The United States, along with international partners, topples a group specialized in piracy.
International cooperation in cyber security
Hacker technologies and electronic ransom gangs have developed and expanded their activities until they threaten vital institutions such as health and education, and even threaten entire countries, which prompted the FBI in the United States, in coordination with foreign entities and countries, to catch the “Hive” gang, which runs one of the largest electronic ransom networks in the world. the scientist.
WASHINGTON — US Attorney General Merrick Garland and other officials announced Thursday that the FBI has dismantled a network of ransomware gangs, saving numerous potential victims including hospitals and educational institutions from paying a potential $130 million ransom.
"Simply, and using legitimate means, we hacked the hackers," Deputy Attorney General Lisa Monaco told a news conference.
US officials said the targeted gang, known as "Hive Ransomware," runs one of the five largest ransomware networks in the world.
The Ministry of Justice confirmed that it will pursue those behind the gang until they are brought to justice.
Cyber security researchers and officials have long accused Russia of harboring ransomware gangs.
"A good covert operation can reduce confidence in operational security and inject suspicion among actors," said John Hultquist, president of Mandiant, a cybersecurity firm.
But, he added, "the group will never leave until they are caught. They will have to regroup, which takes time, but I bet they will reappear in due time.”
FBI Director Christopher Wray said the bureau quietly gained access to his control panel in July and was able to obtain software keys to decrypt a network of about 1,300 victims globally.
US officials credited German police and other international partners such as the Netherlands.
According to the public prosecutor in Stuttgart, Hiveware hackers were responsible for more than 1,500 serious cyberattacks worldwide. The losses are estimated in the billions of dollars.
Hackers are responsible for more than 1,500 dangerous cyberattacks worldwide, causing billions of dollars in damages.
Hackers in ransomware blackmail their victims to return their stolen data in exchange for sums of money. The Hive homepage now states that the FBI seized the site "as part of a coordinated action by law enforcement agencies against 'Hive ransomware'".
The Public Prosecutor's Office in Stuttgart announced the confiscation of a large number of servers as well as data and network connections. The group's websites were blocked.
The group used multiple techniques to target organizations operating in critical manufacturing, healthcare, information technology and government sectors, according to US officials.
It was not immediately clear how the removal would affect Hive's long-term operations. The officials did not announce any arrests but said they were designing a map of Hive officials who run the program and affiliates, who hit targets and negotiate with victims, to pursue prosecutions.
"I think anyone involved with 'Hive' should be concerned because this investigation is ongoing," Ray said.
"Cybercrime is an ever-evolving threat, but as I've said before, the Department of Justice will spare no resource to bring to justice anyone, anywhere who targets the United States with a ransomware attack," he added.
The U.S. Attorney asserted that thanks to hacking led by the FBI's Tampa office, agents were at one point able to disrupt the Hive attack against a Texas school and prevent it from paying $5 million.
The ransomware crisis is considered the largest problem in the world related to cybercrime, from the postal service in Britain and the health service in Ireland to the government of Costa Rica by the Russian-origin "Conti Ransomware" gang, which demanded a ransom of $ 20 million, as criminals control private computer networks victims or encrypt them, steal sensitive data and demand large sums of money.
As an example of Hive's threat, Garland said it blocked a hospital in the Midwest in 2021 from accepting new patients at the height of the Covid pandemic.
The threat captured the attention of the highest levels of the Biden administration two years ago after a series of high-profile attacks that threatened critical infrastructure and global industry. In May 2021, for example, hackers targeted the largest fuel pipeline in the United States, causing operators to shut it down briefly and pay a multimillion-dollar ransom that was largely recovered by the US government.
PreviousNext
Federal officials have used a variety of tools to try to combat the problem, but traditional law enforcement measures such as arrests and prosecutions have done little to discourage criminals.
Russia has long been home to several ransomware gangs.
In November 2021, alleged members of the Russian “Revel” gang were arrested around the world, as US authorities recovered more than $6 million in cryptocurrency.
A similar operation by the United States in June 2021 put the Darkside gang out of business and recovered $4.1 million in stolen funds.
“Darkside” appeared for the first time on hacking forums in the Russian language in August 2020, and it is a game or platform that includes malicious ransomware that presents itself in the form of a service, but it infects companies with malicious programs that allow them to be hacked and demand a ransom from their owners.
In January of 2021, the ransomware group's "Netwalker" darknet websites were also shut down, and a major affiliate group was arrested in Canada.
The strikes to hackers come as research indicates that ransomware gangs' profits have seen a 40 percent drop, with victims refusing to pay in 2022.
"We expect initiatives like this to grow stronger among allied cyber forces, to ensure that governments, organizations and citizens are better protected," said Kim Wiles, an e-government expert.