US authorities have seized the servers of the notorious Hive ransomware group that has received more than $100m in extortion payments from thousands of victims after law enforcement infiltrated its systems and captured the keys to decrypt its attack software, the justice department announced on Thursday.
The website for the group – considered among the most dangerous and prolific hacker gangs that targeted hospitals and public infrastructure – showed a message saying it had been seized by an international law enforcement coalition including the department and the FBI.
Ransomware is a type of malicious attack that infiltrates a computer network and makes files inaccessible. Hackers then demand a ransom to unlock the system, typically in the form of cryptocurrency. The Hive group was known to re-infiltrate networks that tried to circumvent their attacks.
“In a 21st-century cyber stakeout, our investigative team turned the tables on Hive,” the deputy attorney general, Lisa Monaco, said at a news conference announcing the seizure at department headquarters in Washington. “Using lawful means, we hacked the hackers.”
The months-long operation, which started in Florida last year, involved FBI agents accessing Hive’s network and providing victims with the decryption keys needed to regain control of their systems, blocking about $130m in demanded ransoms, senior justice department officials said.
Hive used a “ransomware-as-a-service” model, where its developers sold their ransomware code to affiliates, who carried out the actual attacks – an arrangement that makes it harder for authorities to identify and investigate the hackers behind the group.
The group was particularly notorious for targeting hospitals and schools. In the summer of 2021, Hive carried out a ransomware attack on a hospital in the US midwest that prevented it from accepting new patients and forced it to run all of its operations with paper records.
The FBI started to work with victims in July 2022 to identify Hive’s targets and then sought court orders and search warrants to enter Hive’s systems, officials said, before ultimately seizing Hive’s servers and websites that its members used to communicate and carry out the attacks.
“This is not exactly hiding in plain sight, this is just hiding. We hide and we watch as they proceed with their attacks and we discover the keys and deliver the keys to victims,” the attorney general, Merrick Garland, said.
The department did not announce arrests on Thursday and declined to discuss the possibility of charges against Hive’s members, who are known to communicate in Russian, or ties to the Kremlin because the investigation remains ongoing.
The operation, the department said, was led with German law enforcement and the Netherlands National High Tech Crime Unit. Separately, the National Crime Agency in the UK said in a statement that its investigators were involved in removing malware from UK victims.
The treasury department has estimated that ransomware attacks cost US organizations $886m in 2021, the most recent year for which data is available.
Russia does not extradite its citizens, and the White House has failed to convince the Kremlin in recent years to prosecute its cybercriminals. At least some of the most infamous hacking gangs, including the Fancy Bears group, have been connected to its state security services.
