US says Hive ransomware gang taken down

The FBI says it has secretly hacked and disrupted a prolific ransomware gang called Hive, a manoeuvre that allowed the bureau to thwart the group from collecting more than $US130 million ($A183 million) in ransomware demands from more than 300 victims.

At a news conference, US Attorney General Merrick Garland, FBI Director Christopher Wray and Deputy US Attorney General Lisa Monaco said government hackers broke into Hive’s network and put the gang under surveillance, surreptitiously stealing the digital keys the group used to unlock victim organisations’ data.

They were then able to alert victims in advance so they could take steps to protect their systems before Hive demanded the payments.

“Using lawful means, we hacked the hackers,” Monaco told reporters.

“We turned the tables on Hive.”

News of the takedown first leaked on Thursday when Hive’s website was replaced with a flashing message that said: “The Federal Bureau of Investigation seized this site as part of coordinated law enforcement action taken against Hive Ransomware.”

Hive’s servers were also seized by the German Federal Criminal Police and the Dutch National High Tech Crime Unit.

“Intensive cooperation across national borders and continents, characterised by mutual trust, is the key to fighting serious cybercrime effectively,” German police commissioner Udo Vogel said in a statement from police and prosecutors in the state of Baden-Wuerttemberg.

Reuters was not immediately able to locate contact details for Hive. 

It is unclear where they were geographically based.

The takedown of Hive is distinct from some of the other high-profile ransomware cases the US Justice Department has announced in recent years, such as a cyber attack in 2021 against the Colonial Pipeline Co.

In that case, the Justice Department seized $US2.3 million ($A3.2 million) in cryptocurrency ransom after the company had already paid the hackers.

Here, there were no seizures because investigators intervened before Hive demanded the payments. 

The undercover infiltration, which started in July 2022, went undetected by the gang until now.

Hive was one the most prolific among a wide range of cybercriminal groups that extort international businesses by encrypting their data and demanding massive cryptocurrency payments in return.

The Justice Department said that over the years, Hive has targeted more than 1500 victims in 80 different countries and has collected more than $US100 million in ransomware payments.

Although there were no arrests announced on Wednesday, one department official told reporters to “stay tuned”.

Canadian researcher Brett Callow, of cybersecurity company Emsisoft, said that Hive was responsible for at least 11 incidents involving US government organisations, schools and healthcare providers last year.

“Hive is one of the most active groups around, if not the most active,” he said in an email.

Garland said the FBI’s operation helped a wide range of victims, including a Texas school district.

“The bureau provided decryption keys to the school district, saving it from making a $US5 million ransom payment,” he said. 

A Louisiana hospital, meanwhile, was spared $US3 million.

Garland said the department’s investigation remains ongoing.