Scientists from South Korea reported the first successful attempt to decrypt data encrypted by Hive ransomware without using the attackers’ private key.
“We were able to recover the master key used to generate file encryption keys without obtaining the attackers’ private key, thanks to a cryptographic vulnerability we discovered,” according to a study by researchers at Kukmin University.
Like many other cybercriminal groups, Hive operates on a ransomware-as-a-service (RaaS) model: attackers infiltrate corporate networks, steal data, encrypt it, and demand a ransom for providing a decryption program. The group’s activity was first recorded in June 2021, when Altus Group became a victim.
Hive uses various methods for initial intrusion: hacking poorly protected RDP servers, stealing VPN credentials, and sending phishing emails with malicious attachments.
In addition, the group uses double extortion tactics—in addition to encrypting data, the attackers steal confidential information and threaten to publish it on their Tor website called HiveLeaks. According to the analytics company Chainalysis, by October 2021, at least 355 organizations had been affected by Hive, making them the eighth largest ransomware operators in terms of revenue.
The FBI described the group’s methods in its report, noting that Hive specifically blocks backup programs, antivirus software, and file copying processes to facilitate encryption.
Researchers have identified a critical flaw in the mechanism for generating and storing master keys. The ransomware does not encrypt the entire file, but only certain parts of it, using two key streams obtained from the master key. These streams are combined using an XOR operation and then applied to the file in alternating blocks.
However, this method made it possible to predict the key streams and recover the master key, which opened up the possibility of decrypting the data without the involvement of attackers. The scientists stated that the approach they developed allows for the stable recovery of more than 95% of the keys used in the attac