What was Hive ransomware?

Hive was a ransomware-as-a-service operation active from June 2021 until early 2023. In joint advisory AA22-321A of 17 November 2022, CISA, the FBI and the US health department reported that it had victimised over 1,300 companies worldwide and received about 100 million US dollars in ransom payments, with a particular impact on health care. Its affiliates got in through remote-desktop and VPN accounts without MFA, through phishing and through known vulnerabilities in internet-facing servers. On 26 January 2023 the US Justice Department announced that the FBI had secretly infiltrated Hive's network since July 2022, giving decryption keys to more than 300 victims under attack and over 1,000 earlier victims, before seizing its servers with support from German and Dutch police and Europol. Hive shows what a takedown can do for victims, and also its limits: researchers later reported Hive code reused in a new ransomware brand.

← All 25 questions on Ransomware groups and familiesAll topics