The FBI on Thursday revealed it had secretly hacked and disrupted a prolific ransomware gang called Hive, a maneuver that allowed the bureau to thwart the group from collecting more than $130 million in ransomware demands from more than 300 victims, reports Reuters.
At a news conference, US Attorney General Merrick Garland, FBI Director Christopher Wray, and Deputy US Attorney General Lisa Monaco said government hackers broke into Hive's network and put the gang under surveillance, surreptitiously stealing the digital keys the group used to unlock victim organisations' data.
They were then able to alert victims in advance so they could take steps to protect their systems before Hive demanded the payments.
"Using lawful means, we hacked the hackers," Monaco told reporters. "We turned the tables on Hive."
News of the takedown first leaked on Thursday morning when Hive's website was replaced with a flashing message that said: "The Federal Bureau of Investigation seized this site as part of coordinated law enforcement action taken against Hive Ransomware."
Hive's servers were also seized by the German Federal Criminal Police and the Dutch National High Tech Crime Unit.
"Intensive cooperation across national borders and continents, characterized by mutual trust, is the key to fighting serious cybercrime effectively," said German police commissioner Udo Vogel in a statement from police and prosecutors in the state of Baden-Wuerttemberg, who assisted in the probe.
Reuters was not immediately able to locate contact details for Hive. It is unclear where they were geographically based.
The takedown of Hive is distinct from some of the other high-profile ransomware cases the US Justice Department has announced in recent years, such as a cyber attack in 2021 against the Colonial Pipeline Co.
In that case, the Justice Department seized some $2.3 million in cryptocurrency ransom after the company had already paid the hackers.
Here, there were no seizures because investigators intervened before Hive demanded the payments. The undercover infiltration, which started in July 2022, went undetected by the gang until now.