Breaking news: FBI shuts down Hive ransomware gang’s IT infrastructure

Law enforcement is certainly having more success at disrupting ransomware operations, probably because more resources are being allocated to their efforts, said Brett Callow, British Columbia-based threat analyst for Emisisoft. “While individual disruptions may not have a significant impact on the overall landscape, collectively they do, with the intel that is gathered being used to target individuals and other components of the ransomware supply chain.” Hive is one of the most active ransomware operations around – perhaps the most active – and was responsible for at least 11 of the incidents involving US governments, schools and healthcare providers in 2022. Hive ransomware attacks have caused major disruptions in victims’ daily operations around the world and affected responses to the COVID-19 pandemic, said the FBI. In one case, a hospital attacked by Hive ransomware had to resort to analog methods to treat existing patients and was unable to accept new patients immediately following the attack. According to a background paper on the group by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), Hive’s affiliates often get initial access to victim networks by using single factor logins via Windows Remote Desktop Protocol (RDP), virtual private networks (VPNs), and other remote network connection protocols. In some cases, Hive actors bypassed multifactor authentication and gained access to  Fortinet FortiOS servers by exploiting a known and unpatched vulnerability, CVE-2020-12812. This vulnerability enables a malicious cyber actor to log in without a prompt for the user’s second authentication factor (FortiToken) when the actor changes the case of the username. Hive actors have also gained initial access to victim networks by distributing phishing emails with malicious attachments. Separately, today Cyberint released a report on ransomware trends in 2022. Among the conclusions:

• The U.S. is still the most targeted area of the world, with 1060 victims, a decline of almost 300 victims since last year, followed by the UK, Canada, and Germany.

• While Q2 and Q3 saw major drops in ransomware activity (with 708 and 666 incidents, respectively, down from 763 in Q1), Q4 saw a slight rise to 672. Cyberint analysts describe the Q4 increase as indicative of the new and promising groups established in Q3 and Q4, such as Royal and BlackBasta, gaining ground.

• LockBit 3.0’s rise to power and gaining notoriety without the use of Twitter for “PR” like other groups have increasingly done.

• Talent for hire in the ransomware world is changing the game: Lockbit’s ‘Bug Bounty Program,’ which demonstrated the group’s arrogance and strength, offered rewards for anyone who found vulnerabilities in their servers.

• The rise of Royal in the last months of 2022 saw them achieve a victim count rate already higher than LockBit’s, suggesting competition between the two can be expected in 2023.