The FBI, US DOJ, Secret Service, Europol, and others seize ransomware gang Hive's site and decryption keys; the FBI had access to Hive's network since July 2022
using lawful means, we hacked the hackers.” Tonya Riley / @tonyajoriley : Since infiltrating the network the FBI in July it was able to help 1,300 victims with decryption keys, preventing what the FBI describes as a potential $130 million in ransomware payments. The FBI also provided support to victims to kick Hive off their networks before attacks. Benjamin Freed / @brfreed : Deputy AG Lisa Monaco says FBI hid in Hive ransomware network “for months,” passing on decryption keys to victims to help them avoid paying ransom demands. Monaco: “Simply put, using lawful means, we hacked the hackers.” Sergiu Gatlan / @serghei : FBI hacked the ransomware gang last July and distributed over 1,300 additional decryption keys to Hive victims, saving victims ~$130 million in ransom payments. Also helped victims kick Hive affiliates out of their networks before the ransomware payloads were deployed. https://twitter.com/... @vxunderground : This is the 2nd time, that we are aware of, that the United States Department of Justice, has admitted to using offensive operations to take down, or disrupt, ransomware groups. The DoJ has announced that they are now focusing their efforts on HIVE affiliates and developers. @vxunderground : The United States Department of Justice has stated in their official press conference, regarding the disruption of HIVE ransomware group infrastructure, that they “hacked the hackers” to disrupt their operations and infrastructure. They state they have decrypted 1,500 companies. @usbotschaft : The Justice Department announced today its months-long disruption campaign against the Hive ransomware group that has targeted more than 1,500 victims in over 80 countries around the world, including hospitals, school districts, financial firms, and critical infrastructure: https://twitter.com/... @fbi : FBI Covertly Infiltrated Hive Network, Thwarting Over $130 Million in Ransom Demands @FBITampa https://www.justice.gov/... @fbi : You can read a statement from #FBI Director Christopher Wray about today's announcement below: https://www.justice.gov/.... https://twitter.com/...
TechCrunchCarly Page
Context & Ripple Effects
Hive had already been tied to roughly $100 million in extortion from more than 1,300 organizations, including government and public-health entities, in the FBI's earlier assessment of the gang's reach. The seizure follows a DOJ strategy that explicitly targeted the broader ransomware ecosystem through prosecutions and other disruption efforts.
First-order effects
Hive loses the infrastructure and decryption material seized by the FBI, DOJ, Secret Service, Europol, and partner agencies, while affected organizations receive keys and assistance removing Hive affiliates from their networks.
More than 1,300 Hive victims can avoid ransom demands using keys produced during the FBI's months-long access to the gang's network.
Second-order effects
Hive affiliates and developers face a more immediate enforcement threat because the DOJ campaign was directed at both parts of the operation, not solely its public-facing site.
Ransomware victims gain a stronger incentive to engage law enforcement early: the FBI used its access to provide decryptors and help organizations evict attackers before attacks were completed.
Third-order effects
The operation reinforces an enforcement model built around persistent access to ransomware infrastructure, victim support, and coordinated international seizures rather than post-incident prosecutions alone.
If agencies repeat that model across other ransomware operations, criminal groups will face pressure to treat their infrastructure and affiliate networks as operational liabilities, not just victims' defenses.
The trend: Ransomware enforcement is moving toward coordinated, intelligence-led disruption that combines covert access, victim remediation, and infrastructure takedowns.
As a number of people have reported, Hive has has their infrastructure seized by a truly impressive array of law enforcement. This also means another leader, in terms of postings to data leak sites (FWIW), has fallen and certain members of Conti are now 0-2. https://twitter.com/.…
Congratulations to @FBI for shutting down this major cybercriminal network. Thank you for your tireless work to defend our nation from cyber threats like these. https://www.washingtonpost.com/ ...
Attorney General Merrick Garland said the group, called Hive, hacked hospitals, school districts, financial firms and other entities https://www.washingtonpost.com/ ...
This is a very cool operation against #ransomware. Kudos to @FBI & the 🇳🇱& 🇩🇪authorities. One striking point: only 20% of US victims the USG tracked notified US authorities...😬. Sensible analysis here too from @uuallan (as always) https://www.washingtonpost.com/ ...
U.S. Department of Justice Disrupts Hive Ransomware Variant FBI Covertly Infiltrated Hive Network, Thwarting Over $130 Million in Ransom Demands https://www.justice.gov/...
HIVE ransomware group's victim list is extensive and spans years. It ranges from small businesses to healthcare institutions Full list of publicly known victims: https://ransomwatch.telemetry.ltd/ ... *Paying victims are not listed, obviously
Hive ransomware gang has been taken down by the decryption keys seized. The sting involved the FBI, Europol, as well as police from Germany, the Netherlands and others. Hive is a prolific ransomware group which often targets hospitals and infrastructure. https://www.europol.europ…
NOTE - no arrests. But this police operation is massive and will knock the confidence of ransomware crews the world over. I predict this will lead to a closing of ranks for ransomware crews. Maybe even the end of the Ransomware As A Service model?
The Hive ransomware group, which targeted governments, businesses, and organizations worldwide, was successfully disrupted. This coordinated operation with our global partners prevented $130 million+ in ransom payments. #ReportTheCompromise to https://ic3.gov/ https://twitter.com…
DAG Monaco: “In a 21st century cyber stakeout, our investigative team turned the tables on Hive, swiping their decryption keys, passing them to victims, and ultimately averting more than $130 million dollars in ransomware payments — using lawful means, we hacked the hackers.”
Since infiltrating the network the FBI in July it was able to help 1,300 victims with decryption keys, preventing what the FBI describes as a potential $130 million in ransomware payments. The FBI also provided support to victims to kick Hive off their networks before attacks.
Deputy AG Lisa Monaco says FBI hid in Hive ransomware network “for months,” passing on decryption keys to victims to help them avoid paying ransom demands. Monaco: “Simply put, using lawful means, we hacked the hackers.”
FBI hacked the ransomware gang last July and distributed over 1,300 additional decryption keys to Hive victims, saving victims ~$130 million in ransom payments. Also helped victims kick Hive affiliates out of their networks before the ransomware payloads were deployed. https://tw…
This is the 2nd time, that we are aware of, that the United States Department of Justice, has admitted to using offensive operations to take down, or disrupt, ransomware groups. The DoJ has announced that they are now focusing their efforts on HIVE affiliates and developers.
The United States Department of Justice has stated in their official press conference, regarding the disruption of HIVE ransomware group infrastructure, that they “hacked the hackers” to disrupt their operations and infrastructure. They state they have decrypted 1,500 companies.
The Justice Department announced today its months-long disruption campaign against the Hive ransomware group that has targeted more than 1,500 victims in over 80 countries around the world, including hospitals, school districts, financial firms, and critical infrastructure: https…