Hive0106

Hive0106, also known as TA551, is a notable threat actor recognized for its association with ITG23, another prominent entity in the cybercrime landscape. This partnership has been observed since mid-2021 by X-Force, a cybersecurity firm. Hive0106's primary role is as a distribution affiliate, delivering malware through various methods such as email lures and hosting payloads on newly created malicious domains. The group's tactics include impersonating legitimate business emails to trick recipients into falling for their scams, a method reminiscent of Business Email Compromise (BEC) schemes. In late February 2022, X-Force discovered that Hive0106 used at least one ITG23 crypter repeatedly in conjunction with the Qakbot banking trojan, and at least once with the Gozi banking trojan. Both instances were likely executed by the ITG23 distribution affiliate Hive0106. Moreover, leaked chats have revealed that Hive0106, represented by the gtags 'zev', 'zem', and 'zvs', has provided crypted malware samples to other affiliates and partners, including Bentley, Cherry, Netwalker, and Zeus. Throughout September and October, Hive0106 resumed distributing the Trickbot malware using the 'zem' and 'zvs' gtags. However, researchers remain uncertain whether ITG23 directly controls the delivery of these malicious emails via dedicated personnel or if they are independently distributed by other affiliates like Hive0106 and Hive0107. Despite this uncertainty, Hive0106's activities demonstrate a sophisticated and organized approach to cybercrime, underscoring the need for robust cybersecurity measures.