While Hive has not been one of the most damaging ransomware groups, it was responsible for a large number of incidents.Īccording to Kimberly Goody, a senior manager at Mandiant Threat Intelligence and Google Cloud, Hive ransomware was found in over 15 percent of the intrusions her team responded to in 2022, over 50 percent of them in the United States and many impacting the healthcare sector.
"That has got to have a whole lot of other ransomware groups really, really nervous right now." And I like the fact that they were very clear that, 'Yeah, we infiltrated their network and we spent what is it now, eight months in that network,'" said Liska. "So it's a pretty impressive operation overall. But perhaps most importantly, the operation should inspire fear that the FBI is lurking in the networks of other ransomware groups, he added. Liska said he also expects the Justice Department to announce arrests in the future. "So it makes sense as a good time to go ahead and seize everything and grab as much intelligence as you can from them." Without revenue from victims, Hive may have made the choice to shut down, he said. "I think one of the big reasons is we've seen a significant slowdown in Hive attacks," he said. Ransomware expert and cybersecurity analyst Allan Liska explained that the Justice Department's decision to disrupt Hive makes sense, because the intelligence value of hiding in their networks was decreasing. When asked whether the group has ties to Russia or whether arrests might be announced in the future, Attorney General Merrick Garland said he wouldn't comment further on ongoing investigations. The Justice Department did not announce any specific arrests or information about how it located Hive's servers. "We've made it clear that we will strike back against cybercrime using any means possible," said Monaco, the deputy attorney general. The operation targeting Hive continues in a pattern of using several different tools to respond to ransomware groups in different ways.
The Justice Department has also sanctioned tools ransomware groups use to hide and move their money, seized cryptocurrency wallets belonging to ransomware groups, and arrested prominent ransomware actors. In July 2021, the Biden administration launched the Ransomware and Digital Extortion Task Force, bringing together resources from the Justice Department and the Department of Homeland Security to seek and act on intelligence about ransomware.
The infiltration and ultimate disruption of the Hive ransomware group is the latest effort by the Department of Justice to fight back against the plague of damaging and costly ransomware attacks in recent years. On Wednesday evening, the leak site was replaced with a banner from the international group of law enforcement agencies announcing the seizure. The Justice Department claims the intervention saved over $130 million in ransom payments, a figure that could have been higher had more victims come forward.Īdditionally, the FBI and its partners in Europol and German and Dutch law enforcement were able to completely take over Hive's digital infrastructure, from its command and control servers to its darkweb extortion website where it advertises its victims and dumps stolen data. This allowed the victims to retrieve their files and return to business without paying a ransom. Assisting the victimsĪccording to FBI Director Chris Wray, law enforcement officers were able to provide digital keys to victims who had notified the FBI. "Simply put, using lawful means, we hacked the hackers," explained Deputy Attorney General Lisa Monaco during a press conference Thursday. The FBI says it hacked into Hive's networks in July 2022, burrowing into its digital infrastructure to spy on the group's operations and gather important intelligence before ultimately dismantling the operation on Wednesday night. According to the Justice Department, Hive targeted more than 1,500 victims in over 80 countries, from hospitals to Costa Rica's public health agency, crippling businesses and harming critical infrastructure. They received more than $100 million in profits from victims who paid to get their data back or prevent it from being leaked.
The criminal syndicate sold ransomware tools and services to affiliates around the world starting in the summer of 2021, at the height of the COVID-19 pandemic. WASHINGTON - The Department of Justice on Thursday announced the destruction of the Russian-linked Hive ransomware group after a global law enforcement operation that ran for months. Attorney General Merrick Garland speaks during a news conference with Deputy Attorney General Lisa Monaco (left), and FBI Director Christopher Wray at the Department of Justice in Washington on Thursday.
0 kommentar(er)
