APT Explorer

All actors

Hive0117

Reports
5
Last reported
Known CVEs
9
ID
hive0117
Sources
MISPMalpedia
Merge evidence
1 alias match

Reports per quarter

Dated reports, 2022 Q2 to 2025 Q4.

Techniques seen in the last two years

Show all 25 techniques Show fewer

Counts come from technique IDs in the actor's report text.

CVEs named in reports

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

  1. APT and financial attacks on industrial organizations in Q3 2025 | Kaspersky ICS CERT EN

    Malpedia library date ORKL

    Archived copy on ORKL Details

  2. INTRINSEC-2025-Threat-Report-Trouble_in_the_air.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  3. New Hive0117 phishing campaign imitates conscription summons deliver DarkWatchman malware

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  4. Hive0117 Continues Fileless Malware Delivery in Eastern Europe

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  5. Hive00117 fileless malware delivery Eastern Europe

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

Newest first. Details opens the report in Explore.