The Department of Justice dismantles a major ransomware operation

WASHINGTON — Federal investigators have taken down the computer networks of a cybercriminal organization that demanded hundreds of millions of dollars in ransom from schools, hospitals and other critical infrastructure, the Justice Department announced Thursday.

In July, the FBI and its counterparts in Germany, the Netherlands and the European law enforcement agency Europol gained covert access to servers and websites run by the Hive organization, considered one of of the most active ransomware groups last year. Over the next several months, operatives hid in the system, identified targets, and repeatedly thwarted Hive’s attempts to extort over 300 victims, preventing them from having to pay $130 million in ransoms. .

It was a “21st century cyber intervention,” Lisa O. Monaco, assistant attorney general, said at a press conference Thursday. “Simply put, using legal means, we hacked the hackers.”

The operation against Hive is part of a larger effort by the department to combat ransomware, a global threat that has grown in recent years and which the Biden administration has considered a national security priority.

On Wednesday evening, officials seized two back-end computer servers in Los Angeles used by Hive and took down its dark web sites, allowing users to hide their identities, Attorney General Merrick B. Garland said during the hearing. press conference. The department has not announced any arrests, but officials said the investigation is continuing.

“Cybercrime is an ever-evolving threat,” Garland said. “But as I’ve said before, the Department of Justice will spare no resources in identifying and bringing to justice anyone, anywhere who targets the United States with a ransomware attack.”

Since July 2021, Hive affiliates have operated a so-called double extortion scheme in which hackers encrypt victims’ data, threaten to leak it online and demand a ransom, often worth millions of dollars, to return access and a promise not to publish the stolen information.

Through these attacks, the group managed to extort more than $100 million in payments and targeted more than 1,500 schools, hospitals, businesses and other institutions that authorities deemed critical infrastructure. These include health care groups and school districts in the United States as well as large corporations in Europe and the public health system in Costa Rica.

In an attack on a Midwestern hospital during the coronavirus pandemic in August 2021, Hive blocked the hospital from accepting new patients and gaining access to its digital patient information database, forcing hospital staff to rely on analog copies. The hospital only recovered his data after paying a ransom.

Only 20% of Hive victims reported potential problems to law enforcement, according to FBI Director Christopher A. Wray, who urged other ransomware victims to speak up.