French authorities arrested a Russian national in Paris for allegedly helping the Hive ransomware gang with laundering their victims' ransom payments.
The suspect was apprehended after the French Anti-Cybercrime Office linked him to digital wallets that received millions of U.S. dollars from suspicious sources based on his activity on social networks.
This comes after Hive ransomware's Tor websites were seized in January in an international law enforcement operation after the FBI infiltrated the gang's servers in late July 2022.
This provided detailed information about Hive's attacks before they occurred and helped warn their targets.
The FBI also obtained and provided victims with over 1,300 decryption keys, preventing roughly $130 million in ransom payments from falling into the cybercriminals' hands.
The FBI and Dutch police also discovered Hive communication records, malware file hashes, and details on 250 Hive affiliates stored on Hive servers at a hosting provider in California and backup servers in the Netherlands.
The U.S. State Department is now offering up to $10 million for any information that could help link the Hive ransomware group with foreign governments.
In November, the FBI revealed that this ransomware operation had extorted around $100 million from over 1,500 companies since June 2021.
Hive operated as a ransomware-as-a-service provider for over two years since June 2019.
It used phishing attacks, exploited vulnerabilities in internet-facing devices, and compromised stolen credentials to breach organizations.
Since law enforcement took down the gang's infrastructure, a new ransomware-as-a-service operation named Hunters International has surfaced using code used by the Hive ransomware operation.
While analyzing a Hunters International ransomware sample, security researcher Will Thomas found code overlaps and similarities that matched over 60% of Hive ransomware's code.
This led to the valid assumption that the old ransomware gang has resumed activity under a different brand.
The group claims that their primary focus isn't encryption; instead, their operation's primary goal is to steal data and use it to pressure victims into paying ransoms.
Police dismantle ransomware group behind attacks in 71 countries.
US sanctions Russian who laundered money for Ryuk ransomware affiliate.
ASVEL basketball team confirms data breach after ransomware attack.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 13 Dec 2023 20:25:28 +0000