{"id":46334,"date":"2022-04-21T11:33:00","date_gmt":"2022-04-21T11:33:00","guid":{"rendered":"http:\/\/9e83e83a-23e4-498f-89ab-4ca464f2ce4b"},"modified":"2022-04-21T11:33:00","modified_gmt":"2022-04-21T11:33:00","slug":"hive-hackers-are-exploiting-microsoft-exchange-servers-in-ransomware-spree","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/hive-hackers-are-exploiting-microsoft-exchange-servers-in-ransomware-spree\/","title":{"rendered":"Hive hackers are exploiting Microsoft Exchange Servers in ransomware spree"},"content":{"rendered":"
\n
\n
\"Charlie<\/span> <\/a> <\/div>\n<\/p><\/div>\n<\/p><\/div>\n
\"screenshot-2022-04-21-at-11-37-50.png\"<\/span>
<\/span><\/figcaption><\/figure>\n

The Hive threat group is targeting vulnerable Microsoft Exchange Servers to deploy ransomware.<\/p>\n

First spotted in June 2021, Hive is a Ransomware-as-a-Service (RaaS) model in which cyberattackers can utilize the Hive ransomware strain in attacks.<\/p>\n

The threat actors operate a leak site, accessible via a .onion address, which aims to ‘name and shame’ ransomware victims. Additionally, the malware operators practice double-extortion, in which sensitive corporate data is stolen from a victim organization before disk encryption. <\/p>\n

If a victim refuses to pay for a decryption key, the cyberattackers will plaster their name across the leak site and set a timer before the data is leaked. This piles on the pressure and gives the attackers more opportunities for extortion. <\/p>\n

Hive’s past victims include non-profit entities, the energy sector, financial companies, and healthcare providers.<\/p>\n

“While some ransomware groups operating as RaaS networks claim to steer clear of targeting specific sectors such as hospitals or other critical industries to avoid causing harm to people, Hive’s attacks against healthcare providers in 2021 showed that the operators behind it have no regard for such humanitarian considerations,” Trend Micro said in a March 2022 investigation<\/a> of the group. <\/p>\n

The FBI issued an alert on Hive activity in August 2021, followed by the HHS this April<\/a> (.PDF), who cautioned that the RaaS outfit is an “exceptionally aggressive, financially-motivated ransomware group.” <\/p>\n

In new research published on April 19 by the Varonis Forensics Team<\/a>, a recent ransomware incident has allowed the company to examine the group’s tactics and procedures in depth. <\/p>\n

An unnamed customer’s networks were infiltrated, and the attack was complete in 72 hours. <\/p>\n

The intrusion began with the exploitation of ProxyShell, a set of critical vulnerabilities<\/a> in the Microsoft Exchange Server patched by the vendor in 2021. The security flaws could lead to the remote, full compromise of Exchange servers. <\/p>\n

Once exploited, a webshell backdoor is executed to maintain persistence and grant the attack group a path into the server to deploy Powershell code with SYSTEM-level privileges. <\/p>\n

Hive launches a Cobalt Strike beacon in the next step and creates a new administrator user account. Mimikatz comes into play, and the domain Administrator NTLM hash is stolen. <\/p>\n

“By stealing the domain Administrator NTLM hash and without needing to crack the password, the operator managed to reuse it via Pass-The-Hash attack and take control of the domain admin account,” the researchers say. <\/p>\n

Pass-The-Hash techniques can dupe a target system into launching authenticated sessions on a network without requiring a password crack. <\/p>\n

Hive will then perform reconnaissance on the server, collect information, and deploy the ransomware payload. <\/p>\n

The Go-based Hive ransomware payload, buried in a file called “windows.exe,” will encrypt files, delete shadow copies, disable security solutions, and clear Windows event logs. The malware will also try to disable the Windows Security Accounts Manager (SAM) to stop alerts from being sent to SIEM. <\/p>\n

Once encryption is complete, Hive posts a ransomware note, telling its victim that all data is encrypted and files have been stolen. <\/p>\n

Hive then urges its victim to contact the “sales department” at a .onion address accessible via the Tor network to gain an encryption key and stop “personal data, financial reports, and important documents” from being leaked online. <\/p>\n

Hive then provides instructions and a set of ‘guidelines’ for organizations to follow, including: <\/p>\n