hive Ransomware
Tracked since Aug 14, 2021
0
victims recorded
0
in the last 30 days
3
CVEs
—
Last activity
Hive is a strain of ransomware that was first discovered in June 2021. Hive was designed to be used by Ransomware-as-a-service providers, to enable novice cyber-criminals to launch ransomware attacks on healthcare providers, energy providers, charities, and retailers across the globe.
In 2022 there was a switch from GoLang to Rust.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
- CVE-2021-34523 Critical · 9.0 KEV Microsoft Exchange Server Privilege Escalation Vulnerability
- CVE-2021-34473 Critical · 9.1 KEV Microsoft Exchange Server Remote Code Execution Vulnerability
- CVE-2021-31207 Medium · 6.6 KEV Microsoft Exchange Server Security Feature Bypass Vulnerability
Tactics and techniques (MITRE ATT&CK)
Initial Access
T1078 Valid Accounts: Remote Desktop ProtocolT1190 Exploit Public-Facing ApplicationT1566.001 Phishing: Spearphishing Attachment Execution
T1059.001 Command and Scripting Interpreter: PowerShellT1059.003 Command and Scripting Interpreter: Windows Command Shell Defense Evasion
T1070.001 Indicator Removal: Clear Windows Event LogsT1562.001 Disable or Modify Tools Credential Access
T1003.001 OS Credential Dumping: LSASS Memory Discovery
T1046 Network Service Discovery Lateral Movement
T1021.001 Remote Services: Remote Desktop ProtocolT1021.002 Remote Services: SMB/Windows Admin Shares Exfiltration
T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage Command and Control
T1219 Remote Access Software Impact
T1486 Data Encrypted for ImpactT1490 Inhibit System Recovery Observed tools
Defense Evasion
GMER · PCHunter
Discovery Enum
Advanced IP Scanner · Bloodhound · SoftPerfect NetScan
Exfiltration
MEGA · PrivatLab · RClone · Sendspace · UFile
LOLBAS
BCDEdit · BITSAdmin · WMIC · Windows Event Utility (wevtutil)
Offsec
Cobalt Strike · Impacket · Metasploit · Meterpreter · PowerShell Empire
RMM-Tools
Atera · ScreenConnect · Splashtop
Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live