SentinelOne Vs. Hive Ransomware – Mitigation and Rollback

See how SentinelOne kills Hive Ransomware and reverses all malicious actions. Hive is a recently discovered ransomware family. Earlier this month, the criminal group leaked data from Altus Group, a software company focused on the commercial real estate industry. The threat will attempt to inhibit system recovery by removing Volume Shadow Copies. VSS removal and timeout (execution delays) functions are handled via two .BAT files dropped upon launch (shadow.bat and hive.bat). Hive’s execution is both rapid and noisey. Full drive encryption can be achieved within minutes. That said, visible cmd-windows and excessive timeout calls make it far from ‘stealth’. Victims are instructed to visit the Hive payment / support portal via TOR.

#ransomware #cybersecurity #threathunting #threatintelligence #IT #infosec