Law enforcement authorities from over a dozen countries in Europe and North America have taken part in disrupting the activities of the Hive ransomware group, the U.S. Justice Department and Europol announced. Hive is believed to have targeted various organizations worldwide in the past couple of years, often extorting payments in cryptocurrency.

Captured Decryption Keys Helped Hive Victims Avoid Paying $130 Million in Ransom

Ransomware network Hive, which has had around 1,500 victims in more than 80 countries, has been hit in a months-long disruption campaign, the U.S. Department of Justice (DOJ) and the European Union Agency for Law Enforcement Cooperation (Europol) revealed. A total of 13 nations participated in the operation, including EU member states, the U.K. and Canada.

Hive has been identified as a major cybersecurity threat as the ransomware has been used by affiliated actors to compromise and encrypt data and computer systems of government facilities, oil multinationals, IT and telecom companies in the EU and U.S., Europol said. Hospitals, schools, financial firms, and critical infrastructure have been targeted, the DOJ noted.

It has been one of the most prolific ransomware strains, Chainalysis pointed out, which has collected at least $100 million from victims since its launch in 2021. A recent report by the blockchain forensics company unveiled that revenue from such attacks has decreased last year, with a growing number of affected organizations refusing to pay the demanded ransoms.

According to the announcements by the law enforcement authorities, the U.S. Federal Bureau of Investigation (FBI) penetrated Hive’s computers in July 2022 and captured its decryption keys, providing them to victims around the world which prevented them from paying another $130 million.

Working with the German Federal Police and the Dutch High Tech Crime Unit, the Bureau has now seized control over the servers and websites that Hive used to communicate with its members and the victims, including the darknet domain where the stolen data was sometimes posted. FBI Director Christopher Wray was quoted as stating:

The coordinated disruption of Hive’s computer networks … shows what we can accomplish by combining a relentless search for useful technical information to share with victims.

The Hive ransomware was created, maintained and updated by developers while being employed by affiliates in a ‘ransomware-as-a-service’ (RaaS) double extortion model, Europol explained. The affiliates would initially copy the data and then encrypt the files before asking for a ransom to decrypt the information and not publish it on the leak site.

The attackers exploited various vulnerabilities and used a number of methods, including single factor logins via Remote Desktop Protocol (RDP), virtual private networks (VPNs), and other remote network connection protocols as well as phishing emails with malicious attachments, the law enforcement agencies detailed.

Do you expect police authorities around the world to dismantle more ransomware networks in the near future? Tell us in the comments section below.

Cryptocurrency exchange Bitzlato, better known to the Russian-speaking segment of the market, has been taken down as part of an “international cryptocurrency enforcement action,” the U.S. Justice Department announced. The Russian owner of the platform has been arrested for his role in the alleged transmission of illicit money. Bitzlato claimed it was hacked.

US, France Hit Cryptocurrency Exchange Bitzlato, Russian Co-founder Detained in Miami

U.S. authorities have apprehended Anatoly Legkodymov, a resident of China, on charges that his Hong Kong-registered crypto trading platform, Bitzlato, processed illicit funds worth hundreds of millions of dollars. The Russian, a co-founder and majority owner of the exchange, was arrested by the FBI in Miami on Tuesday, a high-ranking official from the United States Department of Justice (DOJ) revealed.

Speaking during a press conference, Deputy Attorney General Lisa Monaco said that Justice Department agents and prosecutors, working with the U.S. Treasury Department and French law enforcement, have “disrupted Bitzlato, a China-based cryptocurrency exchange, notorious for laundering criminal proceeds from the darknet” and ransomware attacks. She also stated:

Today, the Department of Justice has dealt a significant blow to the crypto crime ecosystem.

Legkodymov is accused of operating the exchange as a “high-tech financial hub that, in his own words, catered to ‘known crooks’,” Monaco explained. She went on to allege that Bitzlato was a “crucial financial resource” for Hydra, the largest darknet market, with Russian roots, which was shut down in April, last year, by the German police with the support of U.S. agencies.

According to the DOJ, Hydra buyers funded illicit purchases from crypto accounts hosted at Bitzlato while sellers of drugs, stolen financial information and hacking tools sent criminal proceeds to accounts at the exchange, collectively amounting to $700 million in direct and indirect transfers between 2018 and 2022.

The deputy attorney general also said that the participants in the operation have engaged in a “coordinated campaign of disruption.” This included law enforcement actions in a number of European countries and the seizure of Bitzlato’s servers. By midday Wednesday, Bitzlato’s website was replaced by a notice saying that the service had been seized by French authorities, Reuters reported.

Crypto Exchange Bitzlato Claims It Was Hacked, Halts Withdrawals

Also on Wednesday, the operators of Bitzlato announced on Telegram, that the exchange had suffered a hacking attack. They told users that withdrawals had been suspended indefinitely and asked them to refrain from sending coins to the platform until the issue is resolved.

“Our service was hacked, part of the funds was withdrawn from the service,” the exchange said, noting that the attackers were able to steal a small portion of the funds without specifying the amount. It also sought to assure customers in a second message that their assets were not lost, stating:

For all victims, we guarantee a refund.

“As a security measure, we have disabled the service, we ask you not to replenish the wallets of our service until the work is restored,” Bitzlato reiterated, adding that its team was working on the problem. At the time of writing, the platform is still offline.

The hack presumably took place after on Tuesday the exchange announced maintenance scheduled for Thursday, Jan. 19, “aimed at improving the operation of the service and its security.” The notice informed users it will halt transactions between 5 and 9 a.m. Moscow time.

“We strongly recommend that you organize your work activities taking into account the amendments in order to avoid unpleasant situations,” the platform advised customers, informing them that it plans to disable deposits, withdrawals and trading.

Bitzlato launched in 2016 under the name Changebot and later became a cryptocurrency exchange offering peer-to-peer (P2P) trading services. It lists pairs of the Russian ruble with BTC, ETH, USDT, and other digital coins which can be bought and sold with a variety of payment methods.

Online crypto exchangers like Bitzlato are popular in Russia and the former Soviet space but as crypto assets are yet to be fully regulated in the region, they are often targeted by authorities across the Commonwealth of Independent States. A report recently revealed that the Belarusian judiciary has imposed a hefty fine on the operator of one such platform.

Do you expect other similar operations against crypto trading platforms in the near future? Share your thoughts on the subject in the comments section below.