Loading story…
Hive ransomware affiliates used multiple intrusion paths to compromise enterprise networks, including unpatched Microsoft Exchange ProxyShell vulnerabilities and fake software installers delivered through malicious Google Ads and typosquatted download sites. Incident reports describe attackers planting web shells on Exchange servers, launching PowerShell payloads and Cobalt Strike beacons, stealing credentials with tools such as Mimikatz and LSASS dumping, and moving laterally through RDP, PsExec, and pass-the-hash. In several cases, the actors also conducted broad internal reconnaissance, exfiltrated data with tools including Rclone and WinSCP, and created new administrator accounts before deploying Hive’s Golang encryptor and dropping the ransom note HOW_TO_DECRYPT.txt.
Researchers also documented unusually aggressive defense-evasion and deployment tactics designed to maximize disruption. Rapid7 observed Hive operators using BITSAdmin, Active Directory Group Policy changes, and PsExec to distribute payloads, then forcing hosts into Safe Mode with minimal services via BCDEdit, enabling auto-logon for a local administrator account, and replacing the Windows shell with a malicious batch file so encryption could run after reboot with security tools disabled. Across the reported intrusions, the ransomware deleted shadow copies and other recovery artifacts, disabled or weakened endpoint defenses, cleared logs, encrypted local and network-accessible files, and used Tor-based negotiation and leak sites to pressure victims into paying.
TTPs, infrastructure, and targeting history in one profile.
24 events from the most recent confirmed update back to the earliest known activity.
Detailed technical information about the ProxyShell Exchange vulnerabilities became public, after which malicious exploitation increased.
Hive ransomware operations were first observed in the wild, marking the emergence of the group later tied to multiple intrusions and extortion activity.
Microsoft patched CVE-2021-31207 in KB5003435, completing fixes for the three vulnerabilities later referred to as ProxyShell.
Microsoft patched CVE-2021-34473 and CVE-2021-34523 in KB5001779, closing two components of the ProxyShell exploit chain affecting Exchange Server.
Kroll stated that Hive ransomware had been seized by law enforcement, marking a disruption of the operation even as its tactics were expected to persist.
The final Hive payload, a Golang binary named Windows.exe, deleted shadow copies, disabled Windows Defender, cleared logs, stopped services, encrypted files, and dropped ransom notes demanding payment.
In the Varonis case, the attackers completed compromise and encryption of multiple devices and file servers in less than 72 hours from initial access.
Before deploying ransomware, the attackers exfiltrated files from the victim environment to support double-extortion pressure.
The attackers searched for password-related files, enumerated assets with SoftPerfect and scripts, reused stolen hashes in pass-the-hash attacks, and moved laterally over RDP to systems including backup and SQL servers.
The threat actor created a new administrator account named "user," added it to privileged groups, and used Mimikatz to dump credentials including the domain Administrator NTLM hash.
After exploiting Exchange, the attackers planted multiple web shells in a public directory and used them to run PowerShell that downloaded and executed Cobalt Strike stagers in memory.
Varonis investigated a Hive ransomware incident in which attackers exploited Microsoft Exchange ProxyShell vulnerabilities to gain initial access to the victim environment.
Rapid7 released detections and IOCs tied to the observed Hive campaign, including filenames, IP addresses, and domains used during the intrusion.
Rapid7 reported previously undocumented Hive flags including -timer, which delays encryption, and -low-key, which skips several default destructive pre-encryption actions.
On reboot, a malicious batch file extracted the Hive ransomware payload from int.7z using 7zr.exe and launched it, including manual executions observed with the -u and -no-discovery flags.
The attacker used a startup script to create a local administrator account, configure auto-logon, replace the Windows shell with a malicious batch file, and set safeboot minimal before rebooting hosts.
Rapid7 documented a Hive intrusion in which the attacker used Cobalt Strike, BITSAdmin, PsExec, and Group Policy changes to distribute scripts and prepare systems for ransomware execution in Safe Mode.
Kroll observed Hive actors dumping LSASS, Kerberoasting, performing internal reconnaissance, moving laterally with RDP and PsExec, and exfiltrating data with tools such as Rclone and WinSCP before ransomware deployment.
In the Kroll-observed chain, Batloader dropped PowerShell and batch scripts that downloaded additional payloads including Ursnif and Vidar, elevated privileges, and disabled or suppressed Windows security controls.
Kroll identified a Hive intrusion vector in which IT administrators were lured via malicious Google Ads and typosquatted software sites into downloading fake installers that delivered Batloader.
GuidePoint responders removed the threat actor from the environment before ransomware was deployed, preventing the attack from progressing to encryption.
Investigators found the RAT was used to invoke Cobalt Strike on the compromised Exchange server and identified beacons on 15 critical infrastructure servers using four team servers.
After gaining Exchange access, the attackers ran obfuscated PowerShell that fetched run.txt and komar.ps1 from 45.32.229.66, decoded shellcode in memory, and downloaded Agent32.bin from 108.62.12.122.
In the GuidePoint incident, attackers exploited CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207 to compromise an on-premises Exchange server and write a web shell to the aspnet_client directory.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 111 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
6 references tracked. Mallory keeps watching after this page renders.
microsoft.com
Open sourcevaronis.com
Open sourcekroll.com
Open sourcerapid7.com
Open sourcebleepingcomputer.com
Open sourceguidepointsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hive emerged as a prolific ransomware-as-a-service operation that heavily targeted healthcare and other enterprises, using **double extortion** to steal data and encrypt systems. Reporting tied the group to intrusions involving phishing, vulnerable RDP, stolen VPN credentials, and possible exploitation of Microsoft Exchange `ProxyShell`, followed by lateral movement with RDP and WMI, use of Cobalt Strike, shadow-copy deletion, and exfiltration through tools such as 7-Zip and anonymous file-sharing services. The group expanded beyond Windows with Linux and FreeBSD encryptors, including VMware ESXi-focused variants, and was linked to major disruptions at hospitals and other organizations. At the same time, academics from Kookmin University published a decryption method that exploited weaknesses in Hive’s custom XOR-based file-encryption design, reporting recovery of more than **95%** of the master key and decryption of roughly **82% to 98%** of affected files without the attackers’ private key. Subsequent public research and proof-of-concept tooling documented Hive version-specific decryptors and analysis resources, while the ransomware operators responded by hardening their malware, including rewriting the Linux ESXi encryptor in **Rust** and moving ransom-site credentials out of embedded samples and into runtime command-line arguments to reduce analysis and monitoring opportunities.
Aug 15, 2026
Researchers reported that **Hive ransomware** affiliates used a new obfuscation method dubbed **"IPfuscation"** to conceal malware payloads inside 64-bit Windows loaders. The technique stores shellcode as arrays of ASCII-formatted network identifiers—primarily IPv4 addresses—which are converted at runtime through Windows string-to-address APIs and then executed to launch a **Cobalt Strike Beacon** stager. Analysts observed execution methods including direct system calls and callback abuse through `EnumUILanguagesA`, making the loaders harder to detect with traditional static signatures. Sentinel Labs also identified related variants that encoded payloads as **IPv6 addresses, UUIDs, base64-encoded UUIDs, and MAC addresses**, along with a Golang loader that shared development artifacts suggesting a common author. The activity aligned with known Hive intrusion tradecraft, including use of **PowerShell**, BAT scripts, **ADFind**, **SharpView**, **BloodHound**, **SharpHashSpray**, **SharpDomainSpray**, **Rubeus**, Group Policy Objects, and scheduled tasks. Researchers said defenders should prioritize **behavioral detection**, endpoint telemetry correlation, and broader security analytics over signature-only approaches, and they published malware hashes, C2 indicators, and YARA rules tied to the IPfuscation family.
Aug 15, 2026
Microsoft reported that the **Hive** ransomware operation deployed a heavily reworked variant rewritten from **Go** to **Rust**, introducing a more complex encryption scheme and stealth improvements that initially helped some samples avoid detection. Analysts said the new build was uncovered after unusual `.key` files lacked the victim identifier normally associated with Hive, leading to the discovery of multiple related samples. The malware now requires ransom-site credentials through the command line, decrypts strings at runtime to hinder analysis, and uses updated cryptography built on `Curve25519` ECDH and `XChaCha20-Poly1305`. The updated payload also attempts to maximize impact by stopping security, backup, database, and business application services before launching recovery-disruption commands to remove shadow copies and backups. Microsoft said Hive continued to operate as a **ransomware-as-a-service** threat seen in intrusions affecting sectors including healthcare and software, with activity linked to affiliate **DEV-0237**, now tracked as **Pistachio Tempest**. The company published indicators of compromise, detections, and mitigation guidance to help defenders identify and contain Hive-related attacks.
Aug 15, 2026