Hive0081

Hive0081 is IBM X-Force's designation for an Iranian-linked threat cluster that overlaps with xHunt campaign activity, documented in late 2019. The group targeted Kuwaiti government and shipping organizations using a set of custom backdoors and tunneling tools associated with the xHunt campaign infrastructure, which researchers linked to the OilRig (APT34) cluster. IBM tracks Hive0081 as a distinct operational identifier for this activity, reflecting the use of novel tools including CASHY200 and EXE_01 identified in the same campaign period. The cluster's targeting and toolset align broadly with Iranian MOIS-linked espionage priorities in the Gulf region.