Skip to main content
Darkfield

Operator dossier

Hiveleak is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 208 public victims claimed by this operator between August 14, 2021 and January 16, 2023. Hiveleak is a financially-motivated ransomware group that emerged in August 2021, conducting targeted attacks primarily against organizations in the United States, United Kingdom, Netherlands, Spain, and Germany with a focus on manufacturing, business services, information technology, healthcare, and education sectors. Limited public documentation exists regarding this group's specific country of origin or affiliations with other ransomware operations, though their targeting patterns and operational timeline suggest they operate as part of the broader ransomware ecosystem that proliferated during the 2021-2022 period. The group's attack methodology and technical capabilities remain largely undocumented in major threat intelligence reports from CISA, FBI, or leading security research firms, though their victim count of 208 organizations indicates sustained operational capability over their known active period. Notable campaigns and high-profile victims have not been extensively documented in public threat intelligence reporting, suggesting the group may have maintained a lower profile compared to major ransomware operations like Conti or LockBit during the same timeframe. The current operational status of Hiveleak remains unclear based on available public intelligence reporting.

Most-targeted sectors

Most-affected countries

Recent disclosures by Hiveleak

Most recent 150 of 208 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for Hiveleak →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

Hiveleak

208 victims indexed · first seen 5 years ago · last activity 3 years ago

208
Victims indexed
#39 of 364 tracked operators
1y 5m
Active period
Aug 2021 → Jan 2023
10
Countries hit
top United States · 38

At a glance

Status
inactive
First seen
5 years ago
Last activity
3 years ago
Onion sites
5 known endpoints
Primary sector
Manufacturing · 17 hits

About

Hiveleak is a financially-motivated ransomware group that emerged in August 2021, conducting targeted attacks primarily against organizations in the United States, United Kingdom, Netherlands, Spain, and Germany with a focus on manufacturing, business services, information technology, healthcare, and education sectors. Limited public documentation exists regarding this group's specific country of origin or affiliations with other ransomware operations, though their targeting patterns and operational timeline suggest they operate as part of the broader ransomware ecosystem that proliferated during the 2021-2022 period. The group's attack methodology and technical capabilities remain largely undocumented in major threat intelligence reports from CISA, FBI, or leading security research firms, though their victim count of 208 organizations indicates sustained operational capability over their known active period. Notable campaigns and high-profile victims have not been extensively documented in public threat intelligence reporting, suggesting the group may have maintained a lower profile compared to major ransomware operations like Conti or LockBit during the same timeframe. The current operational status of Hiveleak remains unclear based on available public intelligence reporting.

Timeline

15 months
2021-08-01T00:00:00+00:00 · 22021-12-01T00:00:00+00:00 · 232022-01-01T00:00:00+00:00 · 322022-02-01T00:00:00+00:00 · 232022-03-01T00:00:00+00:00 · 212022-04-01T00:00:00+00:00 · 52022-05-01T00:00:00+00:00 · 172022-06-01T00:00:00+00:00 · 52022-07-01T00:00:00+00:00 · 292022-08-01T00:00:00+00:00 · 72022-09-01T00:00:00+00:00 · 142022-10-01T00:00:00+00:00 · 22022-11-01T00:00:00+00:00 · 102022-12-01T00:00:00+00:00 · 152023-01-01T00:00:00+00:00 · 3
2021-08-01T00:00:00+00:002023-01-01T00:00:00+00:00

Top countries

🇺🇸 United States
38
🇬🇧 United Kingdom
12
🇳🇱 Netherlands
5
🇩🇪 Germany
4
🇪🇸 Spain
4
🇨🇦 Canada
2
🇧🇷 Brazil
2
🇮🇩 Indonesia
2
United States dossier →United Kingdom dossier →Netherlands dossier →Germany dossier →

Top sectors

Manufacturing
17
Business Services
12
Information Technology
10
Healthcare
7
Education
7
Internet & Telecommunication Services
4
Healthcare Services
4
Energy & Utilities
3
Manufacturing dossier →Business Services dossier →Information Technology dossier →Healthcare dossier →

MITRE ATT&CK

11 techniques · 8 tactics

Tactics

Initial AccessExecutionDefense EvasionDiscoveryLateral MovementCollectionExfiltrationImpact

Techniques

  • T1566Phishing
  • T1190Exploit Public-Facing Application
  • T1059Command and Scripting Interpreter
  • T1027Obfuscated Files or Information
  • T1083File and Directory Discovery
  • T1018Remote System Discovery
  • T1021Remote Services
  • T1005Data from Local System
  • T1039Data from Network Shared Drive
  • T1041Exfiltration Over C2 Channel
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

5 known
  • http://hiveapi4nyabjdfz2hxdsr7otrcv6zq6m4rk5i2w7j64lrtny4b7vjad.onion
  • http://hiveapi4nyabjdfz2hxdsr7otrcv6zq6m4rk5i2w7j64lrtny4b7vjad.onion/v1/companies/disclosed
  • http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion
  • http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion
  • http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/

Source

Updated 3 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time Hiveleak posts a victim.

Add Hiveleak to your watchlist — Pro pings you within 5 minutes of any new Hiveleak leak-site post, Telegram callout, or affiliate-rebrand inference.