The Hive ransomware group that has targeted more than 1500 victims in over 80 countries around the world, including hospitals, has been disrupted in a months-long campaign against, the US Justice Department has announced.
Hive ransomware attacks have caused major disruptions in victim daily operations around the world and hindered responses to the COVID pandemic. In one case, a hospital attacked by Hive ransomware had to fall back to pen and paper to treat existing patients and could not take new admissions shortly after the attack.
The Justice Department revealed that the FBI had penetrated Hive’s computer network and captured its decryption keys, which were then offered to victims around the world. This saved them $130 million in ransom they would have had to otherwise pay to get their networks back.
Finally, the department announced that, in coordination with German and Dutch law enforcement, it has seized control of the servers and websites that Hive uses to communicate with its members, disrupting Hive’s ability to attack and extort victims.
Since June 2021, the Hive ransomware group has targeted more than 1500 victims around the world and received over $100 million in ransom payments.
Hive used a ransomware-as-a-service (RaaS) model featuring administrators, and affiliates. RaaS is a subscription-based model where the administrators develop an easy-to-use ransomware strain and then recruit affiliates to deploy the ransomware against victims. Affiliates identified targets and deployed this readymade malicious software to attack victims and then earned a percentage of each successful ransom payment.
Hive actors used a double-extortion model of attack: before encrypting the victim’s system, the affiliate would steal sensitive data. The affiliate then sought a ransom for both the decryption key necessary to decrypt the victim’s system and a promise to not publish the stolen data – usually the most sensitive, such as hospital patient data. After a victim pays, the affiliates and administrators split the ransom 80/20. Victims who do not pay on the Hive Leak Site. After Consulate Health Care was unable to pay the ransom, since its insurance did not cover such cyber crimes, Hive posted 550GB of personally identifiable information on its patients and employees online.
For more information about the malware, including technical information for organisations about how to mitigate its effects, is available from CISA, visit https://www.cisa.gov/uscert/ncas/alerts/aa22-321a.
