Loading threat actor…
Hive0145 is a financially motivated cybercriminal threat actor assessed to be the exclusive or primary operator behind Strela Stealer since at least late 2022. The group is widely characterized as a rapidly maturing initial access broker focused on credential theft and follow-on access monetization. Its operations have centered on phishing campaigns targeting organizations across Europe, with especially consistent targeting of Spain, Germany, Ukraine, and earlier activity affecting Italy. Hive0145 initially relied on relatively simple invoice-themed phishing emails carrying malicious attachments to deliver Strela Stealer. Over time, the actor significantly improved its tradecraft, expanding localization and tailoring lures to regional languages and locales, including Spanish, German, Italian, Ukrainian, Catalan, Polish, and Basque contexts. By 2024, the group had shifted toward more credible attachment-hijacking operations that reused authentic stolen invoice emails while replacing the original attachment with a weaponized payload, increasing the likelihood of execution. The actor’s delivery chains have used encrypted archives, obfuscated JavaScript and script-based downloaders, polyglot files, uncommon executable formats, valid code-signing certificates, and a custom crypter or loader referred to as Stellar Loader or Stellar Crypter. Campaigns have also used remotely hosted payload retrieval and in-memory execution techniques to improve defense evasion. Observed activity indicates frequent iteration and testing of infection methods, with campaign tempo increasing to near-weekly waves by late 2024. Strela Stealer has primarily targeted credentials stored by Microsoft Outlook and Mozilla Thunderbird. Later variants also collected host profiling data such as system metadata and installed application inventories, indicating added reconnaissance value beyond pure credential theft. The theft of email credentials has enabled Hive0145 to recycle compromised business communications into subsequent phishing operations, supporting both continued intrusion activity and potential resale of access. Hive0145’s activity is best understood as credential-focused intrusion enablement rather than ransomware or destructive operations. Reporting has linked parts of the broader delivery ecosystem to service providers and botnet operators that distributed spam or staged malware on the actor’s behalf, but Hive0145 itself is the actor associated with Strela Stealer operations and monetization of the resulting access.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
9 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
4 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Financially motivated actor assessed as the exclusive operator behind Strela Stealer campaigns since at least 2022; likely acts as an initial access broker acquiring and selling access to compromised systems.
Hive0145 is a cybercriminal group operating the Strela Stealer malware, which is distributed via partnerships with other groups such as Detour Dog.
Conducting phishing campaigns delivering Strela Stealer for credential theft and later broader reconnaissance, evolving from generic invoice lures to hijacked legitimate invoice emails with weaponized ZIP attachments and obfuscated JavaScript loaders.
Ongoing campaign delivering StrelaStealer malware to victims in Europe, extracting credentials from Microsoft Outlook and Mozilla Thunderbird via phishing emails using stolen invoice notifications.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.