Brief Overview

Ransomware is a type of malicious attack that infiltrates a computer network and makes files inaccessible. Hackers then demand a ransom to unlock the system, typically in the form of cryptocurrency. The Hive group was known to re-infiltrate networks that tried to circumvent their attacks.

Hive Ransomware Group has targeted more than 1,500 victims around the world and received over $100 million ransom payments. The website for the group – considered among the most dangerous and prolific hacker gangs that targeted hospitals and public infrastructure – showed a message saying it had been seized by an international law enforcement coalition including the department and the FBI.

Our Researchers Comments

"Ladies and gentlemen, we got him”.

A historical line that will go down in history as a pivotal moment. On January 26th, 2023, the cyber world got its equivalent. Attorney General Merrick Garland took the stage at a press conference. He announced, “Last night, the Justice Department dismantled an international ransomware network responsible for extorting… hundreds of millions of dollars from victims in the United States and around the world.” A pivotal moment in the history of cybercrime.

‍

‍

The Ransomware group Hive was a prolific extorter, having thousands of victims across the globe, including victims in the United Kingdom. When Conti disbanded in early 2022, Hive became the purveyor of ransomware. This was done by building on the early Ransomware as a Service (RaaS) model laid out by Conti.It was this RaaS model that led to their success. Rather than struggling for initial compromises, such as propagating across a network, deploying a ransomware strain and managing the ransom payments and negotiation, Hive outsourced the first two steps of that chain. Suddenly their plug-and-play ransomware could be dropped onto networks that excitable “contractors” (and I use that term somewhat loosely) had already gained access to, and “hey presto” they have locked and encrypted every machine on the network. As such, Hive only needed to sit back and wait for the victim to pay large sums of money for their data. Of course, the extortion did not stop there. Hive would publish your data on their DarkWeb blog if you failed to pay up.

A two-pronged approach that made them one hundred million dollars, if not more. A sum that would place them in the top six thousand businesses worldwide in terms of revenue.However, the party was not to last forever. When you are as big as Hive was, it is only a matter of time before the beady eyes of the international intelligence agencies fix their gaze on you. Few could stand against the combined might of the German Reutlingen Police Headquarters-CID Esslingen, the German Federal Criminal Police, Europol, the Netherlands Politie, and the US Department of Justice, and indeed Hive were not among those few. In an operation that started back in July of 2022, Hive was infiltrated. Early reports have alleged a plethora of vectors were used for this initial compromise, with NSA owning 0Day’s chief amongst the conspiracy theories.

Conclusion

In all likelihood, phishing or getting an operative inside the organisation was the vector. A multi-national million-dollar crime syndicate toppled by clicking a link. Does that not make you think it might be time to brush up on your Phishing training?

Shameless plugs aside, this is still a momentous occasion. We can all sleep a little easier tonight, knowing that Hive is no more for the time being.

Our OSINT features Discover, Remove & Mitigate Public Facing Threats making sure your business isn't targeted by cyber threats.

‍

‍