Hive

First seen
2021-06-01 00:00:00
Malware type
ransomware
Family
Malware family
Last IoC activity
2026-07-22 02:02:50
Profile updated
2026-07-07 13:02:38

Targeted industries: healthcare-and-pharmaceutical

Context

First observed in June 2021, Hive ransomware was originally written in GoLang but recently, new Hive variants have been seen written in Rust. Targets Healthcare sector.

Detection coverage

  • 6 YARA rules

Detection rules

  • MALPEDIA_Win_Hive_Auto (yara-rule)
  • DITEKSHEN_MALWARE_Win_Firebirdrat (yara-rule)
  • DITEKSHEN_MALWARE_Win_Hive (yara-rule)
  • DITEKSHEN_INDICATOR_KB_Gobuildid_Hive (yara-rule)
  • SEKOIA_Malware_Valleyrat_Strings_Config (yara-rule)
  • SIGNATURE_BASE_HKTL_Bluehammer_Apr26 (yara-rule)

Reports & references

  • Microsoft — Ransomware As A Service Understanding The Cybercrime Gig Economy And How To Protect Yourself (report)
  • advintel.io — Enter Karakurt Data Extortion Arm Of Prolific Ransomware Group (report)
  • blogs.vmware.com — Esxi Targeting Ransomware The Threats That Are After Your Virtual Machines Part 1 (report)
  • Microsoft — Re54L7V (report)
  • sentinelone.com — Nokoyawa Ransomware New Karma Nemty Variant Wears Thin Disguise (report)
  • Broadcom/Symantec — Sed Fy22Q2 Ses Ransomware Threat Landscape Wp (report)
  • media.kasperskycontenthub.com — Common Ttps Of The Modern Ransomware Low Res (report)
  • Kaspersky — 106824 (report)
  • bleepingcomputer.com — The Week In Ransomware April 1St 2022 I Can Fight With A Keyboard (report)
  • Palo Alto Unit 42 — Emerging Ransomware Groups (report)
  • s3.amazonaws.com — Ransomware Chats (report)
  • threatstop.com — First Conti Then Hive Costa Rica Gets Hit With Ransomware Again (report)
  • Cisco Talos — Conti And Hive Ransomware Operations (report)
  • s3.amazonaws.com — Ransomware Chats (report)
  • Broadcom/Symantec — Ransomware Hive Conti Avoslocker (report)
  • advintel.io — Discontinued The End Of Conti S Brand Marks New Chapter For Cybercrime Landscape (report)
  • bleepingcomputer.com — Microsoft Exchange Servers Hacked To Deploy Hive Ransomware (report)
  • bleepingcomputer.com — Hive Ransomware Ports Its Linux Vmware Esxi Encryptor To Rust (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Hive (report)
  • sentinelone.com — Hive Attacks Analysis Of The Human Operated Ransomware Targeting Healthcare (report)
  • Trend Micro — Ransomware Spotlight Hive (report)
  • Microsoft — Hive Ransomware Gets Upgrades In Rust (report)
  • yoroi.company — Yoroi On The Footsteps Of Hive Ransomware (report)
  • varonis.com — Hive Ransomware Analysis (report)
  • inf.news — C28D9382Ab78A5Ac3D8Fc802F3F0F1E0 (report)

External references