extortion.wiki THE RANSOMWARE DOCUMENTARY ARCHIVE
Menu

242 negotiations · 332 notes · 276 seizure banners · snapshots Jul 06, 2026 / Jun 26, 2026 / Jul 23, 2026

Hive

From extortion.wiki, the ransomware negotiation research archive

Negotiation records classified under Hive in the current Ransomchats snapshot. This page indexes the source label; it does not independently verify attribution.

Classification follows the source dataset. Metadata is useful. It is not testimony.

Actor lineage

Global lineage directory

Overview

The FBI infiltrated Hive infrastructure beginning in July 2022 and law enforcement seized servers and websites in January 2023. Disrupted does not mean every affiliate or derivative activity ended.

Source name
Hive
Canonical lineage name
Hive
Entity model
operation
First observed
June 2021
Last observed
Date not established
Current status
Disrupted

Documentary media

Official FBI wanted poster for Mikhail Pavlovich Matveev with four agency-published photographs
FBI wanted poster for Mikhail Pavlovich MatveevOfficial FBI wanted poster for Mikhail Pavlovich Matveev. The FBI describes him as an alleged ransomware affiliate linked to LockBit and Hive and records federal charges and outstanding warrants; status: wanted as of 23 July 2026.Published identity:Mikhail Pavlovich Matveev · wanted as of 2026-07-23 · official reward record: Up to USD 10,000,000Federal Bureau of Investigation · published 2023-05-16 · Primary evidenceEvidence status:officially confirmed · Rights/review:documentary excerpt reviewedThe FBI policy treats unattributed Bureau information as public information subject to restrictions on the FBI seal, name, and implied endorsement. The complete poster page is shown only as documentary context; the seal is not isolated or used as branding.Federal Bureau of Investigation wanted poster; reproduced as an attributed documentary preview. No FBI endorsement is implied.

Known aliases

No source-supported alias is currently recorded. Malware names and actor-group names are not assumed to be equivalent.

Historical timeline

Lineage and relationships

No evidence-backed relationship is currently recorded. Similar code, language, infrastructure style, or negotiation behavior is not enough on its own.

Predecessors

None established.

Successors

None established.

Splits and mergers

None established.

Suspected affiliate relationships

None established.

Website seizure banners

Complete seizure archive

Explicit reviewed mappings connect the following seized.fyi records to this actor or a sourced lineage event. Seizure counts remain separate from negotiation, note, actor, and lineage statistics.

Hive website seizure banner

Hive

Date
Jan 26, 2023
Domains
1
Media
image/gif

MITRE ATT&CK integration

No explicit MITRE ATT&CK group mapping is published for this source label. Software entries and fuzzy name matches are not promoted to group mappings.

External intelligence references

  1. U.S. Department of Justice Disrupts Hive Ransomware VariantU.S. Department of Justice · law enforcement · primary authoritative
  2. Mikhail Pavlovich MatveevFederal Bureau of Investigation · law enforcement · primary authoritative
  3. Russian National Charged with Ransomware Attacks Against Critical InfrastructureU.S. Department of Justice · law enforcement · primary authoritative
  4. Privacy PolicyFederal Bureau of Investigation · publisher terms · context only

Confidence and evidence notes

Confidence applies to each individual alias, event, or relationship—not to the actor page as a whole. “Confirmed” requires explicit authoritative attribution or multiple strong independent sources. Moderate, low, disputed, and unknown entries retain the source's uncertainty. A malware-family name is not automatically an actor identity, and shared code or affiliates do not prove shared leadership.

Ransomware notes

Browse Hive notes

The explicit archive alias mapping connects this Ransomchats actor label to the ThreatLabz family Hive. Its 2 archived notes are counted and searched separately from the negotiation records below.

Search within this collection

Negotiation records

Filter Hive records

Collection: 8 records · 372 messages

Hive negotiation record collection
Participants Source Archive status
20211220 24 Hive, Victim JSON Indexed
20211213 15 Hive, Victim JSON Indexed
20211126 4 Hive JSON Indexed
20211113 136 Hive, Victim JSON Indexed
20211102 58 Hive, Victim JSON Indexed
20211026 46 Hive, Victim JSON Indexed
20211005 19 Hive, Victim JSON Indexed
20211004 70 Hive, Victim JSON Indexed