The Demon Hive, Queen of an Infiltrated Hive

Legend

Appearing in June 2021, it targeted hospitals, schools and critical infrastructure among others, extorting more than 1,500 victims. From July 2022 the FBI was inside its network, quietly passing decryption keys to victims. In January 2023, with Germany and the Netherlands, it seized its servers.

Exorcism

Cast it out by patching exposed VPNs and firewalls and protecting RDP. If hit, talk to law enforcement: sometimes, as here, they already have the keys.

Technical record

Circle

Circle III · Ransomware and extortion

First seen

2021

Status

Exorcised (Hive takedown, 2023-01-26)

Weapons (exploited CVEs)

Saint ProxyShell, Who Entered Through Exchange

Works

The Miracle of the Emptied Hive

Ransomware-as-a-service first seen in June 2021 that targeted hospitals, schools, financial firms and critical infrastructure, extorting over 1,500 victims. The FBI infiltrated its network in July 2022, passed decryption keys to victims, and with German and Dutch partners seized its servers in January 2023. It is believed to have rebranded as Hunters International.