Hive
Attribution profile
- Type
- Crime Syndicate
- Location
- Russia
- Known incidents
- 46 incidents
- Sources
- 48 sources
- First seen
- 2020-01-10
- Last seen
- 2025-03-15
- Updated
- 2026-10-13 11:42
- Aliases
- 4 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Hive ransomware group, also known as EpsilonRed or Epsilon Red Group, is a ransomware‑as‑a‑service operation that emerged in June 2021 and is believed to operate from Russia. The group seeks financial gain through double‑extortion tactics, stealing sensitive data before encrypting systems and threatening to publish the stolen information if a ransom is not paid. It primarily targets healthcare providers, educational institutions, and various commercial sectors across multiple countries. Initial access is frequently obtained via phishing emails with malicious attachments, after which the actors move laterally, exfiltrate files, and deploy ransomware to encrypt Windows, Linux and FreeBSD servers while attempting to delete backups. Publicly reported incidents include attacks on Memorial Health System, Partnership HealthPlan of California, Consulate Health Care, Lake Charles Memorial Health System, Guilford College, Bell Canada subsidiary, Damart clothing stores, and the Guatemalan Customs Service via APM Terminals. FBI advisories have linked Hive to over 1,300 compromised organizations worldwide and estimated ransom proceeds of approximately US $100 million as of November 2022.
Incidents
Attributed incidents are available to members.
46 incidentsSources
Sources available to members: 48 sources.