Hive Ransomware

Threat Actor updated a month ago (2024-10-15T10:02:48.932Z)

Download STIX

Preview STIX

Hive ransomware, a prominent threat actor active in 2022, was known for its widespread malicious activities in numerous countries, including the US. The group's modus operandi involved the use of SharpRhino, which upon execution, established persistence and provided remote access to the attackers, enabling them to launch typical ransomware attacks. Despite the group's notorious activities, only about 20% of Hive's victims reported their experiences to law enforcement, as discovered by the FBI when they infiltrated the group’s infrastructure. In a significant development, the Hive ransomware operation was shut down in January 2023 as part of a law enforcement-led operation. This disruption campaign resulted in the infiltration of the group’s networks, the capture of decryption keys, and their distribution to victims worldwide. However, this successful intervention faced challenges due to the underreporting of crimes by the group's victims, hindering the ability of agencies like the FBI to gain superior insights into the group's operations. Post the shutdown of the Hive ransomware operation, a new threat actor named Hunters International emerged, actively deploying Hive ransomware since October. Researchers from Quorum Cyber revealed this transition, though Hunters International denied being a rebranded Hive ransomware operation. Despite these denials, Hunters International has already targeted more than a dozen organizations globally, indicating the persistent threat posed by such cybercriminal groups.

Description last updated: 2024-10-15T09:20:15.109Z

What's your take? (Question 1 of 5)

Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.

Possible Aliases / Cluster overlaps

It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.

Alias Description	Votes
Hive is a possible alias for Hive Ransomware. Hive is a form of malware, specifically ransomware, designed to exploit and damage computer systems. It infiltrates systems through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, Hive can steal personal information, disrupt operations, or hold data hostag	10
Hunters International is a possible alias for Hive Ransomware. Hunters International, an active threat actor group since October of the previous year, has been identified as a significant cybersecurity concern. The group has taken over and rebranded the Hive ransomware, despite their disputes about this association. This development followed the disbandment of	4
Wazawaka is a possible alias for Hive Ransomware. Wazawaka, identified by the FBI as Mikhail Matveev, is a significant threat actor in the cybercrime landscape. Known for his affiliations with multiple ransomware groups, including LockBit, throughout 2020 and 2021, he became a central figure in the Babuk ransomware-as-a-service gang. Matveev's oper	2

Miscellaneous Associations

Other elements of context that could aid in the identification of relevance

Ransomware

Ransom

RaaS

Encryption

Malware

Cybercrime

Fbi

Windows

Antivirus

T1112

Linux

Esxi

Scam

Analyst Notes & Discussion

Be the first to leave your mark here! Log in to share your views and vote.

Associated Malware

To see the evidence that has resulted in these malware associations, create a free account

Alias Description	Association Type	Votes
The Lockbit Malware is associated with Hive Ransomware. LockBit is a malicious software, or malware, known for its damaging and exploitative functions. It infiltrates systems via dubious downloads, emails, or websites, often without the user's knowledge, and can steal personal information, disrupt operations, or hold data hostage for ransom. The LockBit	Unspecified	5
The QakBot Malware is associated with Hive Ransomware. Qakbot is a malicious software (malware) designed to exploit and damage computer systems. It infiltrates systems through suspicious downloads, emails, or websites, often unbeknownst to the user, with the potential to steal personal information, disrupt operations, or hold data for ransom. Built by d	Unspecified	2
The Nokoyawa Malware is associated with Hive Ransomware. Nokoyawa is a prominent malware, specifically ransomware, that has been linked to numerous cybercrime activities since it first emerged in 2022. It has been associated with various other malware families including Quantum, Royal, BlackBasta, and a variety of others such as Emotet, IcedID, CobaltStri	Unspecified	2
The Hunters Malware is associated with Hive Ransomware. Malware hunters, often referred to as bug hunters, play a critical role in cybersecurity by identifying and addressing vulnerabilities in software systems. In 2023, these professionals proved their worth at the Pwn2Own Toronto event where they identified 58 unique zero-day vulnerabilities, earning a	Unspecified	2
The Babuk Malware is associated with Hive Ransomware. Babuk is a form of malware, specifically ransomware, that infiltrates computer systems and encrypts files, rendering them inaccessible to the user. It typically infects systems through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, it can disrupt operatio	Unspecified	2
The TrickBot Malware is associated with Hive Ransomware. TrickBot is a notorious malware developed by cybercriminals to exploit and damage computer systems, often infiltrating through suspicious downloads, emails, or websites. This malicious software can steal personal information, disrupt operations, or even hold data hostage for ransom. Vladimir Dunaev,	Unspecified	2

Associated Threat Actors

To see the evidence that has resulted in these threatActor associations, create a free account

Alias Description	Association Type	Votes
The Mikhail Pavlovich Matveev Threat Actor is associated with Hive Ransomware. Mikhail Pavlovich Matveev, a Russian national also known by online monikers Wazawaka, m1x, Boriselcin, and Uhodiransomwar, has been identified as a major threat actor in the world of cybersecurity. Matveev is among five Russians charged in connection with Lockbit, a group widely recognized as one of	Unspecified	3
The Alphv Threat Actor is associated with Hive Ransomware. Alphv, also known as BlackCat, is a notable threat actor in the cybersecurity landscape. Originating from Russia, this cybercriminal group has been involved in multiple high-profile ransomware attacks, specifically targeting healthcare providers. They gained significant attention after stealing 5TB	Unspecified	3

Source Document References

Information about the Hive Ransomware Threat Actor was read from the documents corpus below. This display is limited to 20 results, create a free account to see more

Source Link	CreatedAt	Title
DARKReading	3 months ago	Hunters International Masks SharpRhino RAT as Legit Network Admin Tool
CERT-EU	a year ago	Hunters International targets Austal USA
CERT-EU	a year ago	Law Enforcement Disrupts BlackCat Ransomware Operation \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #ransomware
DARKReading	9 months ago	US Govt. Offers Millions in Bounties to Find Hive Ransomware Actors
CERT-EU	8 months ago	Navigating Ransomware Trends and Evolving Threats in the Cyber Landscape \| #ransomware \| #cybercrime \| National Cyber Security Consulting
CERT-EU	8 months ago	EquiLend Employee Data Breached After January Ransomware Attack \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #ransomware \| National Cyber Security Consulting
CERT-EU	8 months ago	Ransomware attacks are hitting critical infrastructure more often, FBI says
BankInfoSecurity	8 months ago	Banning Ransom Payments: Calls Grow to 'Figure Out' Approach
CERT-EU	8 months ago	These states generate the most cybercrime complaints \| #cybercrime \| #infosec \| National Cyber Security Consulting
CERT-EU	8 months ago	FBI: Cybercrime cost Americans over $12.5B in 2023 \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #ransomware \| National Cyber Security Consulting
CERT-EU	9 months ago	Cyber Security Today, Week in Review for week ending Friday, March 1, 2024 \| IT World Canada News
CERT-EU	9 months ago	LockBit Ransomware Gang Returns, Taunts FBI and Vows Data Leaks
CERT-EU	9 months ago	How the FBI and CISA look to mature the government’s top ransomware task force \| #ransomware \| #cybercrime \| National Cyber Security Consulting
CERT-EU	9 months ago	Public Extortion via Ransomware Spikes \| #hacking \| #cybersecurity \| #infosec \| #comptia \| #pentest \| #ransomware \| National Cyber Security Consulting
CERT-EU	9 months ago	Police arrest LockBit ransomware members, release decryptor in global crackdown
BankInfoSecurity	9 months ago	LockBit Infrastructure Seized By US, UK Police
BankInfoSecurity	9 months ago	LockBit Infrasttructure Seized By US, UK Police
Malwarebytes	9 months ago	Ransomware in 2023 recap: 5 key takeaways \| Malwarebytes
InfoSecurity-magazine	9 months ago	Malware-as-a-Service Now the Top Threat to Organizations
Unit42	10 months ago	Ransomware Retrospective 2024: Unit 42 Leak Site Analysis