Description
Hive is a ransomware as a service operation active from mid 2021 until late 2022, known for targeting critical infrastructure such as healthcare and energy providers. Its affiliates exfiltrated data before encryption, demanded payment through negotiators, and published stolen material on a leak site when victims refused. An international law enforcement operation seized its infrastructure in early 2023, and researchers later released decryption keys that helped many victims recover.
Stats
- First seen
- February 2022
- Last seen
- October 2026
Alert name variants
| Alert Name |
|---|
| Binary.Ransomware.Hive |
| Email-MIME.Ransomware.Hive |
| Gen:Variant.Ransom.Hive.1 |
| Gen:Variant.Ransom.Hive.119 |
| Gen:Variant.Ransom.Hive.14 |
| Gen:Variant.Ransom.Hive.2 |
| Gen:Variant.Ransom.Hive.31 |
| Gen:Variant.Ransom.Hive.32 |
| Gen:Variant.Ransom.Hive.35 |
| Gen:Variant.Ransom.Hive.42 |
Related blogs
