Hive ransomware

Hive was a ransomware-as-a-service operation active from June 2021 until law enforcement took its sites down in January 2023. Early Windows builds rename each file to the original name plus a long random string and .hive, and later builds swap .hive for five random characters such as .z61yt. Every encrypted folder gets HOW_TO_DECRYPT.txt, sometimes with a four-character prefix like 1uZ5_HOW_TO_DECRYPT.txt. A key file ending in .key is written to the root of the drive and is needed for any recovery. The note links to a Tor chat panel called the sales department. A free tool for Hive versions 1 to 4 is published by KISA, the Korea Internet and Security Agency, through No More Ransom. Hive went after businesses and critical infrastructure, healthcare above all, and had hit more than 1,300 organisations by November 2022. Affiliates got in through RDP and VPN logins without MFA, a FortiOS MFA bypass (CVE-2020-12812), Exchange flaws (CVE-2021-31207, CVE-2021-34473, CVE-2021-34523) and phishing attachments. Before encrypting, the malware ends backup and security processes, deletes shadow copies and clears event logs. Data was stolen with Rclone and Mega and leaked on HiveLeaks. From July 2022 the FBI sat inside Hive's servers and handed decryption keys to more than 1,300 victims before seizing the leak and payment sites on 26 January 2023.

Sources: No More Ransom, KISA

File extensions: .4g3j7, .8b5lc (files are also appended with a random character string), .a1tft, .hive, .z61yt

Contact addresses: Brookslambert[@]protonmail[.]com, Sheppardarmstrong[@]tutanota[.]com

Decryptor: A decryptor exists but covers only some builds. Checked 2026-10-29.

Scope: KISA's free integrated Hive tool on No More Ransom handles Hive versions 1 to 4 only, and for version 2 only files ending `.w2tnk` or `.uj1ps`. It needs the attacker-encrypted key file left on the C drive plus an infected file with its original copy, and KISA warns full recovery is not always possible. Builds after version 4 are outside its scope.

Data exfiltration risk: Confirmed — Hive affiliates copied victim data out before encrypting and posted it on the HiveLeaks site and on anonymous file-sharing services when victims did not pay. The leak and payment sites were seized in January 2023.

Systems typically targeted: Corporate Windows networks first, plus ESXi, Linux and FreeBSD builds. Backup processes are stopped and shadow copies wiped before encryption.

Do this first: Every Hive decryption path, paid or free, depends on the per-machine key file written to C:\ or /root, and it cannot be recreated once lost. Keep the HOW_TO_DECRYPT.txt note and sample files so the build can be matched against the KISA tool's supported versions. Reset credentials for RDP, VPN and Exchange accounts, since these were common ways in.

From the ransom note NOKOYAWA_readme.txt:

Dear [redacted], your files were encrypted, some are compromised. Be sure, you can't restore it without our help. You need a private key that only we have. Contact us to reach an agreement or we will leak your black shit to media: Brookslambert[@]protonmail[.]com Sheppardarmstrong[@]tutanota[.]com ??????,???????,??????? ???,?????????,???????? ??????????????? ?????????,???????????????: […]

Link to decryptor: KISA