Hive Ransomware-as-a-Service Races to the Top as Affiliates Breach 350 Organizations in Just 4 Months
A mere blip on the ransomware radar a quarter ago, the massive onslaught of attacks using Hive Ransomware demonstrates how dangerous the “as-a-Service” model really is.
If you looked at the industry data a quarter ago, Hive ransomware only represented 2.5% of all attacks. But this up-and-coming new ransomware variant is a blueprint of just how easy it can – and should – be for affiliates to setup shop, download the ransomware, and collect on their bounty.
According to a recent look into the Hive by security researchers at GroupIB, the Hive is making ransomware easy. Affiliates can generate a unique version of the ransomware in less than 15 minutes, victim companies can be registered into the Hive’s backend (much like a software partner registering a customer in a partner portal to ensure the deal is attributed to the partner), and transparency is key; with the Hive making sure all communications with victims also visible to affiliates.
Source: The Hive Affiliate Program home page
This is a well-oiled machine. And that’s scary.
Hive is responsible for the single largest ransom demand to date – $240 Million – made in November of last year to electronics retail giant MediaMarkt. This should tell you that the Hive is only going to grow its’ operations and be a formidable tool in the belt of affiliate cybercriminals.
The good news is Hive attacks traditionally use spear-phishing attacks as their initial attack vector. This means that effective Security Awareness Training can do a lot to thwart phishing attacks that use social engineering tactics to trick victims into engaging with malicious loaders that will, inevitably release the Hive.
Be on the watch for this one… it’s going to sting.
Free Ransomware Simulator Tool
Threat actors are constantly coming out with new strains to evade detection. Is your network effective in blocking all of them when employees fall for social engineering attacks?
KnowBe4’s “RanSim” gives you a quick look at the effectiveness of your existing network protection. RanSim will simulate 22 ransomware infection scenarios and 1 cryptomining infection scenario and show you if a workstation is vulnerable.
Here’s how it works:
- 100% harmless simulation of real ransomware and cryptomining infections
- Does not use any of your own files
- Tests 21 types of infection scenarios
- Just download the install and run it
- Results in a few minutes!
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/ransomware-simulator-tool-partner?partnerid=001a000001lWEoJAAW