The Hive ransomware gang now also encrypts Linux and FreeBSD using new malware variants specifically developed to target these platforms.
However, as Slovak internet security firm ESET discovered, Hive’s new encryptors are still in development and still lack functionality.
The Linux variant also proved to be quite buggy during ESET’s analysis, with the encryption completely failing when the malware was executed with an explicit path.
It also comes with support for a single command line parameter (-no-wipe). In contrast, Hive’s Windows ransomware comes with up to 5 execution options, including killing processes and skipping disk cleaning, uninteresting files, and older files.
The ransomware’s Linux version also fails to trigger the encryption if executed without root privileges because it attempts to drop the ransom note on compromised devices’ root file systems.