Hive
From extortion.wiki, the ransomware notes archive
2 archived notes associated with the upstream family directory hive. The family label follows ThreatLabz; any link to negotiation records uses an explicit archive alias mapping.
Archived note files
2 supported · 0 skipped| Original filename | File type | Content hash | Source | Internal archive |
|---|---|---|---|---|
| hive.txt | Plain text (.txt) | 8fd1c3e0cec8ab56… | Upstream file | Read archived source |
| HOW_TO_DECRYPT.txt | Plain text (.txt) | c7e07b6df1ded26a… | Upstream file | Read archived source |
Negotiation records
Threat actor page: HiveAn explicit archive alias maps the ThreatLabz family Hive to the Ransomchats actor label Hive. Note and negotiation counts remain separate.
| Participants | Source | Archive status | |||
|---|---|---|---|---|---|
| 20211220 | 24 | Hive, Victim | JSON | Indexed | |
| 20211213 | 15 | Hive, Victim | JSON | Indexed | |
| 20211126 | 4 | Hive | JSON | Indexed | |
| 20211113 | 136 | Hive, Victim | JSON | Indexed | |
| 20211102 | 58 | Hive, Victim | JSON | Indexed | |
| 20211026 | 46 | Hive, Victim | JSON | Indexed | |
| 20211005 | 19 | Hive, Victim | JSON | Indexed | |
| 20211004 | 70 | Hive, Victim | JSON | Indexed |
Dataset provenance and citation
| Upstream collector | Zscaler ThreatLabz |
|---|---|
| Source repository | ThreatLabz/ransomware_notes |
| Source directory | hive |
| Snapshot commit | 2bbf5b4ecda84837c4a71af1a99c6821920f051a |
| Dataset snapshot | Jun 26, 2026, 10:27 PM |
| Synchronization time | Jul 22, 2026, 11:47 AM |
| Source status | Complete |
| License | MIT; preserved notice |
| Stable internal citation | extortion.wiki. Hive ransomware notes. ThreatLabz/ransomware_notes snapshot 2bbf5b4ecda84837c4a71af1a99c6821920f051a. https://extortion.wiki/notes/hive/. |