Loading...

FBI Warns of New Hive Ransomware Threat

August 27, 2021 by Reece Nations
FBI Warns of New Hive Ransomware Threat
The. J. Edgar Hoover FBI Building in Washington, D.C.. (Photo by Dan McCue)

WASHINGTON — The Federal Bureau of Investigation distributed a Flash report on Friday warning of indicators of compromise from the Hive ransomware known to have infiltrated business networks.

The ransomware utilizes multiple mechanisms as attachments to gain access and “Remote Desktop Protocol” to operate once embedded, according to the FBI. Remote agents can then exfiltrate data and encrypt files on the network before leaving a ransom note within a victim’s system.

Victims can be targeted through phishing emails with malicious attachments. Hive’s ransom notes direct victims to purchase decryption software while threatening to leak exfiltrated data on the Tor web browser site known as “HiveLeaks.”

Hive ransomware can locate computer processes related to backups, anti-virus and anti-spyware, and file copying and eliminate them to enable unauthorized file encryption. During the process, encrypted files are renamed with the double final extension of “.key.hive” or “.key.” while a file named “HOW_TO_DECRYPT.txt” is deposited into the affected directories. The ransom explicitly maintains the “key.” file cannot be modified, renamed, or deleted, or else the encrypted files cannot be recovered.

Hive actors institute deadlines for payment between two to six days, but have prolonged deadlines when contacted by victim companies. Some victims claimed they received phone calls from Hive actors requesting payment for their stolen data.

If an entity discovers a ransomware attack, The FBI and the Cybersecurity and Infrastructure Security Agency recommend they isolate infected systems from all other networks, turn off other computers and devices, and secure their backup data. Ransomware victims should contact their local FBI field office for further assistance.

In cooperation with the investigation, the FBI may request certain network information from victims, such as a RAM capture, images of the infected systems, Bitcoin wallets used by the attackers, Bitcoin wallets used to pay the ransom, and the email addresses of the attackers. In the report, the FBI warns against paying a ransom to criminal actors as it may “embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities.” 

In The News

Health

Voting

Cybercrime

July 28, 2022
by Dan McCue
$10M Award Offered for Info on Foreign Interference in US Elections

WASHINGTON — The State Department is offering a reward of up to $10 million for information on foreign interference in... Read More

WASHINGTON — The State Department is offering a reward of up to $10 million for information on foreign interference in U.S. elections.  The effort, which is being administered by the department’s Rewards for Justice program, is seeking information leading to the identification or location of any... Read More

May 18, 2022
by Dan McCue
Federal Agencies Told to Act Quickly to Turn Back Cyberthreat

WASHINGTON — The entity charged with protecting federal agencies from bad cyber actors issued a rare emergency directive Thursday, warning... Read More

WASHINGTON — The entity charged with protecting federal agencies from bad cyber actors issued a rare emergency directive Thursday, warning they should quickly take steps to protect themselves from vulnerabilities found in VMware. VMware is a cloud computing and virtualization technology company headquartered in Palo Alto,... Read More

May 6, 2022
by Madeline Hughes
Cybercrime Tracking Bill Signed Into Law

WASHINGTON — The Department of Justice can now get a handle on the number of cybercrimes happening in the U.S.... Read More

WASHINGTON — The Department of Justice can now get a handle on the number of cybercrimes happening in the U.S. after President Joe Biden signed a bill into law Thursday granting the department the ability to track crimes that have become increasingly prevalent in recent years.... Read More

May 4, 2022
by Tom Ramstack
Russian Cyberthreats Create Alarms at Senate Homeland Security Hearing

WASHINGTON — Lawmakers at a Senate hearing renewed warnings Wednesday that Russian cyberattacks remain a serious threat as the United... Read More

WASHINGTON — Lawmakers at a Senate hearing renewed warnings Wednesday that Russian cyberattacks remain a serious threat as the United States and allies continue their support for Ukraine. In the latest move, the European Union announced Tuesday it would end all oil imports from Russia in... Read More

April 26, 2022
by Tom Ramstack
FBI Warns of Ransomware Attackers Using Sophisticated Program

WASHINGTON — The FBI is warning that computer hackers most likely based in Russia have compromised at least 60 organizations... Read More

WASHINGTON — The FBI is warning that computer hackers most likely based in Russia have compromised at least 60 organizations since last month with a new generation of a sophisticated programming language.  The targets of the ransomware attacks have included a Swiss airport management company and... Read More

April 22, 2022
by Tom Ramstack
FBI Warns Farmers to Beware Ransomware Cyberattacks

WASHINGTON — The FBI issued a warning this week to farm cooperatives that ransomware attackers are increasingly trying to disrupt... Read More

WASHINGTON — The FBI issued a warning this week to farm cooperatives that ransomware attackers are increasingly trying to disrupt their operations during the planting and harvest seasons. The FBI announcement was one of several warnings about cyberattacks that are becoming more shrill as Russia continues... Read More

News From The Well