Hive ransomware targets healthcare and critical infrastructure
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Hive RaaS has victimized 1,300+ organizations since June 2021, exploiting VPN/RDP access and Exchange vulnerabilities to encrypt systems and extort millions.
Hive is a ransomware-as-a-service operation with confirmed activity from June 2021 through November 2022, targeting government facilities, communications, critical manufacturing, information technology, and especially healthcare organizations. Over 1,300 victims have paid approximately $100 million in ransom. Threat actors gain initial access via single-factor RDP/VPN credentials, phishing with malicious attachments, or exploitation of Microsoft Exchange and FortiOS vulnerabilities—including CVE-2020-12812, which bypasses MFA by manipulating username case. Post-compromise, Hive disables antivirus, removes Volume Shadow Copies, clears event logs, and exfiltrates data using Rclone and Mega.nz before encrypting files with a machine-specific key. The malware variants target Windows, Linux, VMware ESXi, and FreeBSD. Victims receive ransom demands in Bitcoin via a TOR-hosted chat panel, with reinfection reported when organizations decline to pay. FBI, CISA, and HHS recommend immediate patching of known exploited vulnerabilities, enforcement of phishing-resistant MFA, network segmentation, offline immutable backups, and aggressive monitoring of remote access and command-line activity.
Mentioned in this report
Detection guidance
Volume Shadow Copy Deletion via Vssadmin or WMIC
Detects deletion of Volume Shadow Copies through vssadmin or wmic, a common ransomware step to inhibit recovery and used by Hive before encryption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Volume Shadow Copy Deletion via Vssadmin or WMIC
description: Detects vssadmin or wmic commands that delete shadow copies, a typical
ransomware pre-encryption step that inhibits system recovery. Matches on the command
pattern, not a specific sample.
tags:
- attack.impact
- attack.t1490
logsource:
category: process_creation
product: windows
detection:
selection_vssadmin:
Image|endswith: \vssadmin.exe
CommandLine|contains|all:
- delete
- shadows
selection_wmic:
Image|endswith: \wmic.exe
CommandLine|contains|all:
- shadowcopy
- delete
condition: 1 of selection_*
falsepositives:
- Backup or storage maintenance scripts that intentionally purge shadow copies
- Administrators reclaiming disk space on servers
level: high
id: 04016ff9-63f6-5328-8d7b-a6a5eba508ae
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-321a
Windows Event Log Clearing via Wevtutil or PowerShell
Detects clearing of Windows event logs using wevtutil or PowerShell, used by Hive operators to remove evidence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Windows Event Log Clearing via Wevtutil or PowerShell
description: Detects event log clearing through wevtutil cl or Clear-EventLog, consistent
with ransomware operators removing indicators after compromise.
tags:
- attack.stealth
- attack.t1070
logsource:
category: process_creation
product: windows
detection:
selection_wevtutil:
Image|endswith: \wevtutil.exe
CommandLine|contains:
- ' cl '
- clear-log
selection_ps:
Image|endswith:
- \powershell.exe
- \pwsh.exe
CommandLine|contains: Clear-EventLog
condition: 1 of selection_*
falsepositives:
- Administrators clearing logs during troubleshooting or image preparation
- Golden image build scripts
level: medium
id: d37648b5-c199-567a-b037-f9fb08b6f622
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-321a
Defender Real-Time Protection Disabled via Registry or PowerShell
Detects commands disabling Microsoft Defender protection, matching Hive's behaviour of disabling antivirus before encryption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Defender Real-Time Protection Disabled via Registry or PowerShell
description: Detects command lines that disable Microsoft Defender real-time monitoring
via Set-MpPreference or registry modification of Windows Defender policy keys, matching
ransomware defence-impairment before encryption.
tags:
- attack.defense-impairment
- attack.t1685
- attack.t1112
logsource:
category: process_creation
product: windows
detection:
selection_ps:
CommandLine|contains|all:
- Set-MpPreference
- $true
CommandLine|contains:
- DisableRealtimeMonitoring
- DisableBehaviorMonitoring
- DisableIOAVProtection
selection_reg:
Image|endswith: \reg.exe
CommandLine|contains|all:
- Windows Defender
- add
- /d 1
CommandLine|contains:
- DisableAntiSpyware
- DisableRealtimeMonitoring
condition: 1 of selection_*
falsepositives:
- Administrators temporarily disabling Defender for software testing
- Third-party AV installers turning off Defender during deployment
level: high
id: ab5c5d8c-bfe1-527b-888e-e2c8e15ae323
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-321a
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-321a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs