FBI hacks Hive ransomware group

The FBI hacked Hive, a hacker group that operates in more than 80 countries around the world. Stating that they infiltrated Hive’s servers, the authorities announced that they recovered approximately 130 million dollars of encrypted data.

FBI hacks systems belonging to Hive ransomware group

Working in partnership with Germany and the Netherlands, the FBI infiltrated Hive servers and seized more than 300 decryption keys. Explaining that the relevant keys were returned to the ransomware victims, Deputy Attorney General Lisa Monaco said at a press conference, “Simply put, we hacked the hackers using legal tools.” said.

Underlining that Hive is one of the top 5 ransomware groups, Monaco said, “We reversed Hive’s situation and disrupted their business model. We found that Hive has received over $100 million in ransom payments from its victims since June 2021.” made statements.

US Attorney General Merrick Garland said in a statement that the FBI used the decryption keys obtained to open the data of a Louisiana hospital in Texas, which was asked for a million dollars, and a food service that was asked for a $10 million ransom. Adopting the business model known as ransomware as a service (RaaS), the group also sells ransomware to other hackers.

The group, which publishes the data of victims who refuse to pay, on a site called HiveLeaks, hacks servers by exploiting pishing and FortiToken authentication vulnerabilities. In a November warning, CISA explained how the attacks targeted businesses and organizations running their own Microsoft Exchange servers.

Hive is the largest ransomware group cracked by US feds since REvil, which was responsible for leaking MacBook schematics from an Apple supplier, as well as the world’s largest meat supplier, in 2021. FBI Director Christopher Wray noted that only 20 percent of identified victims reached the FBI for help.