HackerFeeds
All ransomware groups

hive

208 tracked victims
·first seen 2021-08-14·last activity 2023-01-16

Activity analysis

HackerFeeds has tracked 208 victims claimed by hive since August 2021, most recently in January 2023 — ranking #31 of 332 groups (0.6% of all tracked ransomware victims). No new victims have been posted in the last 180 days; the most recent claim was in January 2023. Its most-targeted sector is Manufacturing (38 victims), followed by Business Services (29). The United States accounts for 36 victims (47% of those with a known location); 132 victims did not disclose a location.

Victims per year

  • 202125
  • 2022180
  • 20233

Top sectors

  • Manufacturing38
  • Business Services29
  • Healthcare23
  • Technology14
  • Consumer Services14
  • Education13

Computed from victims claimed on the group's leak site as collected by HackerFeeds; claims are not independently verified. Monthly reports · Methodology

Group profile

Hive is a strain of ransomware that was first discovered in June 2021. Hive was designed to be used by Ransomware-as-a-service providers, to enable novice cyber-criminals to launch ransomware attacks on healthcare providers, energy providers, charities, and retailers across the globe. In 2022 there was a switch from GoLang to Rust.

MITRE ATT&CK TTPs

TA0001

Initial Access

  • T1078Valid Accounts: Remote Desktop Protocol

    Compromised RDP credentials used for direct access to victim environments.

  • T1190Exploit Public-Facing Application

    Exploitation of Microsoft Exchange vulnerabilities (ProxyShell CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) to gain initial access.

  • T1566.001Phishing: Spearphishing Attachment

    Hive affiliates use phishing emails with malicious attachments to deliver initial access malware.

TA0002

Execution

  • T1059.001Command and Scripting Interpreter: PowerShell

    PowerShell used to execute payloads, disable security tools, and delete backups.

  • T1059.003Command and Scripting Interpreter: Windows Command Shell

    cmd.exe used for executing batch scripts and commands during post-exploitation.

TA0005

Defense Evasion

  • T1070.001Indicator Removal: Clear Windows Event Logs

    Windows event logs cleared using wevtutil to remove evidence of the attack.

  • T1562.001Disable or Modify Tools

    Windows Defender and other AV/EDR solutions terminated and disabled prior to ransomware deployment.

TA0006

Credential Access

  • T1003.001OS Credential Dumping: LSASS Memory

    Mimikatz deployed to harvest credentials from LSASS memory for privilege escalation and lateral movement.

TA0007

Discovery

  • T1046Network Service Discovery

    Network scanning performed to enumerate active hosts and services for lateral movement targeting.

TA0008

Lateral Movement

  • T1021.001Remote Services: Remote Desktop Protocol

    RDP used for lateral movement across the victim network using harvested credentials.

  • T1021.002Remote Services: SMB/Windows Admin Shares

    SMB admin shares used to deploy the Hive ransomware payload to remote systems.

TA0010

Exfiltration

  • T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage

    Rclone and other tools used to exfiltrate victim data to cloud storage for double extortion via the Hive leak site.

TA0011

Command and Control

  • T1219Remote Access Software

    Cobalt Strike beacons and remote management tools used for persistent C2 access.

TA0040

Impact

  • T1486Data Encrypted for Impact

    Hive originally used Go-based ransomware with RSA+AES encryption. Later variants (v4+) rewritten in Rust using Curve25519 and ChaCha20/Poly1305. Hive's master key was extracted by FBI researchers in 2022 enabling decryption of victim files. Operated as RaaS until FBI takedown January 2023.

  • T1490Inhibit System Recovery

    Shadow copies and system backups deleted to prevent recovery; backup processes terminated prior to encryption.

Recent victims

No victims tracked yet.