Infrastructure associated with Hive Ransomware as a Service (RaaS) operations was seized as part of a coordinated law enforcement effort involving 13 countries.
“Law enforcement identified the decryption key and shared it with many of the victims to help them regain access to their data without having to pay cybercriminals,” Europol said in a statement. said.
The U.S. Department of Justice (DoJ) has announced that the Federal Bureau of Investigation (FBI) will infiltrate Hive’s network in July 2022, obtain over 300 decryption keys, and hand them over to gang-compromised companies, selling 130 million Said it effectively saved a ransom of dollars.
The FBI has also distributed over 1,000 additional decryption keys to former Hive victims, the DoJ added.
Born in June 2021, Hive is a prolific cybercriminal group that has launched attacks against 1,500 organizations in over 80 countries, generating $100 million in illicit profits.
Targeted companies spanned a wide range of industries, including government facilities, telecommunications, critical manufacturing, information technology, and healthcare.
According to statistics collected by MalwareBytes, Hive will have 11 victims in November 2022, trailing Royal (45), LockBit (34), ALPHV (19), BianLian (16), and LV (16). Positioned in 6th place.
“Some Hive actors used single-factor logins through Remote Desktop Protocol, virtual private networks, and other remote network connection protocols to access victim networks,” Europol explained. increase.
“In other cases, Hive actors bypassed multi-factor authentication and exploited vulnerabilities to gain access, allowing malicious cybercriminals to change the case of usernames to was able to log in without prompting for the user’s second authentication factor.”
The international operation consisted of authorities from Canada, France, Germany, Ireland, Lithuania, the Netherlands, Norway, Portugal, Romania, Spain, Sweden, the United Kingdom, and the United States.
