published by the attackers, you will also find a link where the files can be downloaded. Hive uses common file-sharing services for this purpose, such as PrivatLab, AnonFiles, MEGA, UFile, SendSpace, and Exploit.in, as shown in Figure 05.

Figure 05. Links to download stolen data by Hive.

Memorial Health System Attack

The Hive ransomware infected the Memorial Health System (MHS) on August 15, 2021. The attackers claim to have stolen patient data including names, social security numbers, dates of birth, addresses and phone numbers, and medical histories for 200,000 patients, and an additional 1.2 TB of other data.

MHS tried to appeal to the attackers to provide the decrypter for free but ultimately ended up paying 1.8M, divided equally into two Bitcoin wallets. The attackers moved the Bitcoins to another wallet just a few minutes after the transaction was made by MHS.

Aside from the decryptor, the attackers also promise a security report, a file tree describing all stolen data, and the logs proving that they had erased everything from their servers.

Analysis

The ransomware was written in Go, an open-source programming language that allows cross-compilation, meaning that the same source code can be compiled to different OS, such as Linux, Windows, and macOS.

Although we have only seen Windows versions in the wild at this point, we have strong indications that the group is able to infect other systems such as Linux, as well as the Hypervisor ESXi, as we will demonstrate later in the analysis.

We have analyzed two different samples, being 32 and 64-bit Windows versions of the malware. Both of them are packed with UPX, which is an open-source executable packer.

Figure 06. Main Hive ransomware payload, packed with UPX.

The first thing we noticed is that both samples we analyzed had a command line interface (CLI), accepting parameters and also showing log messages throughout the malware execution.

The 64-bit sample accepts two parameters:

  • kill: Kill processes specified as value (case insensitive regex)
  • stop: Stop services specified as value (case insensitive regex)
Figure 07. Parameters accepted by the 64-bit sample of Hive.

On the other hand, the 32-bit sample offers three more options:

  • kill: Kill processes specified as value (case insensitive regex)
  • no-clean: Do not clean disk space (described later in this analysis)
  • skip: Files that the attacker doesn’t want to encrypt (case insensitive regex)
  • skip-before: Skips files created before the specified date.

stop: Stop services specified as value (case insensitive regex)

Figure 08. Parameters accepted by the 32-bit sample of Hive.

Aside from the parameters above, the attacker can also specify the path containing the files that need to be encrypted. If this path isn’t specified, the ransomware will list all the files in the machine, skipping the ones specified in the “-skip” and “-skip-before” parameters.

For analysis purposes, we have created a folder named “C:\to_encrypt”, containing three different pictures. Once executed, the ransomware starts printing out log messages throughout the whole encryption process.

Figure 09. 32-bit Hive ransomware execution.

The log messages show pretty much everything the malware is doing, however, let’s take a look at each one of the aspects being printed out.

Analyzing this 32-bit sample closely, we can see some of the function names parsed by the disassembler, from a package the attackers named as “google.com”, perhaps as an attempt to deceive the analyst.

Figure 10. 32-bit Hive function names.

First, the malware calls a function encryptor.NewApp().

Figure 11. “NewApp” Hive function.

Simply put, this function initializes some important data used by the ransomware, such as the primary key.

Figure 12. “NewApp” function flow.

The function keys.NewPrimaryKey() generates a 10 MB random key used in the encryption process.

Figure 13. 10 MB key generated by Hive.

Once the key is generated, the ransom note and a batch script are loaded into memory, which will be eventually saved to the disk during the process.

After this setup is completed, the ransomware calls a function named App.Run(), which starts the flow we saw in the log messages.

Figure 14. Hive “Run” function.

The first function called inside App.Run() is App.ExportKey().

Figure 15. “ExportKey” function.

This function is responsible for encrypting the 10 MB key generated by keys.NewPrimaryKey().

Figure 16. Main flow of “ExportKey” function.

Hive contains 100 public RSA keys embedded in the binary, which are used to encrypt the key generated previously. They are all parsed through the function ParsePKCS1PublicKey from the pkcs1.go library.

Figure 17. Hive ransomware loading public RSA keys.

The malware then encrypts the data using the EncryptOAEP function from the rsa.go library.

Figure 18. Hive encrypting the key using RSA.

The encrypted key is then saved into a file that ends with “.key.hive” extension (or “key.<random>” for the 64-bit version). This is the file that is eventually loaded by the decryptor to retrieve the encryption key used in the process.

Figure 19. Key file saved by Hive during the process.

After creating the encrypted key, the malware calls two functions named App.KillProcesses() and App.StopServices().


Figure 20. Hive functions to kill processes and stop services.

The name of these functions are self-explanatory, and the full list of default values for stopped processes and services can be found in our GitHub repository.

Next, Hive executes the functions App.RemoveItself() and App.RemoveShadowCopies().

Figure 21. Next two functions executed by the “Run”.

The first one is responsible for creating a batch script that was loaded into memory by the function encryptor.NewApp(). The purpose of this script is to delete the ransomware payload once this process is done.

Figure 27. Batch script created by Hive to delete the payload from disk
Figure 22. Batch script created by Hive to delete the payload from disk

The second function creates another batch script in disk that is responsible for deleting Windows Shadow Copies, to prevent any file restoration.

Figure 23. “shadow.bat” script created by the 32-bit Hive.

Here, we have a big difference between the two samples we have analyzed. Instead of creating a batch script, the 64-bit version we found uses several commands to delete not only the Windows Shadow Copies, but also to stop services, including Windows Defender.

Figure 24. Commands executed by the 64-bit Hive sample we analyzed.

The full list of commands executed by the 64-bit version can be found in our GitHub repository.

Next in the flow, we have two important functions:

Figure 30. “ScanFiles” and “EncryptFiles” functions of Hive.

App.ScanFiles() is responsible for fetching all the files that will be encrypted by the ransomware. Also, this function creates the ransom note in disk, which was already loaded in memory previously.

App.EncryptFiles() does exactly what the name describes. Within that function, the code is calling another two, respectively encryptFilesGroup() and EncryptFile(), loading the contents of the targeted file in memory, encrypting the data with what seems to be a custom algorithm created by Hive developers. Then, the encrypted file is written into disk, using the extension “.hive”.

Figure 26. Files encrypted by Hive ransomware.

Following the file encryption, we have another two functions executed by App.Run().

Figure 27. “EraseKey” and “Notify” functions.

The function App.EraseKey() accesses the memory location where the 10 MB primary key was stored by Hive and replaces all its bytes with random data.

Figure 28. Before and after the “EraseKey” function

App.Notify() creates the ransom note in disk, which is redundant since this file is also created by the function App.ScanFiles().

Last but not least, we have a curious function executed by the ransomware if the flag “-no-clean” wasn’t specified, named App.CleanSpace().

Figure 29. “CleanSpace” function.

Simply put, if executed, this code creates several files with 1GB+ each until the disk is full. Then, these newly created files are deleted.

Figure 30. Files created by the “CleanSpace” function.

Since Hive deletes files that have been encrypted, this process is likely performed to overwrite any bytes on disk that could potentially be restored to their original state, creating new files to replace deleted ones.

Figure 31. Disk space while the “CleanSpace” function is being executed.

Different from other ransomware families, Hive doesn’t change the user background, the only message available to the victim is the ransom note.

Figure 32. Hive ransom note.

According to the note, if the user deletes the file that has the “.key” extension, the data will be undecryptable, which leads us to the next part of this blog.

Decryptor

Hive provides decryptors for ESXi, Linux, and Windows (32 / 64-bit).

Figure 33. Hive ransomware decryptors for MHS.

Although we only found Windows versions of Hive in the wild, this is a strong indication that they have payloads for other systems, aligning with the fact that the whole code was built in Go language, which is multi-platform.

When it comes to the decryption process, the file first loads the encrypted key from disk, which is why the ransom note states that you can’t delete this file.

Figure 34. Hive decryption process

Once the key is loaded and decrypted, Hive scans all directories searching for encrypted files, and then proceeds with the decryption process.

Conclusion

Hive is yet another ransomware group that is likely operating in the RaaS model. However, the process used to encrypt the files is quite unusual. 

Usually, the encryption process implemented by ransomware in the wild is to generate a unique symmetric key for each file, that is eventually encrypted and stored along with the encrypted data, so it can be recovered later. Instead, Hive creates a unique key that is eventually encrypted and written into disk, making the decryption process irreversible if this file is deleted by accident. Furthermore, this ransomware contains functionalities that make the execution slow, such as “wiping” the disk until it’s full to avoid file restoration.

Regardless of these points, we consider Hive a dangerous threat, as it’s already causing damage to people and organizations, combined with the fact that the threat is multi-platform.

Protection

Netskope Threat Labs is actively monitoring this campaign and has ensured coverage for all known threat indicators and payloads. 

  • Netskope Threat Protection
    • Gen:Variant.Ransom.Hive.2
    • Trojan.GenericKD.37237769
  • Netskope Advanced Threat Protection provides proactive coverage against this threat.
    • Gen.Malware.Detect.By.StHeur indicates a sample that was detected using static analysis
    • Gen.Malware.Detect.By.Sandbox indicates a sample that was detected by our cloud sandbox

IOCs

SHA256

hive_x861e21c8e27a97de1796ca47a9613477cf7aec335a783469c5ca3a09d4f07db0ff
hive_x64321d0c4f1bbb44c53cd02186107a18b7a44c840a9a5f0a78bdac06868136b72c

A full list of IOCs is available in our Git repo.

author image
Gustavo Palazolo
Gustavo Palazolo is an expert in malware analysis, reverse engineering and security research, working many years in projects related to electronic fraud protection. He is currently working on the Netskope Research Team, discovering and analyzing new malware threats.