hive Ransomware
Monitorado desde 14/08/2021
0
vítimas registradas
0
nos últimos 30 dias
3
CVEs
—
Última atividade
Hive is a strain of ransomware that was first discovered in June 2021. Hive was designed to be used by Ransomware-as-a-service providers, to enable novice cyber-criminals to launch ransomware attacks on healthcare providers, energy providers, charities, and retailers across the globe.
In 2022 there was a switch from GoLang to Rust.
Vulnerabilidades citadas para este grupo
CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.
- CVE-2021-34523 Crítica · 9.0 KEV Microsoft Exchange Server Privilege Escalation Vulnerability
- CVE-2021-34473 Crítica · 9.1 KEV Microsoft Exchange Server Remote Code Execution Vulnerability
- CVE-2021-31207 Média · 6.6 KEV Microsoft Exchange Server Security Feature Bypass Vulnerability
Táticas e técnicas (MITRE ATT&CK)
Initial Access
T1078 Valid Accounts: Remote Desktop ProtocolT1190 Exploit Public-Facing ApplicationT1566.001 Phishing: Spearphishing Attachment Execution
T1059.001 Command and Scripting Interpreter: PowerShellT1059.003 Command and Scripting Interpreter: Windows Command Shell Defense Evasion
T1070.001 Indicator Removal: Clear Windows Event LogsT1562.001 Disable or Modify Tools Credential Access
T1003.001 OS Credential Dumping: LSASS Memory Discovery
T1046 Network Service Discovery Lateral Movement
T1021.001 Remote Services: Remote Desktop ProtocolT1021.002 Remote Services: SMB/Windows Admin Shares Exfiltration
T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage Command and Control
T1219 Remote Access Software Impact
T1486 Data Encrypted for ImpactT1490 Inhibit System Recovery Ferramentas observadas
Defense Evasion
GMER · PCHunter
Discovery Enum
Advanced IP Scanner · Bloodhound · SoftPerfect NetScan
Exfiltration
MEGA · PrivatLab · RClone · Sendspace · UFile
LOLBAS
BCDEdit · BITSAdmin · WMIC · Windows Event Utility (wevtutil)
Offsec
Cobalt Strike · Impacket · Metasploit · Meterpreter · PowerShell Empire
RMM-Tools
Atera · ScreenConnect · Splashtop
Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas. · Ver no ransomware.live