hive0131

Hive0131 is a financially motivated cybercrime group assessed to likely originate from South America and to operate primarily across Latin America. The group is associated with phishing-led malware delivery campaigns that distribute commodity malware, including information stealers and remote access trojans. Reported activity includes campaigns targeting organizations and users in Latin America, including Colombia, using social-engineering lures themed around invoices or legal matters. Hive0131 has been linked to the use of VMDetectLoader, a modular .NET loader that performs virtual-machine checks and supports in-memory payload delivery. Observed tradecraft includes phishing as an initial access vector, PowerShell-based execution, reflective loading of .NET assemblies, and process hollowing into legitimate Windows processes for defense evasion and post-compromise execution. Campaigns associated with this cluster have delivered commodity payloads such as PURELOGS, a .NET infostealer capable of stealing browser credentials, cookies, autofill data, payment-card data, cryptocurrency-wallet data, and information from numerous desktop applications, as well as DCRat in other operations. Attribution of specific PURELOGS activity to Hive0131 is low confidence where the principal linkage is shared loader usage and code-language similarities. High-confidence characterization supports Hive0131 as a South American, financially motivated threat group focused on phishing-driven malware distribution in Latin America rather than as a confirmed operator of a unique malware family or ransomware program.