This domain has been seized
Data leak site
Checked 2026-08-22 08:18
Screenshot
Hive
Inactive for 3+ yr
Hive is a strain of ransomware that was first discovered in June 2021. Hive was designed to be used by Ransomware-as-a-service providers, to enable novice cyber-criminals to launch ransomware attacks on healthcare providers, energy providers, charities, and retailers across the globe.
In 2022 there was a switch from GoLang to Rust.
Victims
208
none this month
Rank
#32 / 388
all time
First victim
2021-08-14
estimated attack date
Last victim
2023-01-16
1399 days ago
Attack → claim
—
average delay
Countries
27
hit
Infostealer
71.4%
of victims with a domain
Victims per month
By estimated attack date when known, otherwise by discovery date.
Top sectors
Top countries
-
United States
37 · 18%
-
United Kingdom
8 · 4%
-
Netherlands
3 · 1%
-
Canada
2 · 1%
-
China
2 · 1%
-
Spain
2 · 1%
-
Brazil
2 · 1%
-
Indonesia
2 · 1%
-
Ireland
1 · 0%
-
South Africa
1 · 0%
What ransomware.live knows about hive
As commercial construction specialists in Orlando, we provide new construction and renovation servic…
***** DATA IS COMING SOON **** G.W. Becker, Inc. is a full service, single source, provider of choi…
Consulate Health Care is a leading provider of senior healthcare services, specializing in post-acut…
Grupo Centro Médico Virgen de la Caridad, a private health company with its own identity that was bo…
Camst Group is a company that specializes in restaurant services. It offers catering & banqueting, r…
The MHMR Authority of Brazos Valley is a public non-profit community MHMR center. Through the Texas …
Founded in 1933, North Idaho College is a community college in Coeur d'Alene, Idaho.…
Innovative Education Management (IEM) has been successfully developing and operating California char…
Dixons Allerton Academy (formerly Rhodesway Academy) is a coeducational all-through school and sixth…
JAKKS Pacific, Inc. is a multi-brand company that, since 1995, has been designing, developing, produ…
**** ALL BLUEPRINTS OF ALL PRODUCT LINES WILL BE AVAILABLE SOON **** Stolle is the world's leading s…
No description available
This domain has been seized
Negotiation chat
Checked 2026-08-22 08:18
Screenshot
This domain has been seized
Data leak site
Checked 2026-08-22 08:18
Screenshot
MITRE ATT&CK techniques
Initial Access
Execution
Credential Access
Discovery
Lateral Movement
Command and Control
Source: Crocodyli & Ransomware.live
Tools used
Discovery
Advanced IP ScannerBloodhoundSoftPerfect NetScan
RMM tools
AteraScreenConnectSplashtop
Defense evasion
GMERPCHunter
Offensive security
Cobalt StrikeImpacketMetasploitMeterpreterPowerShell Empire
LOLBAS
BCDEditBITSAdminWMICWindows Event Utility (wevtutil)
Exfiltration
MEGAPrivatLabRCloneSendspaceUFile
Source: Ransomware-Tool-Matrix
Hunting queries (KQL)
-
Hive – Recovery Disable (bcdedit) Paired with Windows Event Log Clearing
Shadow Copy Deletion
Sentinel
T1490
Ransom notes
Chats
8
leaked or shared
Paid
0
0% of the chats
Median ask
$1.1M
initial demand
Median final
$276K
after negotiation
Discount
29%
median reduction
Files analysed on analyze.ransomware.live
Files people submitted that match one of this group's IOCs or YARA rules. Each report is public.
| File | Verdict | Why | First seen | |
|---|---|---|---|---|
|
12389b8af28307fd…
ELF 64-bit LSB executable, x86-64, version 1 (SYSV) · 2.3 MB
|
malicious | YARA: Hive, Hive_v3, Linux_Ransomware_Hive_bdc7de59 | 2026-10-18 | Report |
|
822d89e7917d41a9…
ELF 64-bit LSB shared object, x86-64, version 1 (SYSV) · 246 KB
|
malicious | YARA: Hive, Hive_ESXI_v3 | 2026-10-18 | Report |
|
88f7544a29a2ceb1…
PE32 executable for MS Windows 6.01 (GUI), Intel i386... · 764 KB
|
malicious | YARA: Windows_Ransomware_Hive_55619cd0, Windows_Ransomware_Hive_b97ec33b | 2026-10-18 | Report |
|
bdf3d5f4f1b7c90d…
ELF 64-bit LSB executable, x86-64, version 1 (FreeBSD) · 2.4 MB
|
malicious | YARA: Hive, Hive_v3 | 2026-10-18 | Report |