One of the most dastardly ransomware strains has received a Rust-flavored upgrade

Ransomware
Image Credit: Shutterstock (Image credit: Shutterstock)

One of the most destructive ransomware-as-a-service tools, Hive, has received a major overhaul, making it more resilient to antivirus programs and other security solutions.

These are the findings of a team of researchers at the Microsoft Threat Intelligence Center (MSTIC), who recently did a deep dive into a new Hive variant.

“Hive ransomware is only about one year old, having been first observed in June 2021, but it has grown into one of the most prevalent ransomware payloads in the ransomware-as-a-service (RaaS) ecosystem,” Microsoft said in its report.

Far-reaching impact

The biggest change is the full code migration from Go (also known as GoLang) to Rust. The impact of these updates is “far-reaching”, Microsoft says.

Among other things, Rust offers deep control over low-level resources, has a user-friendly syntax, has several mechanisms for concurrency and parallelism, good variety of cryptographic libraries, and is relatively more difficult to reverse-engineer. 

The new variant also uses string encryption, making it somewhat harder to detect, and the underlying algorithms have changed too. The Rust version of Hive uses Elliptic Curve Diffie-Hellmann (ECDH), with Curve25519 and XChaCha20-Poly1305 (authenticated encryption with ChaCha20 symmetric cipher).

As for file encryption, it now generates two sets of keys in memory (as opposed to embedding an encrypted key in each encrypted file), and uses both to encrypt files on the target endpoint. It then encrypts and writes the sets to the root of the encrypted drive, both with .key extensions.

To top it off, the operators changed the ransom message that follows up to the attack. The new version now references the .key files with their new file name convention, and warns victims not to delete or reinstall VMs, as there will be “nothing to decrypt”.

Hive isn’t the first ransomware to migrate to Rust, but it might be the first to signal a trend. Before Hive, it was BlackCat, another successful ransomware, that made the jump.

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
Code Skull
This dangerous new ransomware is hitting Windows, ARM, ESXi systems
ransomware avast
“Every organization is vulnerable” - ransomware dominates security threats in 2024, so how can your business stay safe?
Ransomware attack on a computer
Ransomware attacks surged in 2024 as hackers looked to strike faster than ever
Hands typing on a keyboard surrounded by security icons
35 years on: The history and evolution of ransomware
Trojan
Microsoft warns of a devious new RAT malware which can avoid detection with apparent ease
A laptop with a red screen with a white skull on it with the message: "RANSOMWARE. All your files are encrypted."
More reports claim 2024 was the worst year for ransomware attacks yet
Latest in Security
Data leak
Top home hardware firm data leak could see millions of customers affected
Representational image depecting cybersecurity protection
Third-party security issues could be the biggest threat facing your business
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
Android Logo
Devious new Android malware uses a Microsoft tool to avoid being spotted
URL phishing
HaveIBeenPwned owner suffers phishing attack that stole his Mailchimp mailing list
Ransomware
Cl0p resurgence drives ransomware attacks to new highs in 2025
Latest in News
Buzz Lightyear Space Ranger Spin Rennovations
Disney’s giving a classic Buzz Lightyear ride a tech overhaul – here's everything you need to know
Hisense U8 series TV on wall in living room
Hisense announces 2025 mini-LED TV lineup, with screen sizes up to 100 inches – and a surprising smart TV switch
Nintendo Music teaser art
Nintendo Music expands its library with songs from Kirby and the Forgotten Land and Tetris
Opera AI Tabs
Opera's new AI feature brings order to your browser tab chaos
An image of Pro-Ject's Flatten it closed and opened
Pro-Ject’s new vinyl flattener will fix any warped LPs you inadvertently buy on Record Store Day
The iPhone 16 Pro on a grey background
iPhone 17 Pro tipped to get 8K video recording – but I want these 3 video features instead