Hive

Hive (also known as the Hive ransomware group) was a ransomware as a service (RaaS) operation carried out by the eponymous cybercrime organization between June 2021 and January 2023. The group's purpose was to attack mainly public institutions to subsequently demand ransom for release of hijacked data. In January 2023, following a joint US–German investigation involving 13 law enforcement agencies, the United States announced that the FBI had "hacked the hackers" over several months, resulting in seizure of the Hive ransomware group's servers, effectively shuttering the criminal enterprise. The Hive ransomware group had extorted over $100 million from about 1,500 victims in more than 80 countries when dismantled by law enforcement. The investigation continues, with the US State Department adding a $US10 million bounty for information linking Hive ransomware to any foreign government. Method of operation Hive employed a wide variety of tactics, techniques, and procedures (TTPs), creating significant challenges for defense and mitigation. According to the Federal Bureau of Investigation (FBI), it functioned as affiliate-based ransomware, using multiple mechanisms to compromise business networks, including phishing emails with malicious attachments to gain access, and Remote Desktop Protocol (RDP) once a network was infiltrated. Using locker malware and operating as a RaaS platform, Hive used Double Extortion techniques, in which operators install locker malware to take the data of a victim entity, then encrypt it so that it becomes useless to the victims for conducting business. Group operators then threaten to publish the stolen data on its dark web Tor site – HiveLeaks – unless the ransom is paid. The group has also used "triple extortion" tactics, seeking to extort money from anyone affected by a data disclosure of the victim organization's data. The Hive mainly targets energy, healthcare, financial, media, and education sectors, and became notorious for attacking and crippling critical infrastructure. According to cybersecurity firm Paloaltonetworks in late 2022, the ransomware drops two batch scripts: hive.bat, which tries to delete itself, then shadow.bat, which deletes any shadow copies of the system. It then adds a .hive extension to encrypted files, along with its ransom note, entitled "HOW_TO_DECRYPT.txt", which lists instructions for preventing data loss.