A joint advisory from CISA, FBI, and the Department of Health and Human Services documented the scale and technical details of Hive ransomware operations through November 2022, by which point Hive affiliates had victimized over 1,300 organizations worldwide and collected approximately US$100 million in ransom payments. Operating as a ransomware-as-a-service (RaaS) since June 2021, Hive has targeted Government Facilities, Communications, Critical Manufacturing, IT, and — disproportionately — Healthcare and Public Health (HPH) organizations.
Initial Access: RDP, VPN, Phishing, and Exchange Exploitation
Because Hive follows the RaaS affiliate model, initial access methods vary by operator. Observed vectors include single-factor RDP and VPN logins, and exploitation of CVE-2020-12812 in FortiOS — a flaw allowing authentication bypass by changing the case of the username to skip the FortiToken second factor. Hive actors have also exploited three Microsoft Exchange vulnerabilities in combination: CVE-2021-31207 (Security Feature Bypass), CVE-2021-34473 (Remote Code Execution), and CVE-2021-34523 (Privilege Escalation). Phishing emails with malicious attachments round out the observed initial access techniques.
Pre-Encryption: Defense Destruction and Shadow Copy Removal
Before encrypting files, Hive ransomware executes a structured defense destruction sequence: it identifies and terminates backup, antivirus, anti-spyware, and file copying processes; stops Volume Shadow Copy services and deletes all existing shadow copies via vssadmin or PowerShell; deletes Windows System, Security, and Application event logs; and removes virus definitions and disables Windows Defender and other common AV products via registry modifications. This sequence eliminates both real-time protection and recovery options before a single file is encrypted.
Data Exfiltration and the HiveLeaks Double Extortion Platform
Hive actors exfiltrate data using Rclone combined with the Mega.nz cloud storage service prior to encryption. Victims who refuse to pay face public disclosure through the "HiveLeaks" Tor site, as well as additional anonymous file-sharing platforms including anonfiles.com, send.exploit.in, ufile.io, sendspace.com, and privatlab.net. Ransom demands are negotiated in USD — ranging from several thousand to millions of dollars depending on victim — with payment required in Bitcoin. Hive actors are known to reinfect victims who restore their networks without paying, using either Hive or an alternative ransomware variant.
Encryption Mechanics and Cross-Platform Variants
During encryption, Hive creates a *.key file in the root directory (C:\ or /root/) that exists only on the encrypted machine and cannot be reproduced — making its preservation critical for any decryption attempt. The ransom note HOW_TO_DECRYPT.txt, dropped into each affected directory, explicitly warns victims not to modify, rename, or delete the key file. Victims contact Hive through a TOR-accessible "sales department" link for live chat negotiation; some victims also reported receiving direct phone calls or emails from Hive actors. Beyond Windows, Hive maintains known variants for Linux, VMware ESXi, and FreeBSD — enabling attacks against virtualized infrastructure and diverse server environments.