Current:Home > ScamsFBI says it 'hacked the hackers' to shut down major ransomware group -Triumph Financial Guides
FBI says it 'hacked the hackers' to shut down major ransomware group
View
Date:2025-04-18 11:18:26
WASHINGTON — The Department of Justice on Thursday announced the destruction of the Russian-linked Hive ransomware group after a global law enforcement operation that ran for months.
The criminal syndicate sold ransomware tools and services to affiliates around the world starting in the summer of 2021, at the height of the COVID-19 pandemic.
They received more than $100 million in profits from victims who paid to get their data back or prevent it from being leaked. According to the Justice Department, Hive targeted more than 1,500 victims in over 80 countries, from hospitals to Costa Rica's public health agency, crippling businesses and harming critical infrastructure.
The FBI says it hacked into Hive's networks in July 2022, burrowing into its digital infrastructure to spy on the group's operations and gather important intelligence before ultimately dismantling the operation on Wednesday night.
"Simply put, using lawful means, we hacked the hackers," explained Deputy Attorney General Lisa Monaco during a press conference Thursday.
Assisting the victims
According to FBI Director Chris Wray, law enforcement officers were able to provide digital keys to victims who had notified the FBI. This allowed the victims to retrieve their files and return to business without paying a ransom. The Justice Department claims the intervention saved over $130 million in ransom payments, a figure that could have been higher had more victims come forward.
Additionally, the FBI and its partners in Europol and German and Dutch law enforcement were able to completely take over Hive's digital infrastructure, from its command and control servers to its darkweb extortion website where it advertises its victims and dumps stolen data.
On Wednesday evening, the leak site was replaced with a banner from the international group of law enforcement agencies announcing the seizure.
The infiltration and ultimate disruption of the Hive ransomware group is the latest effort by the Department of Justice to fight back against the plague of damaging and costly ransomware attacks in recent years.
In July 2021, the Biden administration launched the Ransomware and Digital Extortion Task Force, bringing together resources from the Justice Department and the Department of Homeland Security to seek and act on intelligence about ransomware.
The Justice Department has also sanctioned tools ransomware groups use to hide and move their money, seized cryptocurrency wallets belonging to ransomware groups, and arrested prominent ransomware actors.
A warning to other ransomware groups
The operation targeting Hive continues in a pattern of using several different tools to respond to ransomware groups in different ways.
"We've made it clear that we will strike back against cybercrime using any means possible," said Monaco, the deputy attorney general.
The Justice Department did not announce any specific arrests or information about how it located Hive's servers. When asked whether the group has ties to Russia or whether arrests might be announced in the future, Attorney General Merrick Garland said he wouldn't comment further on ongoing investigations.
Ransomware expert and cybersecurity analyst Allan Liska explained that the Justice Department's decision to disrupt Hive makes sense, because the intelligence value of hiding in their networks was decreasing.
"I think one of the big reasons is we've seen a significant slowdown in Hive attacks," he said. Without revenue from victims, Hive may have made the choice to shut down, he said. "So it makes sense as a good time to go ahead and seize everything and grab as much intelligence as you can from them."
Liska said he also expects the Justice Department to announce arrests in the future. But perhaps most importantly, the operation should inspire fear that the FBI is lurking in the networks of other ransomware groups, he added.
"So it's a pretty impressive operation overall. And I like the fact that they were very clear that, 'Yeah, we infiltrated their network and we spent what is it now, eight months in that network,'" said Liska. "That has got to have a whole lot of other ransomware groups really, really nervous right now."
While Hive has not been one of the most damaging ransomware groups, it was responsible for a large number of incidents.
According to Kimberly Goody, a senior manager at Mandiant Threat Intelligence and Google Cloud, Hive ransomware was found in over 15 percent of the intrusions her team responded to in 2022, over 50 percent of them in the United States and many impacting the healthcare sector.
Hive has been destroyed, but ransomware experts said the operators will most likely join other groups or rebuild, a common phenomenon in what's become a global industry.
Additionally, members in Russia will likely continue to operate with impunity, as the Russian state has often declined to pursue investigations, arrests, or extradite those charged to the United States.
However, the disruption forces those operators to pause and do costly and time-consuming work to rebuild.
"Actions like this add friction to ransomware operations. Hive may have to regroup, retool, and even rebrand," said John Hultquist, the head of Mandiant Threat Intelligence within Google Cloud.
"The disruption of the Hive service won't cause a serious drop in overall ransomware activity, but it is a blow to a dangerous group that has endangered lives by attacking the healthcare system," he said.
veryGood! (7645)
Related
- 'Vanderpump Rules' star DJ James Kennedy arrested on domestic violence charges
- A Disillusioned ExxonMobil Engineer Quits to Take Action on Climate Change and Stop ‘Making the World Worse’
- Get $115 Worth of MAC Cosmetics Products for Just $61 Before This Deal Disappears
- Biden calls for passage of a bill to stop 'junk fees' in travel and entertainment
- FACT FOCUS: Inspector general’s Jan. 6 report misrepresented as proof of FBI setup
- Biden’s Pause of New Federal Oil and Gas Leases May Not Reduce Production, but It Signals a Reckoning With Fossil Fuels
- The ice cream conspiracy
- Larry Nassar was stabbed after making a lewd comment watching Wimbledon, source says
- The Louvre will be renovated and the 'Mona Lisa' will have her own room
- Missing Titanic Tourist Submersible: Identities of People Onboard Revealed
Ranking
- The FTC says 'gamified' online job scams by WhatsApp and text on the rise. What to know.
- Inside Clean Energy: Biden’s Climate Plan Shows Net Zero is Now Mainstream
- We Need a Little More Conversation About Cailee Spaeny and Jacob Elordi in Priscilla First Trailer
- In the Amazon, the World’s Largest Reservoir of Biodiversity, Two-Thirds of Species Have Lost Habitat to Fire and Deforestation
- Have Dry, Sensitive Skin? You Need To Add These Gentle Skincare Products to Your Routine
- Maryland’s Capital City Joins a Long Line of Litigants Seeking Climate-Related Damages from the Fossil Fuel Industry
- Former Broadway actor James Beeks acquitted of Jan. 6 charges
- How 'modern-day slavery' in the Congo powers the rechargeable battery economy
Recommendation
Federal court filings allege official committed perjury in lawsuit tied to Louisiana grain terminal
The Biden EPA Withdraws a Key Permit for an Oil Refinery on St. Croix, Citing ‘Environmental Justice’ Concerns
Shell reports record profits as energy prices soar after Russia's invasion of Ukraine
The EPA Calls an Old Creosote Works in Pensacola an Uncontrolled Threat to Human Health. Why Is There No Money to Clean it Up?
$73.5M beach replenishment project starts in January at Jersey Shore
Amazon Shoppers Say These Gorgeous Gold Earrings Don't Tarnish— Get the Set on Sale Ahead of Prime Day
More details emerge about suspect accused of fatally shooting Tennessee surgeon in exam room
Andy Cohen Has the Best Response to Real Housewives of Ozempic Joke
Like
- Newly elected West Virginia lawmaker arrested and accused of making terroristic threats
- Justice Dept asks judge in Trump documents case to disregard his motion seeking delay
- The Rate of Global Warming During Next 25 Years Could Be Double What it Was in the Previous 50, a Renowned Climate Scientist Warns