US Department of Justice announce an international law enforcement operation against the Hive ransomware operation

On the 26th of January 2023, the US Department of Justice along with the FBI and Europol announced an international law enforcement operation against the Hive ransomware operation which resulted in the Hive ransomware operation’s Tor payment and data leak sites being seized.

The law enforcement operation involved the FBI and other international partners secretly infiltrating the Hive ransomware gang’s infrastructure in July 2022, where they were able to secretly monitor the ransomware operation for over six months. This led to them learning about attacks before they occurred and warning targets, and obtaining and distributing decryption keys to victims, preventing approximately $130 million in ransom payments.

“Since late July 2022, the FBI has penetrated Hive’s computer networks, captured its decryption keys, and offered them to victims worldwide, preventing victims from having to pay $130 million in ransom demanded” – US Department of Justice.

The announcement also revealed an application for a warrant where the FBI gained access to two dedicated servers and one virtual private server at a hosting provider in California that was leased using email addresses belonging to Hive members. Additionally, Dutch police also gained access to two backup dedicated servers hosted in the Netherlands in a coordinated action with the FBI.

At this current time, the Hive ransomware gang’s Tor websites now display a seizure notice listing a wide range of other countries involved in the law enforcement operation, including Germany, Canada, France, Lithuania, Netherlands, Norway, Portugal, Romania, Spain, Sweden, and the United Kingdom.