Ransomware Group intelligence

Hive

Inactive

Track Hive with 209 published victims and 3 known leak locations in a single intelligence view.

BREACH HOUSE ALERTS

Want an alert every time a new ransomware post is published?

Choose the feeds and the countries you care about — we email you when they move.

Victims 209 Known published victims in this dataset

First discovered 2021-08-14 Earliest victim discovery date

Last discovered 2023-01-16 Latest victim discovery date

Inactive since 1324 days Days since the latest known victim

Top country United States 37 victims

Known locations 3 Leak or negotiation infrastructure tracked

Hive is tracked by Breach House as a ransomware group with 209 published victims.

United States is currently the most targeted country in this dataset.

3 known leak locations are currently associated with this group.

Top Countries

Distribution

Label	Type	Availability	Links
Leak location 2	Onion service	Down checked 2h ago	`hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion`
Leak location 3	Onion service	Down checked 2h ago	`hiveapi4nyabjdfz2hxdsr7otrcv6zq6m4rk5i2w7j64lrtny4b7vjad.onion`
Leak location 1	Onion service	Down checked 2h ago	`hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion`

Not identified 111
Services 20
Healthcare / Pharma 13
Education 12
Communication / Marketing 10
Manufacturing / Engineering 8
IT 7
Public Sector 6
Finance / Legal / Insurance 5
Energy 4
Telecommunications 3
Transportation / Travel / Logistics 3
Construction / Real Estate 2
Agriculture / Food 2
Hospitality / Food & Beverage / Tourism 1
NGOs / Associations 1

Typical Attacks (10)

▼

MITRE ATT&CK does not currently catalogue Hive, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.

T1059.001 PowerShell Execution

What they do: hive uses PowerShell scripts to execute malicious commands and deploy payloads across compromised systems.

What that means: Adversaries may abuse PowerShell commands and scripts for execution.
T1685 Disable or Modify Tools Defense Impairment

What they do: hive disables security tools like antivirus software and monitoring agents to evade detection during attacks.

What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
T1070.004 File Deletion Stealth

What they do: hive deletes Volume Shadow Copies and backup directories to prevent data recovery and increase pressure.

What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
T1049 System Network Connections Discovery Discovery

What they do: hive queries system network connections to map active services and identify high-value targets for encryption.

What that means: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
T1120 Peripheral Device Discovery Discovery

What they do: hive discovers peripheral devices to locate sensitive data requiring encryption before ransomware deployment.

What that means: Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.
T1135 Network Share Discovery Discovery

What they do: hive performs network share discovery to identify accessible SMB shares for lateral movement and victim data targeting.

What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
T1021.002 SMB/Windows Admin Shares Lateral Movement

What they do: hive leverages SMB/Windows Admin Shares for lateral movement across networked hosts within victim environments.

What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
T1567.002 Exfiltration to Cloud Storage Exfiltration

What they do: hive exfiltrates stolen victim data via encrypted C2 channels to enable double extortion tactics.

What that means: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.
T1486 Data Encrypted for Impact Impact

What they do: hive encrypts victim files using strong symmetric cryptography to maximize impact and ransom demand.

What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
T1490 Inhibit System Recovery Impact

What they do: hive invokes system recovery inhibition commands to prevent automated backups or remediation processes.

What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

Tools Observed (22)

▼

Software Hive has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Defense evasion

GMER PCHunter

Discovery & enumeration

Advanced IP Scanner Bloodhound SoftPerfect NetScan

Exfiltration

MEGA PrivatLab RClone Sendspace UFile

LOLBAS (living-off-the-land binaries)

BCDEdit BITSAdmin Windows Event Utility (wevtutil) WMIC

Offensive security tooling

Cobalt Strike Impacket Metasploit Meterpreter PowerShell Empire

Remote monitoring & management

Atera ScreenConnect Splashtop

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.

Crypto Wallets (1)

▼

$584,731 Received (USD)

2 Payments

1 Known wallets

$584,564 Largest single payment

2022-11-17 → 2022-11-17 Payment window

bitcoin · 1

Address	Chain	Received (USD)	Payments
`bc1q4frmv39nmvdsxjnen8jm7ykgz68w7p38v5pry9`	bitcoin	$584,731	2

Crowdsourced payment data from Ransomwhere, licensed CC BY 4.0. Figures are what has been reported and attributed to this family, not a confirmed total. Cite as: Cable, Jack. (2024). Ransomwhere: A Crowdsourced Ransomware Payment Dataset (1.1.0) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.6512122

Ransom Notes (2)

▼

The note this group leaves on a compromised machine. Click a filename to read it.

HOW_TO_DECRYPT.txt txt · 1373 chars

Your network has been breached and all data were encrypted.
Personal data, financial reports and important documents are ready to disclose.

To decrypt all the data and to prevent exfiltrated files to be disclosed at 
http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
you will need to purchase our decryption software.

Please contact our sales department at:

   http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/

      Login:    [snip]
      Password: [snip]

To get an access to .onion websites download and install Tor Browser at:
   https://www.torproject.org/ (Tor Browser is not related to us)


Follow the guidelines below to avoid losing your data:

 - Do not delete or reinstall VMs. There will be nothing to decrypt.
 - Do not modify, rename or delete *.key files. Your data will be 
   undecryptable.
 - Do not modify or rename encrypted files. You will lose them.
 - Do not report to the Police, FBI, etc. They don't care about your business.
   They simply won't allow you to pay. As a result you will lose everything.
 - Do not hire a recovery company. They can't decrypt without the key. 
   They also don't care about your business. They believe that they are 
   good negotiators, but it is not. They usually fail. So speak for yourself.
 - Do not reject to purchase. Exfiltrated files will be publicly disclosed.

View on RansomLook

hive.txt txt · 1312 chars

Your network has been breached and all data were encrypted.
Personal data, financial reports and important documents are ready to disclose.

To decrypt all the data and to prevent exfiltrated files to be disclosed at 
http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/
you will need to purchase our decryption software.

Please contact our sales department at:

   http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/
  
      Login:    [snip]
      Password: [snip]

To get an access to .onion websites download and install Tor Browser at:
   https://www.torproject.org/ (Tor Browser is not related to us)


Follow the guidelines below to avoid losing your data:

 - Do not modify, rename or delete *.key.rrumj files. Your data will be 
   undecryptable.
 - Do not modify or rename encrypted files. You will lose them.
 - Do not report to the Police, FBI, etc. They don't care about your business.
   They simply won't allow you to pay. As a result you will lose everything.
 - Do not hire a recovery company. They can't decrypt without the key. 
   They also don't care about your business. They believe that they are 
   good negotiators, but it is not. They usually fail. So speak for yourself.
 - Do not reject to purchase. Exfiltrated files will be publicly disclosed.

View on RansomLook

Ransom-note text from RansomLook, licensed CC BY 4.0.

Victims (209)

Search, filter and paginate the victim timeline for Hive. Showing 101–200 of 209.

Type	Target	Discovered	Country	Business Category	Intel Link
Ransomware	CARTEGRAPH id3481 View details	2022-05-19	United States	Other	—
No additional victim description available. ID 3481
Ransomware	Tri-Ko id3477 View details	2022-05-19	United States	Other	—
No additional victim description available. ID 3477
Ransomware	Faw-Volkswagen Automobile Co., Ltd. id3367 View details	2022-05-04	China	Telecommunications	—
No additional victim description available. ID 3367
Ransomware	Monterey Mechanical Co. id3321 View details	2022-04-29	United States	Other	—
No additional victim description available. ID 3321
Ransomware	Attica Group id3297 View details	2022-04-28	Greece	Services	—
No additional victim description available. ID 3297
Ransomware	SSK Ingeniería Y Construcción S.A.C. id3277 View details	2022-04-26	Peru	Other	—
No additional victim description available. ID 3277
Ransomware	MILLS GROUP id3195 View details	2022-04-18		Services	—
No additional victim description available. ID 3195
Ransomware	FCCH id3106 View details	2022-04-07		Other	—
No additional victim description available. ID 3106
Ransomware	PHC id3010 View details	2022-03-29		Other	—
No additional victim description available. ID 3010
Ransomware	Konradin Mediengruppe GmbH id2970 View details	2022-03-26		Other	—
No additional victim description available. ID 2970
Ransomware	Pollmann id2966 View details	2022-03-25	Austria	Other	—
No additional victim description available. ID 2966
Ransomware	Passero Associates id2962 View details	2022-03-24	United States	Other	—
No additional victim description available. ID 2962
Ransomware	KONECTA SERVICIOS ADMINISTRATIVOS Y TECNOLOGICOS S.L. SUCURSAL ARGENTINA id2956 View details	2022-03-24		Other	—
No additional victim description available. ID 2956
Ransomware	Banco Caribe id2948 View details	2022-03-23	Dominican Republic	Finance / Legal / Insurance	—
No additional victim description available. ID 2948
Ransomware	Asphalion id2947 View details	2022-03-23	Spain	Other	—
No additional victim description available. ID 2947
Ransomware	Instituto De Gesto Estratégica De Sade Do Distrito Federal id2941 View details	2022-03-23		Public Sector	—
No additional victim description available. ID 2941
Ransomware	Wibag Bau Ag id2940 View details	2022-03-23		Other	—
No additional victim description available. ID 2940
Ransomware	Otto Dörner GmbH & Co. KG id2927 View details	2022-03-22	Germany	Other	—
No additional victim description available. ID 2927
Ransomware	GomeA id2926 View details	2022-03-22		Other	—
No additional victim description available. ID 2926
Ransomware	Ministry For Foreign Affairs Of The Republic Of Indonesia id2925 View details	2022-03-22	Indonesia	Public Sector	—
No additional victim description available. ID 2925
Ransomware	UCSI University id2924 View details	2022-03-22		Education	—
No additional victim description available. ID 2924
Ransomware	School District Of Janesville id2923 View details	2022-03-22		Education	—
No additional victim description available. ID 2923
Ransomware	Rotoplas id2922 View details	2022-03-22		Other	—
No additional victim description available. ID 2922
Ransomware	Centurion Stone id2921 View details	2022-03-22		Other	—
No additional victim description available. ID 2921
Ransomware	Dayton T. Brown, Inc id2920 View details	2022-03-22		Services	—
No additional victim description available. ID 2920
Ransomware	Centerline Communication Llc id2919 View details	2022-03-22	United States	Communication / Marketing	—
No additional victim description available. ID 2919
Ransomware	Polynt Group id2915 View details	2022-03-22	Italy	Services	—
No additional victim description available. ID 2915
Ransomware	NSM Insurance Group id2884 View details	2022-03-18	United States	Finance / Legal / Insurance	—
No additional victim description available. ID 2884
Ransomware	PAN AMERICAN ENERGY S.L. SUCURSAL ARGENTINA id2773 View details	2022-03-04		Energy	—
No additional victim description available. ID 2773
Ransomware	Steven L. Sugarman & Associates id2723 View details	2022-02-25		Other	—
No additional victim description available. ID 2723
Ransomware	Palacios & Asociados id2722 View details	2022-02-25		Other	—
No additional victim description available. ID 2722
Ransomware	Sit'N Sleep id2721 View details	2022-02-25		Other	—
No additional victim description available. ID 2721
Ransomware	MAS & Coronis Health id2720 View details	2022-02-25		Healthcare / Pharma	—
No additional victim description available. ID 2720
Ransomware	BERMAN SOBIN GROSS & DARBY id2719 View details	2022-02-25		Other	—
No additional victim description available. ID 2719
Ransomware	Rocky's Ace Hardware id2718 View details	2022-02-25		Other	—
No additional victim description available. ID 2718
Ransomware	Guts Superpols Co., Ltd. id2717 View details	2022-02-25		Services	—
No additional victim description available. ID 2717
Ransomware	Ningbo Dechang Electric Machinery Manufacturing Co., Ltd. id2716 View details	2022-02-25		Manufacturing / Engineering	—
No additional victim description available. ID 2716
Ransomware	Tite - Live Belgique id2715 View details	2022-02-25		Other	—
No additional victim description available. ID 2715
Ransomware	Shanghai Huizhong Automotive Manufacturing Co., Ltd. id2714 View details	2022-02-25		Manufacturing / Engineering	—
No additional victim description available. ID 2714
Ransomware	Supernus Pharmaceuticals, NASDAQ: SUPN id2713 View details	2022-02-25		Healthcare / Pharma	—
No additional victim description available. ID 2713
Ransomware	Drake & Scull International PJSC id2712 View details	2022-02-25		Services	—
No additional victim description available. ID 2712
Ransomware	Institute For Systems And Robotics (Isr-Lisboa id2711 View details	2022-02-25		Education	—
No additional victim description available. ID 2711
Ransomware	Centre D'Odontologia Integrada Miret-Puig id2710 View details	2022-02-25		Other	—
No additional victim description available. ID 2710
Ransomware	Hyundai Samho Heavy Industries Co.,Ltd. (South Korea) id2709 View details	2022-02-25	Korea, Republic of	Services	—
No additional victim description available. ID 2709
Ransomware	Rodonaves Transportes E Encomendas Ltda id2708 View details	2022-02-25	Brazil	Transportation / Travel / Logistics	—
No additional victim description available. ID 2708
Ransomware	Eurocoin Interactive B.V. id2707 View details	2022-02-25		Other	—
No additional victim description available. ID 2707
Ransomware	Emil Frey id2706 View details	2022-02-25	Switzerland	Other	—
No additional victim description available. ID 2706
Ransomware	Friedrich id2705 View details	2022-02-25		Other	—
No additional victim description available. ID 2705
Ransomware	Powerhouse1 id2704 View details	2022-02-25	United States	Energy	—
No additional victim description available. ID 2704
Ransomware	Doner id2703 View details	2022-02-25	United States	Other	—
No additional victim description available. ID 2703
Ransomware	EBM id2702 View details	2022-02-25		Other	—
No additional victim description available. ID 2702
Ransomware	ITS InfoCom id2701 View details	2022-02-25	Costa Rica	Other	—
No additional victim description available. ID 2701
Ransomware	Vermeer Southeast id2510 View details	2022-01-25		Other	—
No additional victim description available. ID 2510
Ransomware	Unita Locale Socio id2509 View details	2022-01-25		Other	—
No additional victim description available. ID 2509
Ransomware	The British Columbia Institute Of Technology id2508 View details	2022-01-25		IT	—
No additional victim description available. ID 2508
Ransomware	Sutterfield Financial Group id2507 View details	2022-01-25		Finance / Legal / Insurance	—
No additional victim description available. ID 2507
Ransomware	Schuldnerberatung Ostfriesland e. V. id2506 View details	2022-01-25		Other	—
No additional victim description available. ID 2506
Ransomware	Sardinha Family Trust id2505 View details	2022-01-25		Other	—
No additional victim description available. ID 2505
Ransomware	Sadbhav Engineering Limited id2504 View details	2022-01-25		Manufacturing / Engineering	—
No additional victim description available. ID 2504
Ransomware	Ryan Companies id2503 View details	2022-01-25		Other	—
No additional victim description available. ID 2503
Ransomware	Résidence Les Chtaigniers id2502 View details	2022-01-25		Other	—
No additional victim description available. ID 2502
Ransomware	Powell Transportation id2501 View details	2022-01-25		Transportation / Travel / Logistics	—
No additional victim description available. ID 2501
Ransomware	Northern Financial Services id2500 View details	2022-01-25		Finance / Legal / Insurance	—
No additional victim description available. ID 2500
Ransomware	Montour School District id2499 View details	2022-01-25		Education	—
No additional victim description available. ID 2499
Ransomware	Mele Printing id2498 View details	2022-01-25		Communication / Marketing	—
No additional victim description available. ID 2498
Ransomware	Marten Transport id2497 View details	2022-01-25		Transportation / Travel / Logistics	—
No additional victim description available. ID 2497
Ransomware	Macquarie Health Corporation id2496 View details	2022-01-25		Healthcare / Pharma	—
No additional victim description available. ID 2496
Ransomware	Johnson Memorial Health id2495 View details	2022-01-25		Healthcare / Pharma	—
No additional victim description available. ID 2495
Ransomware	Haselden Construction id2494 View details	2022-01-25		Construction / Real Estate	—
No additional victim description available. ID 2494
Ransomware	Greenway Health id2493 View details	2022-01-25		Healthcare / Pharma	—
No additional victim description available. ID 2493
Ransomware	Florida Sugar Cane League id2492 View details	2022-01-25		Other	—
No additional victim description available. ID 2492
Ransomware	Family Christian Health Center id2491 View details	2022-01-25		Healthcare / Pharma	—
No additional victim description available. ID 2491
Ransomware	Erik Buell Racing id2490 View details	2022-01-25		Other	—
No additional victim description available. ID 2490
Ransomware	Creative Liquid Coatings INC id2489 View details	2022-01-25	United States	Communication / Marketing	—
No additional victim description available. ID 2489
Ransomware	ConForm Automotive id2488 View details	2022-01-25		Manufacturing / Engineering	—
No additional victim description available. ID 2488
Ransomware	Claro Colombia id2487 View details	2022-01-25		Other	—
No additional victim description available. ID 2487
Ransomware	Brinkman Turkey Farms id2486 View details	2022-01-25		Agriculture / Food	—
No additional victim description available. ID 2486
Ransomware	Brakke Asbestsanering BV id2485 View details	2022-01-25		Other	—
No additional victim description available. ID 2485
Ransomware	Bohlke International Airways id2484 View details	2022-01-25		Services	—
No additional victim description available. ID 2484
Ransomware	Advanced Geosciences id2483 View details	2022-01-25		Other	—
No additional victim description available. ID 2483
Ransomware	ANTHONY CATALFANO INTERIORS id2482 View details	2022-01-25		Other	—
No additional victim description available. ID 2482
Ransomware	UNICRED id2471 View details	2022-01-20		Other	—
No additional victim description available. ID 2471
Ransomware	RIVADIS id2470 View details	2022-01-20		Other	—
No additional victim description available. ID 2470
Ransomware	Ezz Steel id2416 View details	2022-01-09		Manufacturing / Engineering	—
No additional victim description available. ID 2416
Ransomware	Metro.Us id2304 View details	2021-12-28	United States	Other	—
No additional victim description available. ID 2304
Ransomware	WOLSEY id2248 View details	2021-12-20		Other	—
No additional victim description available. ID 2248
Ransomware	Madix Inc id2247 View details	2021-12-20		Services	—
No additional victim description available. ID 2247
Ransomware	Altus Group id2221 View details	2021-12-18		Services	—
No additional victim description available. ID 2221
Ransomware	Mega Vision id2220 View details	2021-12-18		Other	—
No additional victim description available. ID 2220
Ransomware	HI FLY id2219 View details	2021-12-18		Other	—
No additional victim description available. ID 2219
Ransomware	IBC24 News id2218 View details	2021-12-18		Other	—
No additional victim description available. ID 2218
Ransomware	SS Design id2217 View details	2021-12-18		Other	—
No additional victim description available. ID 2217
Ransomware	GURTEEN id2216 View details	2021-12-18		Other	—
No additional victim description available. ID 2216
Ransomware	Net Ninjas id2215 View details	2021-12-18		Other	—
No additional victim description available. ID 2215
Ransomware	W.H. Stovall id2214 View details	2021-12-18		Other	—
No additional victim description available. ID 2214
Ransomware	Ospray Video id2213 View details	2021-12-18		Communication / Marketing	—
No additional victim description available. ID 2213
Ransomware	GK.NO id2212 View details	2021-12-18	Norway	Other	—
No additional victim description available. ID 2212
Ransomware	KBM UK id2211 View details	2021-12-18		Other	—
No additional victim description available. ID 2211
Ransomware	EMCO id2210 View details	2021-12-18		Other	—
No additional victim description available. ID 2210
Ransomware	Aria Systems id2209 View details	2021-12-18		Services	—
No additional victim description available. ID 2209