Hive Ransomware
RaaS double/triple extortion
Source Attribution
- Origin
- MITRE
- Source
- FBI/CISA advisory AA22-321A
- Verified
- 2026-08-26T16:07:01.550Z
- Confidence
- high
Source: FBI/CISA advisory AA22-321A · Verified: 2026-08-26T16:07:01.550Z · Confidence: high
Security Timeline
- discovered Hive Ransomware first observed
- updated Encyclopedia entry reviewed (Phase 45C)
Quick Answer
Hive is a RaaS active 2021-2023 operating double extortion with a public leak site; disrupted by FBI. (attributes recorded from FBI/CISA advisory AA22-321A).
Definition
Hive is a RaaS active 2021-2023 operating double extortion with a public leak site; disrupted by FBI.
Overview
Hive is a RaaS active 2021-2023 operating double extortion with a public leak site; disrupted by FBI.
Behavior
- RDP access
- theft of data
- later DDoS pressure
First Seen
2021-06
Target
RaaS double/triple extortion
Malware Intelligence
Family: Hive Ransomware
Techniques: T1486, T1567, T1482
Targets: RaaS double/triple extortion
Behavior:
- RDP access
- theft of data
- later DDoS pressure
References
Have a follow-up question?
Ask AI about this Start an investigation Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.