The Hive ransomware group crossed a significant milestone earlier this week, the Cybersecurity Infrastructure and Safety Company (CISA) stated in a joint press launch, printed along with the Federal Bureau of Investigation (FBI) and the Division of Well being and Human Companies (HHS).

In keeping with the assertion, since June 2021 the group managed to contaminate greater than 1,300 firms with its ransomware variant and raked in north of $100 million for its efforts. 

What’s extra, the group doesn’t appear to take no for a solution. The three companies found Hive reinfecting these victims that select to revive their networks as a substitute of paying the ransom demand. 

Reinfecting rebellious victims

“Hive actors have been recognized to reinfect—with both Hive ransomware or one other ransomware variant—the networks of sufferer organizations who’ve restored their community with out making a ransom cost,” the press launch reads.

Hive additionally casts a comparatively vast web, when looking for new victims. Whereas it’s considerably targeted on Healthcare and Public Well being (PHP) organizations, it does get pleasure from an occasional authorities entity, communications agency, or IT firm. 

The three organizations are typically towards paying the ransom demand, as that doesn’t assure they’ll get the decryption key, or the stolen knowledge again. On the flip aspect, it is going to most positively inspire the group (and different, comparable teams, too) to proceed attacking, proceed deploying ransomware, and proceed asking for extra money. 

As a substitute, they urge the victims to report the assault to their native FBI subject workplace or attain out to CISA by way of e mail. 

These stories, it says within the launch, will assist regulation enforcement collect key knowledge that’s wanted to remain on Hive’s path, disrupt potential future assaults, and finally – deliver the risk actors to justice. 

Hive was first noticed within the early summer season of final yr. 

• These are the perfect firewalls (opens in new tab) proper now

Through BleepingComputer (opens in new tab)