US, German authorities block 'Hive' ransomware website
January 26, 2023
An international operation against cybercrime has blocked a website operated on the darknet by the Hive ransomware gang, German prosecutors and the US Justice Department said on Thursday.
Prosecutors in the southwestern city of Stuttgart said Hive was responsible for more than 1,500 cyberattacks against companies, 70 of them being in Germany.
What did the US Justice Department say?
"Last night, the Justice Department dismantled an international ransomware network responsible for extorting and attempting to extort hundreds of millions of dollars from victims in the United States and around the world," US Attorney General Merrick Garland said, adding that the department had worked with German and Dutch law enforcement to shut down the website.
The Justice Department said that the seizure had thwarted over $130 million (€120 million) in Hive-related ransom demands.
"We hacked the hackers," US Deputy Attorney General Lisa Monaco said.
Garland said that the FBI had disrupted a ransomware attack on a Louisiana hospital and a Texas school district, preventing the attempted extortion of millions of dollars. The Justice Department said that it had recovered over 300 decryption keys since infiltrating Hive's network in July 2022.
US authorities did not give details on who is behind Hive, saying that investigations are ongoing.
What is the Hive ransomware group?
Clients of the Hive group would use its software and services to break into and lock IT systems and then demand payment, often in cryptocurrency, to unlock them. Hive and clients would then share the profits from the ransom.
A US government advisory in 2022 said that Hive had received approximately $100 million in ransom payments. The gang targeted a wide range of businesses and critical infrastructure sectors, "especially" health care and public health, the advisory said.
If victims refused to pay, Hive would publish confidential documents on the internet.
US cybersecurity advisers said victims of the group included India's Tata Power, German retail giant Media Markt, Costa Rica's public health service, Indonesian state oil and gas company Pertamina and multiple US hospitals.
sdi/nm (Reuters, AP, AFP)