Hive
Hive is a strain of ransomware that was first discovered in June 2021. Hive was designed to be used by Ransomware-as-a-service providers, to enable novice cyber-criminals to launch ransomware attacks on healthcare providers, energy providers, charities, and retailers across the globe.
In 2022 there was a switch from GoLang to Rust.
Victims
208
First Discovered
2021-08-14
victim
Last Discovered
2023-01-16
victim
Inactive Since
3yrs
more than
Avg Delay
N/A
attack→claim
Infostealer
60.0%
victims with domain
Countries
27
hit
Known Locations (3)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
This domain has been seized | No | 2026-04-28T07:24:07 |
hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion
|
|||
|
This domain has been seized | No | 2026-04-28T07:26:41 |
hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion
|
|||
|
This domain has been seized | No | 2026-04-28T07:29:13 |
hiveapi4nyabjdfz2hxdsr7otrcv6zq6m4rk5i2w7j64lrtny4b7vjad.onion
|
Target
Top 5 Activity Sectors
- Manufacturing 38
- Business Services 29
- Healthcare 23
- Technology 14
- Consumer Services 14
Top 5 Countries
-
United States
36
-
United Kingdom
8
-
Netherlands
3
-
Canada
2
-
China
2
Heatmap
Ransom Notes (2)
Tools Used
| Discovery | RMM Tools | Defense Evasion | Credential Theft | OffSec | Networking | LOLBAS | Exfiltration |
|---|---|---|---|---|---|---|---|
|
Advanced IP Scanner
Bloodhound
SoftPerfect NetScan
|
Atera
ScreenConnect
Splashtop
|
GMER
PCHunter
|
|
Cobalt Strike
Impacket
Metasploit
Meterpreter
PowerShell Empire
|
|
BCDEdit
BITSAdmin
WMIC
Windows Event Utility (wevtutil)
|
MEGA
PrivatLab
RClone
Sendspace
UFile
|
TTPs Matrix (9)
| Initial Access | Execution | Defense Evasion | Credential Access | Discovery | Lateral Movement | Exfiltration | Command and Control | Impact |
|---|---|---|---|---|---|---|---|---|
| Valid Accounts: Remote Desktop Protocol | Command and Scripting Interpreter: PowerShell | Indicator Removal: Clear Windows Event Logs | OS Credential Dumping: LSASS Memory | Network Service Discovery | Remote Services: Remote Desktop Protocol | Exfiltration Over Web Service: Exfiltration to Cloud Storage | Remote Access Software | Data Encrypted for Impact |
| Exploit Public-Facing Application | Command and Scripting Interpreter: Windows Command Shell | Disable or Modify Tools | Remote Services: SMB/Windows Admin Shares | Inhibit System Recovery | ||||
| Phishing: Spearphishing Attachment |
Negotiation Chats (8)
YARA Rules (1)
Victims (208)
As commercial construction specialists in Orlando, we provide new construction and renovation servic…
***** DATA IS COMING SOON **** G.W. Becker, Inc. is a full service, single source, provider of choi…
Consulate Health Care is a leading provider of senior healthcare services, specializing in post-acut…
Grupo Centro Médico Virgen de la Caridad, a private health company with its own identity that was bo…
Camst Group is a company that specializes in restaurant services. It offers catering & banqueting, r…
The MHMR Authority of Brazos Valley is a public non-profit community MHMR center. Through the Texas …
Founded in 1933, North Idaho College is a community college in Coeur d'Alene, Idaho.…
Innovative Education Management (IEM) has been successfully developing and operating California char…
Dixons Allerton Academy (formerly Rhodesway Academy) is a coeducational all-through school and sixth…
JAKKS Pacific, Inc. is a multi-brand company that, since 1995, has been designing, developing, produ…
**** ALL BLUEPRINTS OF ALL PRODUCT LINES WILL BE AVAILABLE SOON **** Stolle is the world's leading s…
No description available
