Hive0137 and AI-supplemented malware distribution

[Caute_cautim]

Hi All

IBM X-Force tracks dozens of threat actor groups. One group in particular, tracked by X-Force as Hive0137, has been a highly active malware distributor since at least October 2023. Nominated by X-Force as having the “Most Complex Infection Chain” in a campaign in 2023, Hive0137 campaigns deliver DarkGate, NetSupport, T34-Loader and Pikabot malware payloads, some of which are likely used for initial access in ransomware attacks. The crypters used in the infection chains also suggest a close relationship with former members of ITG23 (Conti/Trickbot group). Following law enforcement efforts known as Operation Endgame, Hive0137 was found delivering a new backdoor known as WarmCookie.

https://securityintelligence.com/x-force/hive0137-on-ai-journey/

Regards

Caute_Cautim

[Kyaw_Myo_Oo]

Thanks for sharing @Caute_cautim.

[leefarrellhelps]

Hive0137 is a significant threat actor group tracked by IBM X-Force, known for its complex infection chains and active malware distribution since at least October 2023. They have been involved in campaigns delivering malware like DarkGate, NetSupport, T34-Loader, and Pikabot, which are often used for initial access in ransomware attacks. Their use of crypters indicates a possible connection with former ITG23 members. Despite law enforcement's Operation Endgame, Hive0137 has adapted, now deploying a new backdoor called WarmCookie.