Hive Ransomware: Modern, Efficient Business Model
Umer Jamshaid Published January 27, 2023 | 09:40 AM
Washington, (UrduPoint / Pakistan Point News - 27th Jan, 2023 ) :The US Justice Department's shutdown on Thursday of the Hive ransomware operation -- which extorted some $100 million from more than 1,5000 victims worldwide -- highlights how hacking has become an ultra-efficient, specialized industry that can allow anyone to become a cyber-shakedown artist.
- Modern business model - Hive operated in what cybersecurity experts call a "ransomware as a service" style, or RaaS -- a business that leases it software and methods to others to use in extorting a target.
The model is central to the larger ransomware ecosystem, in which actors specialize in one skill or function to maximize efficiency.
According to Ariel Ropek, director of cyber threat intelligence at cybersecurity firm Avertium, this structure makes it possible for criminals with minimal computer fluency to get into the ransomware game by paying others for their expertise.
"There are quite a few of them," Ropek said of RaaS operations.
"It is really a business model nowadays," he said.
- How it works - On the so-called dark web, providers of ransomware services and support pitch their products openly.
At one end are the initial access brokers, who specialize in breaking into corporate or institutional computer systems.
They then sell that access to the hacker, or ransomware operator.
But the operator depends on RaaS developers like Hive, which have the programming skills to create the malware needed to carry out the operation and avoid counter-security measures.
Typically, their programs -- once inserted by the ransomware operator into the target's IT systems -- are manipulated to freeze, via encryption, the target's files and data.
The programs also extract the data back to the ransomware operator.
RaaS developers like Hive offer a full service to the operators, for a large share of the ransom paid out, said Ropek.
"Their goal is to make the ransomware operation as turnkey as possible," he said.
- Polite but firm - When the ransomware is planted and activated, the target receives a message telling them how to correspond and how much to pay to get their data unencrypted.
That ransom can run from thousands to millions of dollars, usually depending on the financial strength of the target.
Inevitably the target tries to negotiate on the portal. They often don't get very far.
Menlo Security, a cybersecurity firm, last year published the conversation between a target and Hive's "Sales Department" that took place on Hive's special portal for victims.
In it, the Hive operator courteously and professionally offered to prove the decryption would work with a test file.
But when the target repeatedly offered a fraction of the $200,000 demanded, Hive was firm, insisting the target could afford the total amount.
Eventually, the Hive agent gave in and offered a significant reduction -- but drew the line there.
"The price is $50,000. It's final. What else to say?" the Hive agent wrote.
If a target organization refuses to pay, the RaaS developers hold a backup position: they threaten to release the hacked confidential files online or sell them.
Hive maintained a separate website, HiveLeaks, to publish the data.
On the back end of the deal, according to Ropek, there are specialist operations to collect the money, making sure those taking part get their shares of the ransom.
Others, known as cryptocurrency tumblers, help launder the ransom for the hacker to use above-ground.
- Modest blow - Thursday's action against Hive was only a modest blow against the RaaS industry.
There are numerous other ransomware specialists similar to Hive still operating.
The biggest current threat is LockBit, which attacked Britain's Royal Mail in early January and a Canadian children's hospital in December.
In November, the Justice Department said LockBit had reaped tens of millions of Dollars in ransoms from 1,000 victims.
And it isn't hard for Hive's operators to just start again.
"It's a relatively simple process of setting up new servers, generating new encryption keys. Usually there's some kind of rebrand," said Ropek.
Related Topics
Recent Stories
HEC reviews curricula for environmental sciences degree programme
ICC Asia looking forward to an action-packed Asia Cricket Week
Yuvraj Singh named ICC Men’s T20 World Cup 2024 Ambassador
Greece hands Olympic flame to 2024 Paris Games hosts
Two Kyiv hospitals evacuating over feared Russian strikes
World must act on neurotech revolution, say experts
Charles & Catherine's cancer diagnoses
Champions Alcaraz and Sabalenka through in Madrid Open
King Charles to resume some public duties during cancer treatment: palace
US defense chief announces $6 bn in security aid for Ukraine
Heavy rains cause damage to Spezand-Taftan railway track
Woman stabbed in Israel, attacker killed: police
More Stories From Miscellaneous
-
Modern Education Techniques: A pathway to achieve economic development
15 hours ago -
Kite Flying: From cultural festival to deadly sport
15 hours ago -
PDMA predicts gusty wind, rain with thunder, hails
3 days ago -
Iranian president Raisi given guard of honour at PM House
5 days ago -
Intellectuals, writers accolades Naseer Mirza on his literary contribution
5 days ago -
Bahawalpur Adabi Sangat hosts memorable mushaira
5 days ago
-
Cattle farming vital to alleviate poverty in rural areas
5 days ago -
Pakistan: A land of tourism, archeological wonders
6 days ago -
Transforming education sector: from job hunters to job creators
8 days ago -
Amjad Bobby remembered on 19th death anniversary for timeless contributions to music
12 days ago -
Legendary actor Nadeem’s 26 films released on Eid-ul-Fitr days in 50 years
12 days ago -
Besant Hall Cultural Centre to celebrate evening with Sanam Marvi on 26 April
12 days ago