The FBI issued a statement stating that the gang has successfully extorted over $100 million from more than 1,000 companies since June 2021.
See also: Hive ransomware: Claims to have attacked Tata Power
The FBI added that the Hive gang will deploy additional ransomware payloads on the networks of targets who do not succumb to their ransom demands.
Hive is a type of ransomware that spreads through phishing emails . These emails typically contain an attachment or link that, when clicked, will infect the victim's computer with the Hive malware. Once the computer is infected, the ransomware will begin encrypting the victim's files. Once the files are encrypted, the victim will see a message demanding a ransom to decrypt them.
Hive is particularly dangerous because it not only encrypts the victim's files, but also steals their credentials. This means that even if the ransom, the attackers could still access the victim's accounts and sensitive information.
The FBI revealed that, as of November 2022, 1,300 companies worldwide have fallen victim to the Hive ransomware. The crooks have collected approximately $100 million in ransom from these businesses.
If a company does not “give in” and pay the ransom, it will often be re-infected with either Hive ransomware or some other type of ransomware.
The list of victims includes a wide variety of industries and sectors, with a focus on healthcare and public health (HPH) entities. Government facilities, communications organizations, and information technology organizations are also included.
See also: Hive ransomware: Responsible for the attack on the New York Racing Association?
A joint advisory was published today by the Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Health and Human Services (HHS) disclosing this information .
The FBI has discovered new methods that the Hive ransomware uses to attack, and today's advisory is being issued to share these indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs).
The goal is to assist defenders in identifying any illegal activity related to Hive subsidiaries and to reduce the consequences of such events.
Since the beginning of this year, more than 850 victims have submitted samples to the ID Ransomware platform – although this does not include all attacks . This latest play followed a massive spike in activity from late March to mid-April.
The three federal agencies behind this advisory do not recommend paying the ransom, as this would likely encourage other potential cybercriminals to join in on ransomware attacks. However, they urge victims of Hive attacks to report them to their nearest FBI office or CISA at report@cisa.gov, regardless of whether they paid the ransom or not.
See also: Hive ransomware: Says it attacked Bell Technical Solutions
By taking this action, law enforcement will be better equipped to understand the ransomware operation's movements, prevent future attacks, or prosecute those responsible.
In August 2021, the FBI released additional information about the Hive ransomware attacks, including breach indicators and technical details.
