Hive Ransomware Now Touched Linux and BSD
Share this:
The Hive ransomware gang now also encrypts Linux and FreeBSD using new malware variants specifically developed to target these platforms.
The Linux variant also proved to be quite buggy during ESET’s analysis, with the encryption completely failing when the malware was executed with an explicit path.
It also comes with support for a single command line parameter (-no-wipe). In contrast, Hive’s Windows ransomware comes with up to 5 execution options, including killing processes and skipping disk cleaning, uninteresting files, and older files.
The ransomware’s Linux version also fails to trigger the encryption if executed without root privileges because it attempts to drop the ransom note on compromised devices’ root file systems.
Just like the Windows version, these variants are written in Golang, but the strings, package names and function names have been obfuscated, likely with obfuscate.
Hive, a ransomware group active since at least June 2021, has already hit over 30 organizations, counting only victims who refused to pay the ransom.
They’re just one of many ransomware gangs that have begun targeting Linux servers after their enterprise targets have slowly migrated to virtual machines for easier device management and more efficient use of resources.
By targeting virtual machines, ransomware operators can also encrypt multiple servers at once with a single command. Ransomware groups, such as Babuk, RansomExx/Defray, Mespinoza, GoGoogle, DarkSide, and Hellokitty have also created their own Linux encryptors.
Indicators of Compromise
- 321d0c4f1bbb44c53cd02186107a18b7a44c840a9a5f0a78bdac06868136b72c
- 1e21c8e27a97de1796ca47a9613477cf7aec335a783469c5ca3a09d4f07db0ff
- 3a402af7a583471187bf9fc7872560aaacf5e3d8c99ca5404c3f157c06fba454
- b214c1bbcc7b0c2a4a47134d6009594a4d30bd7d5e363a41603de6b5b8de18ca
