extortion.wiki THE RANSOMWARE DOCUMENTARY ARCHIVE
Menu

242 negotiations · 332 notes · snapshots Jul 06, 2026 / Jun 26, 2026

Hive — 20211113

Dated record

From extortion.wiki, the ransomware negotiation research archive

A validated static rendering of 136 messages in source-array order. Transcript text is preserved without editorial additions.

Actor
Hive
Record date
Nov 13, 2021
Messages
136
Participants
Hive, Victim

Preserved messages

Actor / other Victim

Select a message number for a stable citation link. Text remains selectable; hard-wrapped source lines are joined for reading, intentional blank-line paragraph breaks remain, and written URLs remain inert.

  1. Message 001 From Hive Actor / other Date

    Hello and welcome to Hive. How may I help you?

  2. Message 002 From Victim Victim Date

    Hi, decryption key price?

  3. Message 003 From Victim Victim Date

    how many files are stolen? and can you share some file names?

  4. Message 004 From Victim Victim Date

    maybe no ones here

  5. Message 005 From Hive Actor / other Date

    Hello

  6. Message 006 From Hive Actor / other Date

    To decrypt your files you have to pay $20,000,000 in Bitcoin.

  7. Message 007 From Victim Victim Date

    thats way too much, can you please discount

    And please share the hash of the ransomware file so we can at least black list it. You have already stolen everything anyway

  8. Message 008 From Hive Actor / other Date

    We don't provide any hashes. Every time the software is unique. There is no need of hashes here. It will not help anyway.

  9. Message 009 From Hive Actor / other Date

    If you want a discount I would like to see for how much

  10. Message 010 From Victim Victim Date

    let me talk to the management

  11. Message 011 From Victim Victim Date

    share some file names?

  12. Message 012 From Hive Actor / other Date

    I'll share with you later when my teammate will be online.

  13. Message 013 From Victim Victim Date

    ok when should I log back in?

  14. Message 014 From Hive Actor / other Date

    I don't know. Maybe today

  15. Message 015 From Victim Victim Date

    ok

  16. Message 016 From Victim Victim Date

    please ask him/her to share the file names so I can have them when I login, its not easy to use TOR here

  17. Message 017 From Hive Actor / other Date

    Okay, I'll do my best

  18. Message 018 From Victim Victim Date

    thanks

  19. Message 019 From Hive Actor / other Date

    I have uploaded the list of exfiltrated files.

  20. Message 020 From Victim Victim Date

    where?

    I cant see them

  21. Message 021 From Victim Victim Date

    is it like 100G?

  22. Message 022 From Hive Actor / other Date

    It's at the left panel titled Uploaded files

  23. Message 023 From Hive Actor / other Date

    I uploaded a list of files not the files themselves

  24. Message 024 From Victim Victim Date

    yes got it, thanks

  25. Message 025 From Victim Victim Date

    you can delete it now

  26. Message 026 From Victim Victim Date

    Can you please share the hash of the ransomware. SO we can just add it to black list and ask the management for money. They are scared that the payload will come back. If you can't I understand but this will make th eprocess easy

  27. Message 027 From Hive Actor / other Date

    We are well-known organization. We honor our agreements. There is no point in the blacklist right now. You need to concentrate on how to collect money.

  28. Message 028 From Hive Actor / other Date

    I have another option for you. You will give me your email address (protonmail is preferred) and I'll send you new credentials to login. Then I'll upload the encryptor to VirusTotal and provide you a link to it. All necessary hashes will be available there. But to prevent others to login to your customer website you have to get new credentials first.

  29. Message 029 From Victim Victim Date

    Here [redacted]@protonmail.com

  30. Message 030 From Victim Victim Date

    just like you wanted... protonmail

  31. Message 031 From Victim Victim Date

    please keep your word, I will login again in a bit or check my email

  32. Message 032 From Victim Victim Date

    BTW, the site you guys made is beautiful. Better support than normal companies:)

  33. Message 033 From Hive Actor / other Date

    Thank you

  34. Message 034 From Victim Victim Date

    did you upload the file?

  35. Message 035 From Victim Victim Date

    and why did you change my creds... are you planing to hack me too?:(((((

  36. Message 036 From Hive Actor / other Date

    The encryptor didn't uploaded yet, looking for it rn.

  37. Message 037 From Hive Actor / other Date

    What do you mean about creds? From what?

  38. Message 038 From Victim Victim Date

    you change the credential to login to this site

  39. Message 039 From Hive Actor / other Date

    It was necessary because whether I upload the encryptor other researchers will be able to login and read your conversation.

  40. Message 040 From Hive Actor / other Date

    It's a potential data leakage so I have prevented it

  41. Message 041 From Victim Victim Date

    Thanks

  42. Message 042 From Victim Victim Date

    would you share the link here or email?

  43. Message 043 From Hive Actor / other Date

    Here is safe now

  44. Message 044 From Victim Victim Date

    ok

  45. Message 045 From Victim Victim Date

    why do you prefer protonmail?

  46. Message 046 From Victim Victim Date

    is it on tor?

  47. Message 047 From Hive Actor / other Date

    https://www.virustotal.com/gui/file/12baa6c83e6f8b059e7f14cb67bdad4e917b90bc8a139b5379a4b42a0c92a6be?nocache=1

  48. Message 048 From Victim Victim Date

    Thanks. I dont have virus total account but at least I got the hash. Really appreciat eit

  49. Message 049 From Victim Victim Date

    we have mcafee and symantec and nothing prevented this:(

  50. Message 050 From Hive Actor / other Date

    Actually I didn't spend too much time to hide it but I will

  51. Message 051 From Hive Actor / other Date

    What a recovery company are you from?

  52. Message 052 From Victim Victim Date

    not from company, directly the SOC team

  53. Message 053 From Hive Actor / other Date

    I got it

  54. Message 054 From Victim Victim Date

    working with the management to do something

  55. Message 055 From Victim Victim Date

    they may hire someone in hope of recovery.

  56. Message 056 From Hive Actor / other Date

    Unfortunately for them there are only two options: 1) start from a scratch 2) purchase the decryption software from us

  57. Message 057 From Victim Victim Date

    yes I have provided all the data

  58. Message 058 From Hive Actor / other Date

    Recovery companies no matter what they say can't decrypt.

  59. Message 059 From Victim Victim Date

    I understand but in the demo they show us how they can do the magic and impress the management

  60. Message 060 From Victim Victim Date

    THey told us that they will recover the keys from the memory and then decrypt files? is that possible?

  61. Message 061 From Hive Actor / other Date

    For ESXi servers it's not possible

  62. Message 062 From Victim Victim Date

    why not? please educate me to I can understand and tell the management not to waste time. We have way too many vendors here

  63. Message 063 From Hive Actor / other Date

    The encryptor software rewrites the key from memory.

  64. Message 064 From Victim Victim Date

    what?:(... liek in simple words please?

  65. Message 065 From Hive Actor / other Date

    Array of bytes in memory where the key resides in rewrites to prevent such operation

  66. Message 066 From Victim Victim Date

    Thats awesome. Is this for all servers or only esxi?

  67. Message 067 From Hive Actor / other Date

    For all of course

  68. Message 068 From Victim Victim Date

    so if we end-up hiring a company that charges us $400 an hour, its pretty much useless?

  69. Message 069 From Victim Victim Date

    BTW, the array of memory that you mentioned, these are the public keys or the private keys?

  70. Message 070 From Hive Actor / other Date

    Encryptor even don't know anything about private keys. It only has public keys. Public keys need to encrypt random field which uses in encryption process.

  71. Message 071 From Hive Actor / other Date

    In my opinion spending money to external IT companies will only waste your valuable time.

  72. Message 072 From Victim Victim Date

    Thanks, appreciate it. Its clear to me now

  73. Message 073 From Victim Victim Date

    Hey, how much data have you stolen 100Gig?

  74. Message 074 From Victim Victim Date

    And the price you provided $20,000,000 is way too much

  75. Message 075 From Victim Victim Date

    This is 20 million $?????

  76. Message 076 From Hive Actor / other Date

    Yes, your company has $2B revenue. We usually rate 1% of revenue

  77. Message 077 From Victim Victim Date

    :( And the total you have stolen in GB?

  78. Message 078 From Victim Victim Date

    I am guessing you used the VPN to get on the network. Did you steal the credentials after that? SYmantec and McAfee didn't prevent stealing credentials?

  79. Message 079 From Hive Actor / other Date

    We have 32 Gb total. Almost all AntiViruses are useless against real hackers.

  80. Message 080 From Victim Victim Date

    unfortunate but true

  81. Message 081 From Victim Victim Date

    For some reason the IT guy told us that they can see certain portion of files and they could be decrypted.

  82. Message 082 From Victim Victim Date

    I think you are only encrypting certain portion of files right? they can see the file content in bigger files

  83. Message 083 From Hive Actor / other Date

    There is a spotted encryption mechanism. If you are talking about ESXi files then I don't think they can. Some text files - yes

  84. Message 084 From Victim Victim Date

    I mean the big files are not fully encrypted. They are encypted at the header and then footer I think... but in the middle one can see the text.

  85. Message 085 From Hive Actor / other Date

    It's true. First 4Kb, the last, and a few blocks in the middle

  86. Message 086 From Victim Victim Date

    But this is nto true for ESXi files? everything for them is encrypted?

  87. Message 087 From Victim Victim Date

    also how efficient is your encryption process? are you faster than lockbit2.0?

  88. Message 088 From Victim Victim Date

    we also got one file for lockbit but was protected that was few weeks ago

  89. Message 089 From Hive Actor / other Date

    I didn't compare it with lockbit but my software is quite fast, especially ESXi

  90. Message 090 From Hive Actor / other Date

    How is it going with decision making?

  91. Message 091 From Victim Victim Date

    its slow, we provided all the data and making sure they understand the complexity

  92. Message 092 From Victim Victim Date

    But for the esxi part, you don't use partial encryption? and everything is encrypted?

  93. Message 093 From Victim Victim Date

    not just 4kb header etc

  94. Message 094 From Victim Victim Date

    can you please explain 2 things to understand. Explain a bit more on how you re-write the keys in the memory and the efficiency of esxi encryption. That way I can explain to everyone as well, that no hope for recovery

  95. Message 095 From Victim Victim Date

    most probly I will ask for discount shirtly

  96. Message 096 From Hive Actor / other Date

    It's very simple. ESXi files especially virtual drives are very fragile. Even few changes make them unreadable because it has a binary structure. ESXi was encrypted using spot method. 4 Kb of beginning of the files, 4 Kb of ending of the file and along file. Totally 100 Kb over the each file is encrypted. It's a quite enough.

  97. Message 097 From Victim Victim Date

    cool and the memory re-writing? as I understand you are not creating a new key for each file

  98. Message 098 From Victim Victim Date

    The memory overwrite is my last question. So I can make sure the SOC team understands

  99. Message 099 From Hive Actor / other Date

    When encryptor starts it creates a random field which will be used in encryption process. It is static. After encryption process finishes it rewrites to prevent restoration process. RSA keys private and public only use to encrypt/decrypt the random field. Only knowing the field it's possible to decrypt files. Encryptor has only public RSA keys, decryptor - private RSA keys.

  100. Message 100 From Victim Victim Date

    by random fields u mean aes?

  101. Message 101 From Hive Actor / other Date

    No, a truly cryptographic random field.

  102. Message 102 From Victim Victim Date

    like PRNG or truly random numbers?

  103. Message 103 From Hive Actor / other Date

    Of course not PRNG:)

  104. Message 104 From Victim Victim Date

    :(

  105. Message 105 From Victim Victim Date

    can you give me an example

  106. Message 106 From Victim Victim Date

    so you have the origanal private key. The ransomware generates fields that will encrypt files? are these fields used as keys? for aes?

  107. Message 107 From Victim Victim Date

    You are one smart guy

  108. Message 108 From Hive Actor / other Date

    Actually I already disclose you a lot of details which was never disclosed to anyone. I think it's enough to make a decision.

  109. Message 109 From Victim Victim Date

    Thanks

  110. Message 110 From Hive Actor / other Date

    AES is a chiper, I use a different one - some kind of Vernam's chiper. It's impossible to decrypt without knowing the keys.

  111. Message 111 From Victim Victim Date

    that means only one key will be used for all files and then re-written

  112. Message 112 From Victim Victim Date

    so no way to get back

  113. Message 113 From Hive Actor / other Date

    In simplified version the key used to encrypt all files. It exports to the disk using a few RSA public keys applied. Then encryption process follows. After that the key rewrites to prevent recovery from memory.

    Decryption software has RSA private keys to initially decrypt the exported key.

  114. Message 114 From Victim Victim Date

    Whats the BTC address or wallet?

  115. Message 115 From Hive Actor / other Date

    I made an offer at the right panel

  116. Message 116 From Victim Victim Date

    you came into the network via global protect. Are you still on the network?

  117. Message 117 From Hive Actor / other Date

    No

  118. Message 118 From Victim Victim Date

    you are very honest for a hacker

  119. Message 119 From Hive Actor / other Date

    We are all honest who works at Hive

  120. Message 120 From Victim Victim Date

    but they say you hacked hospitals like [redacted] etc

  121. Message 121 From Hive Actor / other Date

    Yes, we attack every targets, we have no limits here. It's not related with honesty

  122. Message 122 From Victim Victim Date

    Got it

  123. Message 123 From Victim Victim Date

    I think the time is up:(

  124. Message 124 From Hive Actor / other Date

    Don't worry you have time. Tell me how is it going with upper management please

  125. Message 125 From Victim Victim Date

    working on it, tough situation

  126. Message 126 From Hive Actor / other Date

    Hi, how is it going?

  127. Message 127 From Victim Victim Date

    good thanks

  128. Message 128 From Victim Victim Date

    how r u

  129. Message 129 From Hive Actor / other Date

    I'm good too. I just wanted to know to what direction your company inclined right now.

    By the way, what about a recovery process from memory from recovery company you told earlier?

  130. Message 130 From Victim Victim Date

    They think the recovery is possible

  131. Message 131 From Victim Victim Date

    also backup etc

  132. Message 132 From Hive Actor / other Date

    Let's play with the price. I think both your management and our side want to resolve this as quick as possible

  133. Message 133 From Victim Victim Date

    Whats the best price?

  134. Message 134 From Victim Victim Date

    I am not sure if 333 is even remotely possible

  135. Message 135 From Victim Victim Date

    They won't even consider 80 a possibility

  136. Message 136 From Hive Actor / other Date

    I can offer you $3,000,000 in Bitcoin.