Hive
Hive is a ransomware family and ransomware-as-a-service operation active since at least June 2021 and described as one of the most prolific ransomware groups. It is associated with double-extortion attacks, including data theft and encryption, and is specifically noted for targeting healthcare organizations and hospitals. Reporting also places Hive among major ransomware groups linked to Russia, and U.S. authorities have alleged that Mikhail Pavlovich Matveev participated in conspiracies involving Hive and played a major role in the development and deployment of the variant.
The malware has been observed in Linux and VMware ESXi ransomware trends, with Hive listed among groups that added Linux encryptors to their arsenal and among ransomware families targeting ESXi environments. However, SentinelLABS found no obvious similarity between Hive’s ESXi locker and the leaked Babuk-derived ESXi codebase used by several other families. Microsoft reporting also states that the threat cluster DEV-0237 used Hive payloads in some campaigns, reflecting affiliate or operator reuse within the broader ransomware ecosystem.
Operationally, Hive-related activity has been linked to fast-flux infrastructure, and a Huntress investigation found an IP address associated via Maltrail with Hive ransomware during an intrusion that began with brute-force access to an internet-exposed RDP server. In a separate Sophos X-Ops cluster, a January 2023 Hive attack showed hands-on-keyboard tradecraft including brute-forced RDP initial access, creation of administrative accounts across thousands of machines, use of batch scripts such as gp.bat and related script chains, deployment from password-protected archives, and ransomware execution roughly 13 hours after the main burst of activity. Public reporting also notes infrastructure seizure and backend infiltration by the FBI and European law enforcement in late January 2023, disrupting Hive’s operations.
Hive has been repeatedly referenced in sector and prevalence reporting as a common ransomware variant during 2022, including a material increase in prevalence in Q4 2022. It has also been cited in discussions of possible successor or rebrand activity: Hunters International has been widely suspected by some researchers to be a rebrand of Hive due to similarities in encryptor code, although that group denied direct ties and claimed it purchased Hive’s software and website.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
DEV-0237 heavily used Ryuk and Conti payloads from Trickbot LLC/DEV-0193, then Hive payloads more recently.
Authorities say Matveev played a major role in the development and deployment of the Hive, LockBit and Babuk ransomware variants...
...delivering various ransomware payloads over the years, including Hive, BlackCat (ALPHV), Hunters International, LockBit, and Embargo ransomware.
Techniques & procedures
8 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
1 technique
Initial Access
Execution
1 technique
Execution
Privilege Escalation
1 technique
Privilege Escalation
Stealth
1 technique
Stealth
Lateral Movement
1 technique
Lateral Movement
Command and Control
1 technique
Command and Control
Impact
1 technique
Impact
Other
1 technique
Other
file1.bat : a batch file designed to set up the system with autologon as the newly-created administrative user AdminBac, reboot into Safe Mode ... file2.bat : a second batch file, executed in Safe Mode via a registry key, designed to unpack the ransomware binary from the encrypted archive
IOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
60 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware operated by the Hive group; the content notes FBI infiltration of the group’s operations.
A ransomware operation referenced as an example of FBI infiltration of a ransomware network.
RaaS operation dismantled after law-enforcement infiltration that enabled distribution of decryption keys to victims.
Named ransomware family (RaaS) referenced via infrastructure attribution: brute-force source IPs were reported by maltrail as associated with Hive ransomware.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.