Skip to content
brandefense.io
Request A Demo
RansomwareFinancialAdvanced sophistication · Organisation

Hive

Hive is a ransomware group with a financial motive, tracked by Brandefense. It targets 19 sectors, including Government and Technology, in 31 countries, including the United States and the United Kingdom. It uses 6 MITRE ATT&CK techniques and exploits 6 known CVEs.

Also known as
  • hive Team
Request IOC feedRequest ATT&CK export
Techniques
6
Exploited CVEs
6
First seen
Nov 9, 2021
Last seen
Dec 9, 2025
Record updated

Who They Target.

Sectors · 19
Countries · 31
Labelsdata-leak-sitedouble-extortionhiveleakslaw-enforcement-disruptionraasransomware

About Hive.

Hive is a strain of ransomware that was first discovered in June 2021. Hive was designed to be used by Ransomware-as-a-service providers, to enable novice cyber-criminals to launch ransomware attacks on healthcare providers, energy providers, charities, and retailers across the globe. In 2022 there was a switch from GoLang to Rust.

Last updated Oct 1, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.