Hive0051’s large scale malicious operations enabled by synchronized multi-channel DNS fluxing

For the last year and a half, IBM X-Force has actively monitored the evolution of Hive0051’s malware capabilities. This Russian threat actor has accelerated its development efforts to support expanding operations since the onset of the Ukraine conflict. Recent analysis identified three key changes to capabilities: an improved multi-channel approach to DNS fluxing, obfuscated multi-stage scripts, and the use of fileless PowerShell variants of the Gamma malware.

As of October 2023, IBM X-Force has also observed a significant increase in …

actor analysis capabilities channel conflict development dns ibm ibm x-force key large malicious malware operations russian scale support threat threat actor ukraine ukraine conflict x-force