# Hive ransomware targets healthcare and critical infrastructure

Published: 2025-07-21 · Severity: high · Sectors: healthcare, government-national, telecommunications, manufacturing, technology, defense
Canonical: https://vorant.io/reports/0219c799-d9ef-5b65-a483-f38b16048a11/hive-ransomware-targets-healthcare-and-critical-infrastructure

> Hive RaaS has victimized 1,300+ organizations since June 2021, exploiting VPN/RDP access and Exchange vulnerabilities to encrypt systems and extort millions.

Hive is a ransomware-as-a-service operation with confirmed activity from June 2021 through November 2022, targeting government facilities, communications, critical manufacturing, information technology, and especially healthcare organizations. Over 1,300 victims have paid approximately $100 million in ransom. Threat actors gain initial access via single-factor RDP/VPN credentials, phishing with malicious attachments, or exploitation of Microsoft Exchange and FortiOS vulnerabilities—including CVE-2020-12812, which bypasses MFA by manipulating username case. Post-compromise, Hive disables antivirus, removes Volume Shadow Copies, clears event logs, and exfiltrates data using Rclone and Mega.nz before encrypting files with a machine-specific key. The malware variants target Windows, Linux, VMware ESXi, and FreeBSD. Victims receive ransom demands in Bitcoin via a TOR-hosted chat panel, with reinfection reported when organizations decline to pay. FBI, CISA, and HHS recommend immediate patching of known exploited vulnerabilities, enforcement of phishing-resistant MFA, network segmentation, offline immutable backups, and aggressive monitoring of remote access and command-line activity.

## Mentioned in this report

- Vulnerabilities: CVE-2020-12812 (KEV), CVE-2021-31207 (KEV), CVE-2021-34473 (KEV), CVE-2021-34523 (KEV)
- Threat actors: Hive
- Malware: Hive

## Detection guidance (public sample)

### Volume Shadow Copy Deletion via Vssadmin or WMIC

ATT&CK: T1490

Detects deletion of Volume Shadow Copies through vssadmin or wmic, a common ransomware step to inhibit recovery and used by Hive before encryption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Volume Shadow Copy Deletion via Vssadmin or WMIC
description: Detects vssadmin or wmic commands that delete shadow copies, a typical
  ransomware pre-encryption step that inhibits system recovery. Matches on the command
  pattern, not a specific sample.
tags:
- attack.impact
- attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: \vssadmin.exe
    CommandLine|contains|all:
    - delete
    - shadows
  selection_wmic:
    Image|endswith: \wmic.exe
    CommandLine|contains|all:
    - shadowcopy
    - delete
  condition: 1 of selection_*
falsepositives:
- Backup or storage maintenance scripts that intentionally purge shadow copies
- Administrators reclaiming disk space on servers
level: high
id: 04016ff9-63f6-5328-8d7b-a6a5eba508ae
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-321a
```

### Windows Event Log Clearing via Wevtutil or PowerShell

ATT&CK: T1070

Detects clearing of Windows event logs using wevtutil or PowerShell, used by Hive operators to remove evidence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Windows Event Log Clearing via Wevtutil or PowerShell
description: Detects event log clearing through wevtutil cl or Clear-EventLog, consistent
  with ransomware operators removing indicators after compromise.
tags:
- attack.stealth
- attack.t1070
logsource:
  category: process_creation
  product: windows
detection:
  selection_wevtutil:
    Image|endswith: \wevtutil.exe
    CommandLine|contains:
    - ' cl '
    - clear-log
  selection_ps:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains: Clear-EventLog
  condition: 1 of selection_*
falsepositives:
- Administrators clearing logs during troubleshooting or image preparation
- Golden image build scripts
level: medium
id: d37648b5-c199-567a-b037-f9fb08b6f622
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-321a
```

### Defender Real-Time Protection Disabled via Registry or PowerShell

ATT&CK: T1685

Detects commands disabling Microsoft Defender protection, matching Hive's behaviour of disabling antivirus before encryption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Defender Real-Time Protection Disabled via Registry or PowerShell
description: Detects command lines that disable Microsoft Defender real-time monitoring
  via Set-MpPreference or registry modification of Windows Defender policy keys, matching
  ransomware defence-impairment before encryption.
tags:
- attack.defense-impairment
- attack.t1685
- attack.t1112
logsource:
  category: process_creation
  product: windows
detection:
  selection_ps:
    CommandLine|contains|all:
    - Set-MpPreference
    - $true
    CommandLine|contains:
    - DisableRealtimeMonitoring
    - DisableBehaviorMonitoring
    - DisableIOAVProtection
  selection_reg:
    Image|endswith: \reg.exe
    CommandLine|contains|all:
    - Windows Defender
    - add
    - /d 1
    CommandLine|contains:
    - DisableAntiSpyware
    - DisableRealtimeMonitoring
  condition: 1 of selection_*
falsepositives:
- Administrators temporarily disabling Defender for software testing
- Third-party AV installers turning off Defender during deployment
level: high
id: ab5c5d8c-bfe1-527b-888e-e2c8e15ae323
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-321a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-321a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/0219c799-d9ef-5b65-a483-f38b16048a11/hive-ransomware-targets-healthcare-and-critical-infrastructure.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup