Current:Home > InvestFBI says it 'hacked the hackers' to shut down major ransomware group -GrowthInsight
FBI says it 'hacked the hackers' to shut down major ransomware group
View
Date:2025-04-17 23:55:14
WASHINGTON — The Department of Justice on Thursday announced the destruction of the Russian-linked Hive ransomware group after a global law enforcement operation that ran for months.
The criminal syndicate sold ransomware tools and services to affiliates around the world starting in the summer of 2021, at the height of the COVID-19 pandemic.
They received more than $100 million in profits from victims who paid to get their data back or prevent it from being leaked. According to the Justice Department, Hive targeted more than 1,500 victims in over 80 countries, from hospitals to Costa Rica's public health agency, crippling businesses and harming critical infrastructure.
The FBI says it hacked into Hive's networks in July 2022, burrowing into its digital infrastructure to spy on the group's operations and gather important intelligence before ultimately dismantling the operation on Wednesday night.
"Simply put, using lawful means, we hacked the hackers," explained Deputy Attorney General Lisa Monaco during a press conference Thursday.
Assisting the victims
According to FBI Director Chris Wray, law enforcement officers were able to provide digital keys to victims who had notified the FBI. This allowed the victims to retrieve their files and return to business without paying a ransom. The Justice Department claims the intervention saved over $130 million in ransom payments, a figure that could have been higher had more victims come forward.
Additionally, the FBI and its partners in Europol and German and Dutch law enforcement were able to completely take over Hive's digital infrastructure, from its command and control servers to its darkweb extortion website where it advertises its victims and dumps stolen data.
On Wednesday evening, the leak site was replaced with a banner from the international group of law enforcement agencies announcing the seizure.
The infiltration and ultimate disruption of the Hive ransomware group is the latest effort by the Department of Justice to fight back against the plague of damaging and costly ransomware attacks in recent years.
In July 2021, the Biden administration launched the Ransomware and Digital Extortion Task Force, bringing together resources from the Justice Department and the Department of Homeland Security to seek and act on intelligence about ransomware.
The Justice Department has also sanctioned tools ransomware groups use to hide and move their money, seized cryptocurrency wallets belonging to ransomware groups, and arrested prominent ransomware actors.
A warning to other ransomware groups
The operation targeting Hive continues in a pattern of using several different tools to respond to ransomware groups in different ways.
"We've made it clear that we will strike back against cybercrime using any means possible," said Monaco, the deputy attorney general.
The Justice Department did not announce any specific arrests or information about how it located Hive's servers. When asked whether the group has ties to Russia or whether arrests might be announced in the future, Attorney General Merrick Garland said he wouldn't comment further on ongoing investigations.
Ransomware expert and cybersecurity analyst Allan Liska explained that the Justice Department's decision to disrupt Hive makes sense, because the intelligence value of hiding in their networks was decreasing.
"I think one of the big reasons is we've seen a significant slowdown in Hive attacks," he said. Without revenue from victims, Hive may have made the choice to shut down, he said. "So it makes sense as a good time to go ahead and seize everything and grab as much intelligence as you can from them."
Liska said he also expects the Justice Department to announce arrests in the future. But perhaps most importantly, the operation should inspire fear that the FBI is lurking in the networks of other ransomware groups, he added.
"So it's a pretty impressive operation overall. And I like the fact that they were very clear that, 'Yeah, we infiltrated their network and we spent what is it now, eight months in that network,'" said Liska. "That has got to have a whole lot of other ransomware groups really, really nervous right now."
While Hive has not been one of the most damaging ransomware groups, it was responsible for a large number of incidents.
According to Kimberly Goody, a senior manager at Mandiant Threat Intelligence and Google Cloud, Hive ransomware was found in over 15 percent of the intrusions her team responded to in 2022, over 50 percent of them in the United States and many impacting the healthcare sector.
Hive has been destroyed, but ransomware experts said the operators will most likely join other groups or rebuild, a common phenomenon in what's become a global industry.
Additionally, members in Russia will likely continue to operate with impunity, as the Russian state has often declined to pursue investigations, arrests, or extradite those charged to the United States.
However, the disruption forces those operators to pause and do costly and time-consuming work to rebuild.
"Actions like this add friction to ransomware operations. Hive may have to regroup, retool, and even rebrand," said John Hultquist, the head of Mandiant Threat Intelligence within Google Cloud.
"The disruption of the Hive service won't cause a serious drop in overall ransomware activity, but it is a blow to a dangerous group that has endangered lives by attacking the healthcare system," he said.
veryGood! (4)
Related
- Bodycam footage shows high
- US Coast Guard rescues boater off Florida coast after he went missing for nearly 2 days
- First-time homebuyers need to earn more to afford a home except in these 3 metros
- One injured after large fire breaks out at Sherwin-Williams factory in Texas, reports say
- Blake Lively’s Inner Circle Shares Rare Insight on Her Life as a Mom to 4 Kids
- The future is uncertain for the United States after crashing out of the Women’s World Cup
- CBS News poll finds after latest Trump indictment, many Americans see implications for democracy. For some, it's personal
- 'Down goes Anderson!' Jose Ramirez explains what happened during Guardians-White Sox fight
- Paris Olympics live updates: Quincy Hall wins 400m thriller; USA women's hoops in action
- Is 2023 the summer of strikes for US workers? Here’s what the data says.
Ranking
- Taylor Swift Cancels Austria Concerts After Confirmation of Planned Terrorist Attack
- Officials approve $990K settlement with utility in 2019 blast that leveled home, injured 5
- Bella Hadid shares vulnerable hospitalization pictures amid Lyme disease treatment
- US Coast Guard rescues boater off Florida coast after he went missing for nearly 2 days
- Bet365 ordered to refund $519K to customers who it paid less than they were entitled on sports bets
- An Indigenous leader has inspired an Amazon city to grant personhood to an endangered river
- 'Loki' season 2 is nearly here—here's how to watch
- Why did MLB's most expensive team flop? New York Mets 'didn't have that magic'
Recommendation
Paula Abdul settles lawsuit with former 'So You Think You Can Dance' co
Woman accuses Bill Cosby of drugging, sexually assaulting her in the '80s
India’s Modi faces a no-confidence vote over silence on ethnic violence tearing at remote Manipur
Bachelor Nation's Kaitlyn Bristowe and Jason Tartick Break Up After 4 Years Together
Kourtney Kardashian Cradles 9-Month-Old Son Rocky in New Photo
NASCAR suspends race at Michigan due to rain and aims to resume Monday
Multiple passengers dead after charter bus crashes in Pennsylvania, police say
Analysis: Coco Gauff’s Washington title shows she is ready to contend at the US Open