R
Ransomwhere.org
Live MapLatest VictimsGroups
PaymentsTTPsIdentifyNewsDataAPI
LIVE
Ransomwhere.org

Real-time ransomware intelligence platform. Tracking threat actors, victims, and payments to raise awareness and help defend against ransomware attacks worldwide.

Platform

  • Live Map
  • Latest Victims
  • Groups
  • Payments
  • Identify
  • News

Resources

  • Data & Methodology
  • API Docs
  • NoMoreRansom
  • Ransomware.live
  • CISA Advisories

Data sourced from Ransomware.live API. For informational purposes only.

© 2026 Ransomwhere.org

Groups/hive

hive

Inactive

Hive is a strain of ransomware that was first discovered in June 2021. Hive was designed to be used by Ransomware-as-a-service providers, to enable novice cyber-criminals to launch ransomware attacks on healthcare providers, energy providers, charities, and retailers across the globe. In 2022 there was a switch from GoLang to Rust.

208
Victims
3
Sites

Known Leak Sites

hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onionDLS
hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onionChat
hiveapi4nyabjdfz2hxdsr7otrcv6zq6m4rk5i2w7j64lrtny4b7vjad.onionDLS

Victims (208)

Live
R C Stevens Construction
hive
G.W. Becker
hive
Consulate Health Care
hive
Centro Médico Virgen De La Caridad
hive
Camst Group
hive
MHMR Authority Of Brazos Valley
hive
Alvaria
hive
Interface
hive
North Idaho College
hive
Innovative Education Management
hive
Dixons Allerton Academy
hive
City Of Huntsville, Texas
hive
JAKKS Pacific Inc
hive
Stolle Machinery
hive
Mark-Taylor
hive
Expand Group
hive
KNOX College
hive
INTERSPORT France
hive
Guilford College
hive
Norman Public Schools
hive
Hydro-Gear & Agri-Fab
hive
LCMH
hive
MCCROSSAN
hive
APM Terminals
hive
TCQ
hive

Top Targeted Countries

Unknown134
United States34
United Kingdom8
Netherlands3
Canada2

Profile

:
:
:

Activity

Total victims208
Countries affected28
Last seen