Loading story…
WikiLeaks published source code and development logs for Hive, describing it as a covert CIA command-and-control platform used to manage malware operations. The leaked material portrays Hive as infrastructure that let implants on compromised systems exfiltrate data and receive tasking while masking attribution, and a public GitHub repository later mirrored the released code and documentation.
The leaked descriptions say Hive relied on cover domains hosted on commercial VPS infrastructure, with public-facing relay servers forwarding authenticated implant traffic over VPN links to a hidden CIA server known as Blot. The material also alleges the platform used fake digital certificates, including certificates impersonating Kaspersky Lab and a Thawte-signed chain, to make malicious communications appear tied to legitimate organizations rather than the CIA.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
A GitHub repository named "infoskirmish/hive" shows an initial code import presenting itself as hosting the CIA Hive source code released by WikiLeaks.
WikiLeaks published source code and development logs for Hive as part of Vault 8. The material described Hive as a covert CIA command-and-control and communications platform used to manage malware operations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **Hive ransomware** affiliates used a new obfuscation method dubbed **"IPfuscation"** to conceal malware payloads inside 64-bit Windows loaders. The technique stores shellcode as arrays of ASCII-formatted network identifiers—primarily IPv4 addresses—which are converted at runtime through Windows string-to-address APIs and then executed to launch a **Cobalt Strike Beacon** stager. Analysts observed execution methods including direct system calls and callback abuse through `EnumUILanguagesA`, making the loaders harder to detect with traditional static signatures. Sentinel Labs also identified related variants that encoded payloads as **IPv6 addresses, UUIDs, base64-encoded UUIDs, and MAC addresses**, along with a Golang loader that shared development artifacts suggesting a common author. The activity aligned with known Hive intrusion tradecraft, including use of **PowerShell**, BAT scripts, **ADFind**, **SharpView**, **BloodHound**, **SharpHashSpray**, **SharpDomainSpray**, **Rubeus**, Group Policy Objects, and scheduled tasks. Researchers said defenders should prioritize **behavioral detection**, endpoint telemetry correlation, and broader security analytics over signature-only approaches, and they published malware hashes, C2 indicators, and YARA rules tied to the IPfuscation family.
Aug 15, 2026
Hive emerged as a prolific ransomware-as-a-service operation that heavily targeted healthcare and other enterprises, using **double extortion** to steal data and encrypt systems. Reporting tied the group to intrusions involving phishing, vulnerable RDP, stolen VPN credentials, and possible exploitation of Microsoft Exchange `ProxyShell`, followed by lateral movement with RDP and WMI, use of Cobalt Strike, shadow-copy deletion, and exfiltration through tools such as 7-Zip and anonymous file-sharing services. The group expanded beyond Windows with Linux and FreeBSD encryptors, including VMware ESXi-focused variants, and was linked to major disruptions at hospitals and other organizations. At the same time, academics from Kookmin University published a decryption method that exploited weaknesses in Hive’s custom XOR-based file-encryption design, reporting recovery of more than **95%** of the master key and decryption of roughly **82% to 98%** of affected files without the attackers’ private key. Subsequent public research and proof-of-concept tooling documented Hive version-specific decryptors and analysis resources, while the ransomware operators responded by hardening their malware, including rewriting the Linux ESXi encryptor in **Rust** and moving ransom-site credentials out of embedded samples and into runtime command-line arguments to reduce analysis and monitoring opportunities.
Aug 15, 2026
Hive ransomware affiliates used multiple intrusion paths to compromise enterprise networks, including unpatched Microsoft Exchange `ProxyShell` vulnerabilities and fake software installers delivered through malicious Google Ads and typosquatted download sites. Incident reports describe attackers planting web shells on Exchange servers, launching PowerShell payloads and Cobalt Strike beacons, stealing credentials with tools such as Mimikatz and LSASS dumping, and moving laterally through `RDP`, `PsExec`, and pass-the-hash. In several cases, the actors also conducted broad internal reconnaissance, exfiltrated data with tools including `Rclone` and `WinSCP`, and created new administrator accounts before deploying Hive’s Golang encryptor and dropping the ransom note `HOW_TO_DECRYPT.txt`. Researchers also documented unusually aggressive defense-evasion and deployment tactics designed to maximize disruption. Rapid7 observed Hive operators using `BITSAdmin`, Active Directory Group Policy changes, and `PsExec` to distribute payloads, then forcing hosts into Safe Mode with minimal services via `BCDEdit`, enabling auto-logon for a local administrator account, and replacing the Windows shell with a malicious batch file so encryption could run after reboot with security tools disabled. Across the reported intrusions, the ransomware deleted shadow copies and other recovery artifacts, disabled or weakened endpoint defenses, cleared logs, encrypted local and network-accessible files, and used Tor-based negotiation and leak sites to pressure victims into paying.
Aug 15, 2026