[Back to the takedown index](https://takedownindex.org/takedowns) # Hive ransomware infiltration and seizure July 2022, Ransomware Led by [Federal Bureau of Investigation](https://takedownindex.org/organizations/federal-bureau-of-investigation) Verified core entry, last reviewed August 21, 2026 What was taken down? Covert access to the Hive network for approximately seven months; more than 300 decryption keys provided to victims under active attack and more than 1,000 additional keys distributed to previous victims; leak site and payment site seized; servers seized in Germany and the Netherlands.[[1]](#source-1)[[2]](#source-2) [See what happened](#what-happened) What happened to the people? No individual outcomes are recorded against this entry. Group accounted for: Partial [See people and accountability](#people) Did it stay down? After this action the service returned under a new name, first seen October 2023. No later seizure of the replacement is recorded. Medium confidence in the link between the two. [See what happened afterward](#afterward) ## What happened FBI covertly penetrated Hive's network in July 2022, captured decryption keys for roughly seven months, and then seized the group's servers and dark-web sites with German and Dutch partners.[[1]](#source-1)[[2]](#source-2) Announced January 26, 2023. **Date:** July 1, 2022 to January 26, 2023 **Target:** Hive, ransomware as a service **Activity:** Ransomware **Operational lead:** FBI **Partners** USAO-MDFL, BKA, and 2 more[[1]](#source-1)[[2]](#source-2) - [United States Attorney's Office for the Middle District of Florida](https://takedownindex.org/organizations/united-states-attorney-s-office-for-the-middle-district-of-florida), prosecuting - [Bundeskriminalamt](https://takedownindex.org/organizations/bundeskriminalamt), infrastructure seizure - [National High Tech Crime Unit](https://takedownindex.org/organizations/national-high-tech-crime-unit), infrastructure seizure - [European Union Agency for Law Enforcement Cooperation](https://takedownindex.org/organizations/european-union-agency-for-law-enforcement-cooperation), supporting **Jurisdiction:** United States, Germany, Netherlands, and European Union **Outcome:** Covert access to the Hive network for approximately seven months; more than 300 decryption keys provided to victims under active attack and more than 1,000 additional keys distributed to previous victims; leak site and payment site seized; servers seized in Germany and the Netherlands. **Status:** Completed **Legal mechanism:** US seizure warrants (Middle District of Florida); German and Dutch judicial process; Europol support **Group accounted for:** Partial ### Infrastructure 2 onion services seized and 1 admin panel taken over. Servers seized, with no count in the record. | Identifier | Recorded as | Status | Notes | | --- | --- | --- | --- | | Not published | Server | Seized | Servers seized in Germany and the Netherlands. Exact count not published.[[1]](#source-1) | | Not published | approximately 2 onion services | Seized | Leak site and victim payment site seized and replaced with a joint seizure notice.[[1]](#source-1) | | Not published | 1 admin panel | Taken over | FBI held covert access to the Hive network from July 2022, extracting decryption keys for approximately seven months before the seizure.[[1]](#source-1) | Domains and onion addresses are shown defanged. Where the record gives a count but no identifier, the count is shown in place of one. This list carries only what appears in the cited sources. ## People and accountability No individual is named against this entry in the cited record. That is a gap in what has been published rather than a finding that nobody was involved. Group accounted for: Partial Infrastructure was seized and victims protected, but no operator was charged or arrested and a technically related operation appeared within months. Core administrator group never publicly identified. [See the organizations and roles behind this action](https://takedownindex.org/takedowns/hive-ransomware-infiltration-and-seizure/organizations) ## What happened afterward No arrests announced with the action. Researchers subsequently linked Hunters International to the Hive codebase.[[1]](#source-1)[[2]](#source-2) October 2023 Hunters International. Rebrand. Confidence: Medium. No later seizure recorded.[[1]](#source-1) Multiple independent technical analyses reported substantial code overlap with the Hive encryptor. The successor group publicly stated it purchased the source code rather than being a rebrand of the same operators. Return class C. The class is a research grading carried in the source dataset and its scale is not published, so this page relies on the relationship and confidence values instead. [How this index handles it](https://takedownindex.org/about). ## Sources Numbered markers throughout this entry link to the source that supports the claim beside them. ### Official sources 1. [U.S. Department of Justice Disrupts Hive Ransomware Variant](https://takedownindex.org/sources/united-states-department-of-justice-u-s-department-of-justice-disrupts-hive-rans) United States Department of Justice, January 26, 2023, Source grade P1 Covert network access from July 2022, more than 300 decryption keys to victims under attack and more than 1,000 to previous victims, approximately 130 million USD in ransom demands averted, German and Dutch server seizures No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. 2. [Europol statement on the Hive ransomware takedown](https://takedownindex.org/sources/europol-europol-statement-on-the-hive-ransomware-takedown) Europol, January 26, 2023, Source grade P2 International coordination and German and Dutch participation No address recorded for this source. Publisher, title, and date are given so it can be retrieved from the publisher. Coverage note. - DOJ reported preventing approximately 130 million USD in ransom demands. - Approximately 1,500 victims in more than 80 countries and roughly 100 million USD collected are official estimates. - The Hunters International relationship is DISPUTED. Multiple technical analyses found substantial code overlap, while the successor group publicly claimed it purchased the source code rather than being a rebrand. Both positions are preserved. Research context ## How this entry was checked This entry went through a dedicated source verification pass. Publisher, title, publication date, and docket numbers were confirmed against each cited source. Source review: Verified core Sources cited: 2 Research cutoff: August 20, 2026 Last reviewed August 21, 2026 See also [About the Internet Takedown Index](https://takedownindex.org/about) Related entries - [RSOCKS proxy botnet disruption](https://takedownindex.org/takedowns/rsocks-proxy-botnet-disruption) - [Operation Tourniquet](https://takedownindex.org/takedowns/operation-tourniquet) - [Cyclops Blink disruption](https://takedownindex.org/takedowns/cyclops-blink-disruption) Report updates or corrections Help keep this record accurate. [Submit feedback](https://takedownindex.org/about#corrections-and-updates)