hlt.today logo n
Tuesday, July 16, 2024

FBI EUROPOL Shuts Down Hive Cyber Criminals Ransomware Activities

HLS.Today EUR 100 Million Recovered as FBI EUROPOL Shuts Down Hive Cyber Criminals Ransomware Activities

HLS.Today – EUROPOL Cybercriminals stung as HIVE infrastructure shut down. Europol supported German, Dutch and US authorities to shut down the servers and provide decryption tools to victims.

Europol supported the German, Dutch and US authorities in taking down the infrastructure of the prolific HIVE ransomware. This international operation involved authorities from 13* countries in total. Law enforcement identified the decryption keys and shared them with many of the victims, helping them regain access to their data without paying the cybercriminals. 

In the last year, HIVE ransomware has been identified as a major threat as it has been used to compromise and encrypt the data and computer systems of large IT and oil multinationals in the EU and the USA. Since June 2021, over 1 500 companies from over 80 countries worldwide have fallen victim to HIVE associates and lost almost EUR 100 million in ransom payments. Affiliates executed the cyberattacks, but the HIVE ransomware was created, maintained and updated by developers. Affiliates used the double extortion model of ‘ransomware-as-a-service’; first, they copied data and then encrypted the files. Then, they asked for a ransom to both decrypt the files and to not publish the stolen data on the Hive Leak Site. When the victims paid, the ransom was then split between affiliates (who received 80 %) and developers (who received 20 %). 

Other dangerous ransomware groups have also used this so-called ransomware-as-a-service (RaaS) model to perpetrate high-level attacks in the last few years. This has included asking for millions of euros in ransoms to decrypt affected systems, often in companies maintaining critical infrastructures. Since June 2021, criminals have used HIVE ransomware to target a wide range of businesses and critical infrastructure sectors, including government facilities, telecommunication companies, manufacturing, information technology, and healthcare and public health. In one major attack, HIVE affiliates targeted a hospital, which led to severe repercussions about how the hospital could deal with the COVID-19 pandemic. Due to the attack, this hospital had to resort to analogue methods to treat existing patients, and was unable to accept new ones.  

HLS.Today Featured Image

The affiliates attacked companies in different ways. Some HIVE actors gained access to victim’s networks by using single factor logins via Remote Desktop Protocol, virtual private networks, and other remote network connection protocols. In other cases, HIVE actors bypassed multifactor authentication and gained access by exploiting vulnerabilities. This enabled malicious cybercriminals to log in without a prompt for the user’s second authentication factor by changing the case of the username. Some HIVE actors also gained initial access to victim’s networks by distributing phishing emails with malicious attachments and by exploiting the vulnerabilities of the operating systems of the attacked devices. 

About EUR 120 million saved thanks to mitigation efforts

Europol streamlined victim mitigation efforts with other EU countries, which prevented private companies from falling victim to HIVE ransomware. Law enforcement provided the decryption key to companies which had been compromised in order to help them decrypt their data without paying the ransom. This effort has prevented the payment of more than USD 130 million or the equivalent of about EUR 120 million of ransom payments.

Europol facilitated the information exchange, supported the coordination of the operation and funded operational meetings in Portugal and the Netherlands. Europol also provided analytical support linking available data to various criminal cases within and outside the EU, and supported the investigation through cryptocurrency, malware, decryption and forensic analysis. 

On the action days, Europol deployed four experts to help coordinate the activities on the ground. Europol supported the law enforcement authorities involved by coordinating the cryptocurrency and malware analysis, cross-checking operational information against Europol’s databases, and further operational analysis and forensic support. Analysis of this data and other related cases is expected to trigger further investigative activities. The Joint Cybercrime Action Taskforce (J-CAT) at Europol also supported the operation. This standing operational team consists of cybercrime liaison officers from different countries who work on high-profile cybercrime investigations.

*Law enforcement authorities involved

Canada – Royal Canadian Mounted Police (RCMP) & Peel Regional Police

France: National Police (Police Nationale)

Germany: Federal Criminal Police Office (Bundeskriminalamt) and Police Headquarters Reutlingen – CID Esslingen (Polizei BW)

Ireland: National Police (An Garda Síochána)

Lithuania: Criminal Police Bureau (Kriminalinės Policijos Biuras)

Netherlands – National Police (Politie)

Norway: National Police (Politiet)

Portugal: Judicial Police (Polícia Judiciária)

Romania: Romanian Police (Poliția Română – DCCO)

Spain: Spanish Police (Policía Nacional)

Sweden: Swedish Police (Polisen)

United Kingdom – National Crime Agency

USA – United States Secret Service, Federal Bureau of Investigations

Headquartered in The Hague, the Netherlands, Europol supports the 27 EU Member States in their fight against terrorism, cybercrime, and other serious and organized crime forms. Europol also works with many non-EU partner states and international organisations. From its various threat assessments to its intelligence-gathering and operational activities, Europol has the tools and resources it needs to do its part in making Europe safer.




Topics, Products, Events, Opportunities:

Our Weekly Top Articles

Related Articles

A comment or question? Drop us a line.

About HLS.Today

HLS.Today’s purpose is to cover news and information for the public and private sectors. We are also covering the latest product and service innovations in the homeland security and public safety industries at large. The main objective of this information platform is to provide professionals and executives with relevant information and tools to enrich their knowledge when making an informed decision.

We invite you to join our weekly newsletter, which will cover the featured stories and most read articles of the week in your email. We also don’t like spam emails and promise you we will not share your emails with anyone. Contact us and add your email to our mailing list.

Skip to content