Skip to main content
Back to the takedown index

Hive ransomware infiltration and seizure

July 2022, Ransomware
Led by Federal Bureau of Investigation

Verified core entry, last reviewed August 21, 2026

What was taken down?

Covert access to the Hive network for approximately seven months; more than 300 decryption keys provided to victims under active attack and more than 1,000 additional keys distributed to previous victims; leak site and payment site seized; servers seized in Germany and the Netherlands.[1][2]

See what happened

What happened to the people?

No individual outcomes are recorded against this entry.
Group accounted for: Partial

See people and accountability

Did it stay down?

After this action the service returned under a new name, first seen October 2023. No later seizure of the replacement is recorded. Medium confidence in the link between the two.

See what happened afterward

FBI covertly penetrated Hive's network in July 2022, captured decryption keys for roughly seven months, and then seized the group's servers and dark-web sites with German and Dutch partners.[1][2]

Announced January 26, 2023.

Date
July 1, 2022 to January 26, 2023
Target
Hive, ransomware as a service
Activity
Ransomware
Operational lead
FBI
Partners
USAO-MDFL, BKA, and 2 more[1][2]
Jurisdiction
United States, Germany, Netherlands, and European Union
Outcome
Covert access to the Hive network for approximately seven months; more than 300 decryption keys provided to victims under active attack and more than 1,000 additional keys distributed to previous victims; leak site and payment site seized; servers seized in Germany and the Netherlands.
Status
Completed
Legal mechanism
US seizure warrants (Middle District of Florida); German and Dutch judicial process; Europol support
Group accounted for
Partial

Infrastructure

2 onion services seized and 1 admin panel taken over. Servers seized, with no count in the record.

approximately 2
onion services seized
1
admin panel taken over
Identifier Recorded as Status Notes
Not published Server Seized Servers seized in Germany and the Netherlands. Exact count not published.[1]
Not published approximately 2 onion services Seized Leak site and victim payment site seized and replaced with a joint seizure notice.[1]
Not published 1 admin panel Taken over FBI held covert access to the Hive network from July 2022, extracting decryption keys for approximately seven months before the seizure.[1]

Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources.

No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved.

Group accounted for: Partial

Infrastructure was seized and victims protected, but no operator was charged or arrested and a technically related operation appeared within months.

Core administrator group never publicly identified.

See the organizations and roles behind this action

No arrests announced with the action. Researchers subsequently linked Hunters International to the Hive codebase.[1][2]

  1. October 2023

    Hunters International. Rebrand. Confidence: Medium. No later seizure recorded.[1]

    Multiple independent technical analyses reported substantial code overlap with the Hive encryptor. The successor group publicly stated it purchased the source code rather than being a rebrand of the same operators.

October 2023

Hunters International. Rebrand. Confidence: Medium. No later seizure recorded.[1]

Multiple independent technical analyses reported substantial code overlap with the Hive encryptor. The successor group publicly stated it purchased the source code rather than being a rebrand of the same operators.

Return class C. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. How this index handles it.

Numbered markers throughout this entry link to the source that supports the claim beside them.

Official sources

  1. [1]
    U.S. Department of Justice Disrupts Hive Ransomware Variant

    United States Department of Justice, January 26, 2023, Source grade P1

    Covert network access from July 2022, more than 300 decryption keys to victims under attack and more than 1,000 to previous victims, approximately 130 million USD in ransom demands averted, German and Dutch server seizures

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

  2. [2]
    Europol statement on the Hive ransomware takedown

    Europol, January 26, 2023, Source grade P2

    International coordination and German and Dutch participation

    No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher.

Coverage note.
  • DOJ reported preventing approximately 130 million USD in ransom demands.
  • Approximately 1,500 victims in more than 80 countries and roughly 100 million USD collected are official estimates.
  • The Hunters International relationship is DISPUTED. Multiple technical analyses found substantial code overlap, while the successor group publicly claimed it purchased the source code rather than being a rebrand. Both positions are preserved.