Inside the Hive

Group-IB provides a technical analysis of the Hive Ransomware-as-a-Service: documenting its affiliate admin portal and DLS, estimating at least 355 victimized companies (48 publicly listed on the leak site), describing initial access methods (vulnerable RDP, compromised VPN credentials, phishing), and detailing cross-platform Go-based ransomware builds (Windows/Linux/FreeBSD/ESXi) including encryption and key-export mechanics; the report also supplies SHA-256 IOCs and YARA rules to aid detection and hunting.