Skip to main content
Ransomware Group

Hive

Hive is a strain of ransomware that was first discovered in June 2021. Hive was designed to be used by Ransomware-as-a-service providers, to enable novice cyber-criminals to launch ransomware attacks on healthcare providers, energy providers, charities, and retailers across the globe. In 2022 there was a switch from GoLang to Rust.

Known victims208

Threat level

HIGH

Get an alert if one of your domains is named on a ransomware leak site.

Monitor your domainsFree account · up to 5 monitored targets

Tactics, Techniques & Procedures (TTPs)

DefenseEvasion

  • GMER
  • PCHunter

DiscoveryEnum

  • Advanced IP Scanner
  • Bloodhound
  • SoftPerfect NetScan

Exfiltration

  • MEGA
  • PrivatLab
  • RClone
  • Sendspace
  • UFile

LOLBAS

  • BCDEdit
  • BITSAdmin
  • WMIC
  • Windows Event Utility (wevtutil)

Offsec

  • Cobalt Strike
  • Impacket
  • Metasploit
  • Meterpreter
  • PowerShell Empire

RMM-Tools

  • Atera
  • ScreenConnect
  • Splashtop

Known infrastructure

The following Tor hidden services have been associated with this group:

  • This domain has been seized
  • This domain has been seized
  • This domain has been seized

These sites are malicious. Open them only from an isolated environment.

0

Check if you’re affected

Look up your domain to see whether it appears on Hive’s victim list.

Try it nowFree⌘K
Try

risk score · threat categories · sources · age · confidence — in one request

Other active ransomware groups

LockBitALPHV BlackcatCL0PPlayBianLianAkiraMedusaRhysida