A team of South Korean security researchers from Kookmin University in Seoul have published a whitepaper financially supported by a grant from the Korean government and Korea’s Information Security Agency (KISA), that details known exploitable vulnerabilities in the Hive Ransomware encryption algorithm. The techniques detailed in the paper claim that in their experiments they were able to recover approximately 95% of the master key used to encrypt the drive, without having access to the attacker’s private RSA key. This method allowed them to recover 82% to 98% of the encrypted drive’s data. In the past, Hive ransomware, which first appeared in June 2021 has been so devastating to multiple organizations, that the FBI had to issue an alert for it. Along with encrypting a drive or network of drives for ransom, this group applies pressure to their victims by threatening to leak the data on their HiveLeak dark web site. If the methods laid out in the report are sound, this could change the way ransomware is perceived as a threat by victims and would empower them to take immediate actions other than paying the ransom to save their data. Currently, researchers from both Bitdefender and Kaspersky are reverse engineering the methods detailed in the paper to create a free Hive Ransomware decrypter. The Ankura CTIX will continue to monitor this unprecedented matter, and updates will be published as more details arise.