hive

T1078Valid Accounts: Remote Desktop Protocol

Compromised RDP credentials used for direct access to victim environments.

T1190Exploit Public-Facing Application

Exploitation of Microsoft Exchange vulnerabilities (ProxyShell CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) to gain initial access.

T1566.001Phishing: Spearphishing Attachment

Hive affiliates use phishing emails with malicious attachments to deliver initial access malware.

T1059.001Command and Scripting Interpreter: PowerShell

PowerShell used to execute payloads, disable security tools, and delete backups.

T1059.003Command and Scripting Interpreter: Windows Command Shell

cmd.exe used for executing batch scripts and commands during post-exploitation.

T1070.001Indicator Removal: Clear Windows Event Logs

Windows event logs cleared using wevtutil to remove evidence of the attack.

T1562.001Disable or Modify Tools

Windows Defender and other AV/EDR solutions terminated and disabled prior to ransomware deployment.

T1003.001OS Credential Dumping: LSASS Memory

Mimikatz deployed to harvest credentials from LSASS memory for privilege escalation and lateral movement.

T1046Network Service Discovery

Network scanning performed to enumerate active hosts and services for lateral movement targeting.

T1021.001Remote Services: Remote Desktop Protocol

RDP used for lateral movement across the victim network using harvested credentials.

T1021.002Remote Services: SMB/Windows Admin Shares

SMB admin shares used to deploy the Hive ransomware payload to remote systems.

T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage

Rclone and other tools used to exfiltrate victim data to cloud storage for double extortion via the Hive leak site.

T1219Remote Access Software

Cobalt Strike beacons and remote management tools used for persistent C2 access.

T1486Data Encrypted for Impact

Hive originally used Go-based ransomware with RSA+AES encryption. Later variants (v4+) rewritten in Rust using Curve25519 and ChaCha20/Poly1305. Hive's master key was extracted by FBI researchers in 2022 enabling decryption of victim files. Operated as RaaS until FBI takedown January 2023.

T1490Inhibit System Recovery

Shadow copies and system backups deleted to prevent recovery; backup processes terminated prior to encryption.