Hive Ransomware: How It Worked, How It Fell, What Defenders Learned

Hive was a ransomware-as-a-service operation that hit more than 1,500 victims in over 80 countries before the FBI quietly infiltrated it and handed decryption keys back to its targets. It ran from June 2021 until its infrastructure was seized in January 2023, and it leaned heavily on hospitals and other healthcare providers. This profile explains what Hive was, how its affiliates got in and caused damage, why the takedown still matters, and what defenders should check today. It is written for security operations, incident response and threat intelligence teams, and it draws on the joint FBI, CISA and HHS advisory and the US Department of Justice announcement. For the probable successor operation, see the Hunters International Threat Actor Profile.

Key takeaways

• Remote access was the front door. The advisory lists single-factor RDP and VPN logins, a FortiOS MFA bypass (CVE-2020-12812) and the ProxyShell family of Exchange flaws as initial access routes.
• Recovery was the target before encryption. Affiliates deleted shadow copies, stopped backup processes, disabled Microsoft Defender through the registry and cleared Windows event logs.
• Double extortion was standard. Data was exfiltrated, likely with Rclone to Mega.nz, and victims were threatened with publication on the HiveLeaks Tor site.
• The takedown was an infiltration, not just a seizure. The FBI had access from late July 2022, gave more than 1,300 keys to victims and, according to DOJ, prevented about US$130 million in ransom payments.
• The brand died, the tradecraft did not. Group-IB assesses with moderate confidence that Hunters International is a Hive rebrand, so Hive detections remain relevant.

What it is

Hive was a ransomware-as-a-service (RaaS) operation: a core team built and maintained the encryptor, the negotiation portal and the leak site, while affiliates broke into networks and deployed the payload in exchange for a share of the ransom. The model is explained in the Ransomware-as-a-Service Business Model Guide.

The joint advisory AA22-321A, published by the FBI, CISA and the Department of Health and Human Services on 17 November 2022, records Hive affiliate activity from June 2021 through at least November 2022. At that date the FBI counted more than 1,300 victim companies worldwide and roughly US$100 million in ransom payments. Hive is not catalogued as a software entry in MITRE ATT&CK v20, so the technique mapping on this page comes from the advisory itself.

How it works

The advisory describes a consistent sequence. Each stage below is mapped to the ATT&CK v20 technique it represents, with the control that most directly breaks it. The mapping uses current v20 IDs: the advisory's 2022 defence evasion technique has since been revoked, and the equivalent behaviour now sits under T1685 Disable or Modify Tools.

The extortion stage

After encryption, Hive dropped a ransom note named HOW_TO_DECRYPT.txt in each affected directory and pointed victims to a Tor-hosted "sales department" chat panel. The advisory also notes some victims were phoned or emailed directly. Demands were set in US dollars and paid in Bitcoin, ranging from several thousand to millions of dollars. A key file with a .key extension was written to the root of each encrypted system (C:\ or /root/), and that file was needed for decryption. Affiliates threatened publication on HiveLeaks and also used anonymous file-sharing services to leak data. Leak site mechanics are covered in the Ransomware Leak Sites and Victim Shaming Guide.

ESXi and Linux variants

Hive built encryptors for Linux, FreeBSD and VMware ESXi alongside Windows. Encrypting hypervisor datastores takes down every virtual machine on a host at once, which is why ESXi management access deserves the same protection as domain controllers. See the ESXi Ransomware Playbook.

Why it matters

Hive is historic as a brand but current as a lesson, for four reasons.

• Healthcare exposure: The advisory singled out Healthcare and Public Health, where downtime affects patient care. The Threat Actors Targeting Healthcare Guide places Hive among the groups that shaped that sector's risk.
• Reinfection risk: The advisory states Hive reinfected networks that had been restored without paying. Restoring from backup without first removing the attacker's access is not recovery.
• A model for disruption: According to DOJ, the FBI was inside Hive's networks from late July 2022, passed more than 300 decryption keys to victims under active attack and more than 1,000 to earlier victims, and then, with German and Dutch partners and Europol support, seized the servers and websites in January 2023. Reporting early to law enforcement is what put victims within reach of those keys. See the Ransomware Decryptors guide.
• Continuity of tradecraft: The Ransomware Family Lineage and Rebrands Guide shows how code and people move between brands. Hunting for Hive behaviours still catches its successors.

Detection and measurement

Most Hive stages leave evidence that a well-configured logging pipeline catches before encryption.

Useful measures: percentage of remote access paths enforcing phishing-resistant MFA (target 100 percent); median days to patch KEV-listed edge vulnerabilities; percentage of servers forwarding Security and PowerShell logs off host; time from shadow copy deletion alert to containment; and date of the last successful full restore test for critical systems.

Framework mapping

Common misconceptions

• "Hive is gone, so this is history." The infrastructure was seized, but the advisory's techniques are generic RaaS tradecraft and the probable successor uses related code.
• "We have MFA, so the VPN is safe." CVE-2020-12812 let users skip the second factor by changing the case of the username. MFA that has not been tested against edge cases, or that exempts some accounts, is the gap. The Colonial Pipeline breach shows how one forgotten VPN account without MFA can be enough.
• "Restoring from backup ends the incident." Hive reinfected restored networks. Eviction comes before restoration.
• "Paying gets the data back and keeps it private." Payment funds the next attack and does not guarantee deletion. Before any payment decision, read the Ransomware Payments and Sanctions Guide.
• "Cleared logs mean no evidence." Only if logs stayed on the host. Central collection defeats local clearing.

Related concepts

Hive sits within a wider set of ransomware topics. The group's healthcare focus links to sector regulation and reporting duties. Its reliance on exposed RDP connects it to the Exposed RDP Compromise guide, and its data theft links to data extortion without encryption. Identity is central throughout: the entry point was usually a remote access account, so remote access and admin identities, including service accounts used by backup tools, belong in scope for MFA, least privilege and just-in-time access. The Backup Identity Isolation Guide covers keeping backup admin credentials out of reach of a compromised domain.

Rolling out Hive-informed defences

1. Week 1, close the doors: Inventory every internet-facing remote access service, remove any RDP exposure on 3389/TCP, and confirm phishing-resistant MFA is enforced on VPNs, webmail and backup consoles.
2. Week 2, patch the edge: Check FortiOS, Exchange and other edge devices against KEV, patch, then hunt for signs of earlier exploitation.
3. Weeks 2 to 4, see the precursors: Enable PowerShell script block logging and Sysmon, forward Security logs centrally, and deploy alerts for the signals above in audit mode first. Tune false positives from backup software before moving to blocking.
4. Month 2, protect recovery: Move backups to immutable or offline storage with separate credentials, and run a full restore test.
5. Ongoing, rehearse: Run a tabletop on a Hive-style scenario using the Ransomware Playbook Template. Any new blocking control should have a documented rollback, such as a policy exclusion for a named backup process.

Smaller organisations can get most of the benefit from the first two steps and immutable backups. Larger ones should add EDR tamper protection, egress controls on file-sharing services and a 24x7 path to contain hosts.

Practitioner checklist

• Confirm no RDP is reachable from the internet and that every VPN and remote gateway enforces phishing-resistant MFA with no exempt accounts.
• Verify FortiOS, Exchange and other edge systems are patched for the CVEs in AA22-321A and hunt for prior compromise.
• Enable endpoint agent tamper protection and alert on DisableAntiSpyware or DisableAntiVirus registry changes.
• Alert on vssadmin shadow copy deletion, bcdedit recovery changes and Security Event ID 1102.
• Forward Windows Security, System and PowerShell logs off host in near real time.
• Block or alert on Rclone and uploads to file-sharing services that the business does not use.
• Keep immutable, offline backups with separate admin credentials and test full restores.
• Treat ESXi management interfaces as tier zero and keep them off general user networks.
• Include law enforcement contact (FBI field office, CISA or national equivalent) in the incident plan, so decryption help can reach you early.

Standards and references

• FBI, CISA and HHS: #StopRansomware: Hive Ransomware (AA22-321A)
• US Department of Justice: U.S. Department of Justice Disrupts Hive Ransomware Variant
• Europol: Cybercriminals stung as HIVE infrastructure is shut down
• CISA: Known Exploited Vulnerabilities Catalog
• MITRE ATT&CK: Inhibit System Recovery
• MITRE ATT&CK: External Remote Services
• NIST: SP 800-53 Rev. 5
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: Hunters International Threat Actor Profile · Ransomware Groups Guide · Ransomware Prevention Guide · Ransomware Response and Recovery Guide