Hive ransomware

Reported Context (7)

An initial look at the offending IP addresses resulted in some hits via Maltrail, which indicated that the IP in question was associated with Hive ransomware: Huntress Traces RDP Brute Force to Suspected Ransomware Infrastructure
According to the FBI MATVEEV is linked to several ransomware variants, including LockBit, Hive and Babuk. Major Cybercrime Arrests and Takedowns Mark 2024 Law-Enforcement Push
Hive ransomware was first observed in June 2021 and uses an affiliate RaaS model. Ransomware Groups Evolved Tactics and Expanded Extortion in 2022
being the top target. Their tactics, techniques, and procedures (TTPs) are similar to those used by the Hive and Nokayawa ransomware families, including the use of AdFind, a command-line query tool used to gather OWASSRF Exploit Bypasses Exchange Mitigations to Enable Remote Code Execution
Hive Talos Q3 2021 Report: Ransomware Dominated Incident Response Engagements

CVE (4)

Malware (40)

People (20)

Threat Actors (34)

MITRE ATT&CK (29)

Vendors (4)

Products (14)

Tools (18)

Industries (25)

Countries (12)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.