Hive (Windows)
- First seen
- 2021-06-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Profile updated
- 2026-07-07 13:02:36
Targeted industries: healthcare-and-pharmaceutical energy-and-utilities education-and-nonprofits retail-and-hospitality
Context
Hive is a strain of ransomware that was first discovered in June 2021. Hive was designed to be used by Ransomware-as-a-service providers, to enable novice cyber-criminals to launch ransomware attacks on healthcare providers, energy providers, charities, and retailers across the globe. In 2022 there was a switch from GoLang to Rust.
Reports & references
- Microsoft — Ransomware As A Service Understanding The Cybercrime Gig Economy And How To Protect Yourself (report)
- advintel.io — Enter Karakurt Data Extortion Arm Of Prolific Ransomware Group (report)
- Microsoft — Re54L7V (report)
- sentinelone.com — Nokoyawa Ransomware New Karma Nemty Variant Wears Thin Disguise (report)
- Broadcom/Symantec — Sed Fy22Q2 Ses Ransomware Threat Landscape Wp (report)
- Kaspersky — 106824 (report)
- Palo Alto Unit 42 — Emerging Ransomware Groups (report)
- s3.amazonaws.com — Ransomware Chats (report)
- threatstop.com — First Conti Then Hive Costa Rica Gets Hit With Ransomware Again (report)
- Cisco Talos — Conti And Hive Ransomware Operations (report)
- s3.amazonaws.com — Ransomware Chats (report)
- Broadcom/Symantec — Ransomware Hive Conti Avoslocker (report)
- advintel.io — Discontinued The End Of Conti S Brand Marks New Chapter For Cybercrime Landscape (report)
- bleepingcomputer.com — Microsoft Exchange Servers Hacked To Deploy Hive Ransomware (report)
- bleepingcomputer.com — Hive Ransomware Ports Its Linux Vmware Esxi Encryptor To Rust (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Hive (report)
- Trend Micro — Ransomware Spotlight Hive (report)
- yoroi.company — Yoroi On The Footsteps Of Hive Ransomware (report)
- varonis.com — Hive Ransomware Analysis (report)
- arxiv.org — 2202.08477 (report)
- blog.group-ib.com — Hive (report)
- github.com — Hive (report)
- lifars.com — How To Decrypt The Files Encrypted By The Hive Ransomware (report)
- securityaffairs.co — Recover Files Hive Ransomware (report)
- thehackernews.com — Master Key For Hive Ransomware (report)