HiveMalware
First observed in June 2021, Hive ransomware was originally written in GoLang but recently, new Hive variants have been seen written in Rust. Targets Healthcare sector.From MISP Galaxy
Last reported 2 days ago, by CERT-FR16 reports
ATT&CK techniques
6 of 63 · each with the sentence it comes from- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: PowerShell”
- T1110Brute Force
“T1110”
- T1486Data Encrypted for Impact
“T1486”
- T1489Service Stop
“T1489”
- T1490Inhibit System Recovery
“T1490”
- T1027Obfuscated Files or Information
“T1027”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
16 reports, newest first · the exact sentence from each-
Multiples vulnérabilités dans les produits Papercut (23 octobre 2026)“PaperCut Hive toutes versions antérieures à 2.3.0.”
-
The adversary economy: How threat actors are reacting to PHP2Shell“…ent agencies have demonstrated both the capability and the willingness to exploit criminal infrastructure, as the FBI’s operation against Hive ransomware and multiple forum takedowns have shown.”
-
Cómo opera una estafa de inversión que utiliza medios falsos, figuras públicas y la identidad de una empresa financiera real“El análisis realizado con Hive Detection asignó un 99% de probabilidad a que el contenido hubiera sido generado o manipulado mediante IA.”
-
Flash Alert: From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira“Monitor wbadmin abuse for NTDS.dit/Hive dumping:”
-
Exploiting Trust: How Signed Drivers Fuel Modern Kernel Level Attacks on Windows“POORTRY was used by Cuba, Hive, and LockBit ransomware.”
-
Ransomware Initial Access Brokers Exposed“…nitial look at the offending IP addresses resulted in some hits via Maltrail, which indicated that the IP in question was associated with Hive ransomware:”
-
The beginning of the end: the story of Hunters International“Former Hive’s operators may have been involved in the Hunters International’s administration.”
-
2025 Cybersecurity Threat Report“Ransomware is fragmenting: Despite takedowns of large groups like Hive and LockBit, smaller, flexible affiliates have risen to fill the gap.”
-
Encrypted Symphony: Infiltrating the Cicada3301 Ransomware-as-a-Service Group“Cicada3301 are not the only ones who prefer Rust – Hive, RansomExx, ALPHV, Qilin (Agenda), and Luna have also been observed adopting this programming language.”
-
Ransomware manager: Investigation into farnetwork, a threat actor linked to five strains of ransomware“During the chat, farnetwork wondered why Hive had not taken all payments, which could indicate that farnetwork has interacted with Hive in some way.”
-
The Qilin Ransomware: Analysis and Protection Strategies“Rust* A cross-platform programming language used by Qilin along with other nefarious ransomware gangs such as Hive, Blackcat, Luna, etc.”
-
The old way: BabLock, new ransomware quietly cruising around Europe, Middle East, and Asia“…ed multithread encryption is also implemented in ransomware such as LockBit 3.0 / BlackMatter, DarkSide, REvil, and the latest version of Hive v6.”
-
Know Thy Enemy: unraveling the “Hi-Tech Crime Trends 2022/2023” report“In July 2021, for example, the criminal group Hive attacked the MediaMarkt chain of consumer electronics stores and demanded a ransom of $240 million.”
-
Ave Maria and the Chambers of Warzone RAT“Reviewing the Foothold Details, we are able to see the persistence created within the Hive Current Users Run Key.”
-
Elastic Security uncovers BLISTER malware campaign“/* Machine Hive */ "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",”
-
Inside the Hive“Inside the Hive”
Indicators in its reports
named in the reports above- exploit[.]inin 1 report
- hxxps://www.papercut[.]com/kb/Main/security-bulletin-sep-2026/in 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.