An infection with HIVE is marked by your systems displaying a notice similar to the one shown here, with the attackers - a specialised cybercrime group - holding your compromised systems and stolen data hostage until a ransom is paid.
If you discover a physical break-in at your office, your instinct would be to call the police, avoid disturbing the scene, and allow them to investigate and gather evidence.
A cyber-attack demands the same response. Your digital environment is a crime scene, and preserving it is critical for a thorough forensic investigation.
This is not a job for your IT team or MSP. Digital forensic specialists are available 24/7 to assist you.
First identified in June 2021, HIVE is a notorious cybercriminal group with a global presence. Operating as an affiliate-based ransomware variant, it follows a Ransomware-as-a-Service (RaaS) model, allowing affiliates to deploy its malware as they see fit. Known for its sophisticated and aggressive tactics, HIVE has gained a reputation for indiscriminate attacks across all sectors, including critical infrastructure and nonprofit organisations.
HIVE employs common ransomware tactics, techniques, and procedures (TTPs) to compromise victims' systems. During the attack, the operator disables anti-malware protections, exfiltrates sensitive data, and encrypts business files. HIVE then leaves a plain-text ransom note that threatens to publish the victim's data on the TOR site 'HiveLeaks' unless the victim complies with the attackers' demands.
Affiliates of HIVE have been known to use a variety of methods to breach victim networks, including phishing emails with malicious attachments, stolen VPN credentials, and exploiting vulnerabilities in externally facing systems.
HIVE resort to double extortion tactics to amplify the impact and urgency of their demands. In a double extortion scheme, the perpetrators not only encrypted victims' files but also threaten to leak stolen data if the ransom is not paid.
This dual-threat strategy significantly increases the pressure on the victim organisation to comply with the ransom demands.
HIVE emerged in 2021 and before being dismantled by the FBI it targeted high value sectors such as healthcare, retail, finance and energy providers, as well as nonprofits across Europe, the USA and Asia.
To date, HIVE has claimed 208 victims.
Solace Cyber’s track record includes hundreds of successful response recoveries, providing Digital Forensic Incident Response services, 24x7x365.
"Globally, critical infrastructure faced over 420 million cyberattacks between January and December 2023, averaging 13 attacks per second, marking a 30% increase from 2022."
Solace Global was founded in 2010 as global experts in risk management and security, offering services such as Travel, Crisis, and Offshore Risk Management. With a 24/7 Security Operations Centre and an in-house intelligence team providing daily and weekly reports, Solace Global is accredited to ISO 27001, 14001, 45001, and 9001 standards.
Solace Cyber was established in 2021, specialising in Cyber breaches, particularly Digital Forensics and Incident Response, Ransomware, Risk Management, and Information Security, along with Managed Security Services. The leadership team collectively possess over 20 years of experience in the IT and security industry.
Solace Cyber is accredited to ISO 27001 and in 2022 gained the prestigious Cyber Incident Response (Level 2) accreditation with the National Cyber Security Centre in 2022. This accreditation represents the UK’s highest cyber security standards, providing top-tier incident response support and recovery.
s
%+
A forensic analysis needs to be meticulous and a clean restore and recovery requires a wealth of experience not normally available in an in-house team who must provide a broader range of IT support skills:
Solace Cyber was established precisely for this scenario. We have a well-defined process for handling cyber-attacks like HIVE which involves a 6-step approach:
It includes a thorough digital forensic analysis from step 2 where the output becomes a central component of business recovery. This is because understanding the attack is of critical importance:
It is critical that the analysis of digital evidence is carried out to an agreed plan. This will have been designed to provide the best and earliest chance of discovering a root cause, which is essential to inform remediation/eradication and recovery as well as supporting a legal take-down case if this is applicable. A legal take-down means we can assist in the legal enforcement that stops the criminals from publishing the data, thus undermining the ransom notice.
Solace’s Digital Forensic and Incident Response teams maintain consistent communication throughout. Dedicated Incident Managers and technical engineering leads provide updates during the Cyber Incident Response journey, utilising risk registers and working within change management processes, all from triage through to post-incident, delivering successful business recovery.
The HIVE ransomware entered your system by one of several ways:
We recommend you adopt policies to:
After recovering from a HIVE ransom attack, Solace Cyber recommends that you update your business continuity plan to account for lessons learnt during this attack & recovery.
Most ransomware breaches cost approximately £500K, while smaller email data breaches typically cost around £50K. There is a critical balance between preserving the environment for forensic analysis and quickly recovering it to minimise business interruption. The costs increase the longer it takes to identify and resolve the breach.
A cyber security insurance claim is complex, covering reasonable expenses for investigating and remediating an incident, along with legal fees, business interruption, criminal liability, employment liability, and ransom payments. Although the insurance industry is responsible for facilitating business recovery, cyber insurance is viewed as volatile, and many policies are not being validated correctly.
Finding your way through demands expertise, and that's where Solace Cyber can offer assistance.
Criminal organisations like HIVE are paid by affiliates to launch cyber-attacks using their specific brand of malware that is known for its swift and efficient encryption capabilities. Even if the ransom is paid, the likelihood of having files decrypted and data restored is minimal, underscoring the necessity of employing a ransomware incident response team.
The NCSC have documented the deliberations for paying ransomware: https://www.ncsc.gov.uk/ransomware/home
Important Reminder: It is a criminal offense to pay money to people who are subject to financial sanctions. The list of who is subject to financial sanctions is constantly changing.
The latest iteration can be found here: https://www.gov.uk/government/publications/financial-sanctions-consolidated-list-of-targets
Yes. There's a possibility that some of the lost data falls under the category of "Personal Data" belonging to your customers. It's your legal responsibility to safeguard this data, even if it has been lost. Additionally, you may need to notify the Information Commissioner's Office at https://ico.org.uk/.
Your insurer or legal counsel will provide guidance on the necessary steps and how to move forward in this situation.
Solace has experience collaborating with insurers and legal professionals and can offer support in managing this relationship during this challenging period.
A ransomware attack presents the most significant threat to your business by:
In the event of a business interruption, determining your position in the supply chain for any item and sustaining operations become challenges. If the disruption persists, maintaining business continuity becomes paramount. Moreover, upon restoration of systems and data, addressing any backlog of work and establishing operational protocols for the future becomes essential.
Ransomware ranks only behind receivership in terms of its capacity to incapacitate a business.
The NCSC is the UK National Cyber Security Centre. They provide cyber security guidance and support, helping to make the UK the safest place to live and work online. They have defined a Cyber Incident Response procedure and they have approved and accredited suppliers to provide this service.
As a recognised Assured Service Provider by the National Cyber Security Centre (NCSC), Solace Cyber provide comprehensive cyber risk management services that are designed to Protect, Detect & Mitigate cyber security threats across the UK.
Action Fraud is the UK's national reporting centre for fraud and cybercrime. Whether you have been scammed, defrauded, or experienced cybercrime in England, Wales, or Northern Ireland, Action Fraud offers a central point of contact for information on fraud and financially motivated cybercrime.
In the event of a HIVE ransom attack on your systems, STAY CALM.
DO NOT INTERACT WITH THEM, ATTEMPT TO RESTORE, OR OVERWRITE ANY DATA (explanation above).
Reach out to Solace Cyber at 01202 308818 or complete our form for a callback from one of our specialists.
We'll respond promptly to minimize your business's downtime.
Solace Cyber, part of Solace Global, helps companies across the UK recover from ransomware attacks and data breaches.
SOLACE GLOBAL CYBER LTD is registered in England & Wales no. 08830710
Solace Global
Twin Sails House,
W Quay Rd,
Poole, BH15 1JF
United Kingdom
