Hive emerged in June 2021 as a Ransomware-as-a-Service (RaaS) operation, rapidly gaining prominence for its aggressive tactics and high-profile attacks, particularly targeting healthcare and public health (HPH) entities. The group is assessed with moderate confidence to be of Russian or Eastern European origin, with some members having previously been associated with the Conti ransomware group. Its primary motivation is financial gain through a double extortion model. What sets Hive apart is its rapid evolution, including a shift in 2022 from GoLang to Rust programming for its ransomware, and its ultimate disruption in January 2023 by an unprecedented FBI infiltration operation that successfully provided decryption keys to victims, averting significant ransom payments.

Aliases del actor

UNC[X]aunque no siempre se asocian con actores específicosGamaredon GroupBlueAlphaShuckwormACTINIUMPrimitive BearTriton UrsaIron TildenHive0051ha sido asociado con operaciones de ciberespionajeperturbación de sistemas críticosAPT DEATHSTALKERactiniumapt-c-53armageddonbluealphagammadropgammaloadglowsandglowsparkhive0051primitive bearpterodoshuckwormapt10earth kashagalliumnoopldrstone pandaapolloshadowatg26

Actores similares

apt-noisybearactor · 1APT29 (Cozy Bear)actor · 1Energetic Bearapt · 0Boulder Bearapt · 0Pat Bearapt · 0White Bearapt · 0apt-desertfalconactor · 1apt-stealthfalconactor · 1Stone Pandaapt · 0Bearlyfyapt · 0

Sectores atacados

URLs nuevas detectadas en IntelTracker