March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Update – Cisco Suffered A Cyber Attack By The Yanluowang Ransomware Gang – Active IOCs
August 12, 2022
Rewterz Threat Alert – Oski Data Stealer Malware – Active IOCs
August 12, 2022
Rewterz Threat Update – Cisco Suffered A Cyber Attack By The Yanluowang Ransomware Gang – Active IOCs
August 12, 2022
Rewterz Threat Alert – Oski Data Stealer Malware – Active IOCs
August 12, 2022
Severity
High
Analysis Summary
Hive is one of the quickest evolving ransomware families which was first observed in June 2021 and likely operates as an affiliate-based ransomware, employs a wide variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense and mitigation. Hive ransomware uses multiple mechanisms to compromise business networks, including phishing emails with malicious attachments to gain access and Remote Desktop Protocol (RDP) to move laterally once on the network. After compromising a victim network, Hive ransomware actors exfiltrate data and encrypt files on the network. The actors leave a ransom note in each affected directory within a victim’s system, which provides instructions on how to purchase the decryption software. The ransom note also threatens to leak exfiltrated victim data on the Tor site, “HiveLeaks.”
The latest variant introduced by this ransomware is written in Rust languaguage as opposed to the previous variants, which were written in GoLang or Go.
According to researchers:
The new variation employs a unique collection of algorithms, including Elliptic Curve Diffie-Hellmann (ECDH) with Curve25519 and XChaCha20-Poly1305″ (authenticated encryption with ChaCha20 symmetric cipher)
The latest Hive version approaches file encryption in a distinctive manner. It produces two sets of keys in memory, uses them to encrypt files, and then encrypts and writes the sets to the root of the drive it encrypts, with a .key extension.
Impact
- Unauthorized Access
- Data Exfiltration
- File Encryption
Indicators of Compromise
MD5
- 02410903fe74fdc15d702f00652ccd24
- b6ddea4e5a19e3c1224ac1d7ad65ddae
- 2c1f189a36be67d5269deaaf3a6a4b55
SHA-256
- 638cc41ca18feccf21b7ed1b71fe0b0881b592647fd286276dff6a4e48992bfa
- 6920e86a65fc94f9fd46c46c09187b802a13801904e06c6aa63c10e0c9197218
- 693e43e6524610a91f66f692325ff3aead9c426d587c2dcfda7c9c15773f1895
SHA-1
- 937ddea9b59ec8947892e1546cbfa5bbc94c9180
- ac749ddbbefeeb4b156e26693ea89bd394cf78f2
- 0f243e23f08bf0815322f0a055fb54529d038682
Remediation
- Search for IOCs in your environment.
- Block all threat indicators at your respective controls.
- Maintain cyber hygiene by updating your anti-virus software and implement patch management lifecycle.
- Maintain Offline Backups – In a ransomware attack, the adversary will often delete or encrypt backups if they have access to them. That’s why it’s important to keep offline (preferably off-site), encrypted backups of data and test them regularly.
- Emails from unknown senders should always be treated with caution.
- Never trust or open ” links and attachments received from unknown sources/senders.