Hive ransomware now encrypts Linux and FreeBSD systems

The Hive ransomware gang now also encrypts Linux and FreeBSD using new malware variants specifically developed to target these platforms.

However, as Slovak internet security firm ESET discovered, Hive’s new encryptors are still in development and still lack functionality.

The Linux variant also proved to be quite buggy during ESET’s analysis, with the encryption completely failing when the malware was executed with an explicit path.

It also comes with support for a single command line parameter (-no-wipe). In contrast, Hive’s Windows ransomware comes with up to 5 execution options, including killing processes and skipping disk cleaning, uninteresting files, and older files.

The ransomware’s Linux version also fails to trigger the encryption if executed without root privileges because it attempts to drop the ransom note on compromised devices’ root file systems.

“Just like the Windows version, these variants are written in Golang, but the strings, package names and function names have been obfuscated, likely with gobfuscate,” ESET Research Labs said.

Ransomware now interested in Linux servers

Hive, a ransomware group active since at least June 2021, has already hit over 30 organizations, counting only victims who refused to pay the ransom.

They’re just one of many ransomware gangs that have begun targeting Linux servers after their enterprise targets have slowly migrated to virtual machines for easier device management and more efficient use of resources.

By targeting virtual machines, ransomware operators can also encrypt multiple servers at once with a single command.

In June, researchers spotted a new REvil ransomware Linux encryptor designed to target VMware ESXi virtual machines, a popular enterprise virtual machine platform.

Emsisoft CTO Fabian Wosar told BleepingComputer that other ransomware groups, such as Babuk, RansomExx/Defray, Mespinoza, GoGoogle, DarkSide, and Hellokitty have also created their own Linux encryptors.

“The reason why most ransomware groups implemented a Linux-based version of their ransomware is to target ESXi specifically,” Wosar said.

HelloKitty and BlackMatter ransomware Linux encryptors were later discovered in the wild by security researchers in July and August, confirming Wosar’s statement.

One month later, it was discovered that some of these Linux malware strains are also buggy and could damage victims’ files during encryption.

In the past, the Snatch and PureLocker ransomware operations have also used Linux variants on their attacks.