Hive Ransomware Operation Shut Down by Law Enforcement

guest · Jan 26, 2023

The Hive ransomware website has been seized as part of an operation that involved law enforcement in 10 countries.
By Eduard Kovacs @EduardKovacs - January 26, 2023

The Hive ransomware operation appears to have been shut down as part of a major law enforcement operation involving agencies in 10 countries.
Click to expand...

A message displayed in English and Russian on the Hive ransomware operation’s Tor-based website reads: The Federal Bureau of Investigation seized this site as part of a coordinated law enforcement action taken against Hive Ransomware.

Another message says the action was taken in coordination with Europol and authorities in Florida, which indicates that more details will likely be made available in the upcoming period by the Justice Department and Europol.
Click to expand...

Until law enforcement agencies confirm the shutdown of Hive, there is a slight chance that the website seizure notice was posted by the cybercriminals themselves.

However, Allan Liska, a ransomware expert working for threat intelligence company Recorded Future, reported that the Hive infrastructure was seized. Liska also posted an image showing that many well-known ransomware groups have fallen.
Click to expand...

The Hive ransomware operation was launched in 2021. Offered under a ransomware-as-a-service (RaaS) model, the ransomware was often used against organizations in the healthcare sector, as well as other critical infrastructure.
The hackers used malware to encrypt the target’s files, but not before stealing data that could be used to pressure the victim into paying up.

A free decryptor for files encrypted with the Hive ransomware was released by a South Korean cybersecurity agency in the summer of 2022.
Click to expand...

guest · Jan 26, 2023

mood said: ↑

The Hive ransomware website has been seized as part of an operation that involved law enforcement in 10 countries.
By Eduard Kovacs @EduardKovacs - January 26, 2023
Click to expand...

UPDATE: The US Department of Justice has confirmed dismantling the Hive ransomware operation.

It turns out that the FBI infiltrated the Hive “control panel” in July 2022, allowing agents to identify victims and obtain decryption keys that allowed victims to recover encrypted files, preventing $130 million in ransom payments.
In addition to seizing the domain associated with Hive’s leak website, law enforcement shut down servers used by the cybercriminals to store data.
Click to expand...

DoJ: U.S. Department of Justice Disrupts Hive Ransomware Variant

FBI Covertly Infiltrated Hive Network, Thwarting Over $130 Million in Ransom Demands
The Justice Department announced today its months-long disruption campaign against the Hive ransomware group that has targeted more than 1,500 victims in over 80 countries around the world, including hospitals, school districts, financial firms, and critical infrastructure.
Click to expand...

Since late July 2022, the FBI has penetrated Hive’s computer networks, captured its decryption keys, and offered them to victims worldwide, preventing victims from having to pay $130 million in ransom demanded. Since infiltrating Hive’s network in July 2022, the FBI has provided over 300 decryption keys to Hive victims who were under attack. In addition, the FBI distributed over 1,000 additional decryption keys to previous Hive victims.
Click to expand...

US announces it seized Hive ransomware gang’s leak sites and decryption keys
By Carly Page @carlypage_ - January 26, 2023

The infrastructure behind Hive, one of the most prolific ransomware operations, has been seized by law enforcement agencies in the United States and Europe.
Click to expand...

Hive saw its dark web portal seized as part of a coordinated law enforcement action carried out by the U.S. Department of Justice, the FBI, Secret Service and several European government agencies, just months after the federal government’s cybersecurity unit CISA sounded the alarm about Hive’s ongoing extortion efforts.

“This hidden site has been seized. The Federal Bureau of Investigation seized this site as part of a coordinated law enforcement action taken against Hive Ransomware,” a seizure notice displayed on Hive’s dark web leak site reads. “This action has been taken in coordination with the United States Attorney’s Office for the Middle District of Florida and the Computer Crime and Intellectual Property Section of the Department of Justice with substantial assistance from Europol.”
Click to expand...

Garland added that the FBI has also begun dismantling Hive’s front and back-end infrastructure in the U.S. and abroad, which included the seizure of two of Hive’s backend servers located in Los Angeles. The FBI did not say how it identified the Hive servers, and no arrests or indictments were announced during the press conference.
Click to expand...

guest · Jan 26, 2023

US offers $10M bounty for Hive ransomware links to foreign governments
By Sergiu Gatlan @serghei - January 26, 2023

The U.S. Department of State today offered up to $10 million for information that could help link the Hive ransomware group (or other threat actors) with foreign governments.
Click to expand...

The State Department offers these rewards as part of its Transnational Organized Crime Rewards Program (TOCRP), through which over $135 million in rewards have been paid since 1986.
Disrupted after FBI infiltrated Hive's servers
This offer comes after Hive ransomware's Tor websites were seized today as part of an international law enforcement operation.

The Justice Department revealed that the FBI infiltrated Hive servers at a hosting provider in California last July and secretly monitored the operation for six months (Dutch police gained access to backup servers hosted in the Netherlands).
Besides decryption keys, the FBI also discovered Hive communication records, malware file hashes, and information on 250 Hive affiliates.
Click to expand...

FanJ · Jan 26, 2023

Europol Press Release:
Cybercriminals stung as HIVE infrastructure shut down
https://www.europol.europa.eu/media...criminals-stung-hive-infrastructure-shut-down

Europol supported German, Dutch and US authorities to shut down the servers and provide decryption tools to victims
Click to expand...

Since June 2021, criminals have used HIVE ransomware to target a wide range of businesses and critical infrastructure sectors, including government facilities, telecommunication companies, manufacturing, information technology, and healthcare and public health. In one major attack, HIVE affiliates targeted a hospital, which led to severe repercussions about how the hospital could deal with the COVID-19 pandemic. Due to the attack, this hospital had to resort to analogue methods to treat existing patients, and was unable to accept new ones.
Click to expand...

guest · Jan 27, 2023

Hive ransomware: modern, efficient business model
by Paul Handley - January 27, 2023

The US Justice Department's shutdown Thursday of the Hive ransomware operation—which extorted some $100 million from more than 1,500 victims worldwide—highlights how hacking has become an ultra-efficient, specialized industry that can allow anyone to become a cyber-shakedown artist.
Click to expand...

Modern business model
Hive operated in what cybersecurity experts call a "ransomware as a service" style, or RaaS—a business that leases its software and methods to others to use in extorting a target.
The model is central to the larger ransomware ecosystem, in which actors specialize in one skill or function to maximize efficiency.

According to Ariel Ropek, director of cyber threat intelligence at cybersecurity firm Avertium, this structure makes it possible for criminals with minimal computer fluency to get into the ransomware game by paying others for their expertise.

"There are quite a few of them," Ropek said of RaaS operations.
"It is really a business model nowadays," he said.
Click to expand...

Polite but firm
When the ransomware is planted and activated, the target receives a message telling them how to correspond and how much to pay to get their data unencrypted.
That ransom can run from thousands to millions of dollars, usually depending on the financial strength of the target.

If a target organization refuses to pay, the RaaS developers hold a backup position: they threaten to release the hacked confidential files online or sell them.
Hive maintained a separate website, HiveLeaks, to publish the data.
Click to expand...

Modest blow
Thursday's action against Hive was only a modest blow against the RaaS industry.

There are numerous other ransomware specialists similar to Hive still operating.
Click to expand...

guest · Jan 27, 2023

Industry Reactions to Hive Ransomware Takedown: Feedback Friday
By Eduard Kovacs @EduardKovacs - January 27, 2023

Authorities in the United States and Europe have announced the results of a major law enforcement operation targeting the Hive ransomware.
Click to expand...

Agencies from around the world worked together to take down Hive’s leak website and servers. In addition, agents hacked into Hive systems in July 2022, allowing them to identify targets and obtain decryption keys that allowed victims to recover encrypted files without paying a ransom.

Authorities continue to investigate Hive in an effort to identify the cybercriminals involved in the operation, including developers, administrators and affiliates. The US announced that it’s offering rewards of up to $10 million for information on these and other hackers.
Click to expand...

Several industry professionals have commented on various aspects of the Hive takedown, many noting that while Hive may have fallen, the threat actors behind the operation will likely continue their malicious activities.
And the feedback begins…
Click to expand...

guest · Jan 28, 2023

Ransomware experts laud Hive takedown but question impact without arrests
By Jonathan Greig @jgreigj - January 27, 2023

The Justice Department’s splashy announcement of the takedown of the Hive ransomware group’s infrastructure on Thursday was reminiscent of other recent high-profile operations against the scourge of ransomware.
Click to expand...

But the details of the operation set it apart from other ransomware group takedowns in recent years. FBI Director Christopher Wray said agents with the bureau’s Tampa Field Office gained “clandestine, persistent access” to the control panel used by Hive operators seven months ago, allowing them to identify victims and offer decryption keys to more than 1,300 of them around the world while preventing at least $130 million in ransom payments.

Still, one notable variable was missing from the Justice Department’s announcement: arrests. Europol said four experts were deployed to “coordinate the activities on the ground,” but no arrests have been announced in any of the 12 countries involved in the operation to take down Hive.
Click to expand...

Attorney General Merrick Garland declined to comment, noting that the investigation was ongoing. Wray attempted to frame the lack of arrests as part of an evolution in how the FBI is approaching ransomware investigations.

“More and more I think you can expect to see … situations where impact is achieved by more than just arrests, where we’re doing things like getting keys to victims, taking down infrastructure and seizing cryptocurrency,” Wray said during a press conference Thursday.
Click to expand...

guest · Feb 1, 2023

Will Hive Stay Kaput After FBI Busts Infrastructure?
Ransomware Group's Servers Remain Dark, But Rebooting Would Pose Scant Challenge
By Mathew J. Schwartz @euroinfosec - January 31, 2023

What's not to love about an international law enforcement operation wreaking disruption on Hive, the ransomware-wielding crime syndicate? But with no suspects in jail, it's unclear how long this takedown will stick before the bad guys get back their sting.
Click to expand...

There's still plenty to celebrate since Hive, one of the world's most active ransomware groups, went dark last week after the FBI and German and Dutch law enforcement agencies seized its servers. Anyone attempting to visit Hive's dark web sites didn't see ransomware content, but rather a seizure notice (see: FBI Seizes Hive Ransomware Servers in Multinational Takedown).

"We hacked the hackers," U.S. Deputy Attorney General Lisa O. Monaco told reporters on Thursday. In July, law enforcement infiltrated parts of Hive's infrastructure and quietly passed decryption keys to over 330 victims.
Click to expand...

Unfortunately, hackers have a habit of coming back, [...]

"Hive will bounce back, and there is already talk amongst ransomware criminals on the dark web about when and how Hive will resurface," says ransomware tracking expert Jon DiMaggio, chief security strategist at Analyst1. "Most speculate they will rebrand, which I think is likely, but they could simply set up new infrastructure and do a reset with the same brand and try and play off their former reputation."
Click to expand...

DiMaggio advocates psychological operations, if they're not already being used by the cops. "The issue is: Many criminals wonder if Hive was compromised - from a human aspect - and they are afraid law enforcement or the government has infiltrated some of the members themselves," he says. "It is a great time to play on these fears and create a further divide in the criminal community."

"The paranoia is certainly running rampant right now, which is a win," he adds.
Click to expand...

Rasheed187 · Feb 5, 2023

mood said: ↑

Industry Reactions to Hive Ransomware Takedown: Feedback Friday
By Eduard Kovacs @EduardKovacs - January 27, 2023
Click to expand...

I have to say this was pretty cool. I do wonder how they managed to hack into the servers. Would be cool if they got in by first compromising a hacker's PC with some trojan. Hackers getting hacked, this serves them right, gotta love this.

Log in or Sign up

Hive Ransomware Operation Shut Down by Law Enforcement

guest Guest

guest Guest

guest Guest

FanJ Updates Team

guest Guest

guest Guest

guest Guest

guest Guest

Rasheed187 Registered Member

Log in or Sign up

Hive Ransomware Operation Shut Down by Law Enforcement

guest Guest

guest Guest

guest Guest

FanJ Updates Team

guest Guest

guest Guest

guest Guest

guest Guest

Rasheed187 Registered Member

Useful Searches