FBI’s First Victory: Hive Brought Down Sans Arrests, Agent Hints at More to Come

• The FBI successfully dismantled Hive, a prominent cybercrime group, earlier this year, without making any arrests.
• It is highly unusual for the federal authorities to publicly announce a complex operation without accompanying arrests.
• However, according to a FBI agent involved in the investigation, this is only the beginning of the fight against these criminals.

The FBI successfully dismantled a highly active ransomware group without making any arrests this year. However, one agent involved in the investigation informed Politico that this operation is just the beginning.

The bureau conducted a month-long sting operation against the cybercrime group known as Hive. The operation garnered attention when the Justice Department announced in January that they had gained access to Hive’s computer networks, captured decryption keys, and offered them to victims worldwide. This prevented victims from paying $130 million demanded as ransom.

Federal authorities also coordinated with law enforcement agencies in Germany and the Netherlands to take down Hive’s servers and websites used for communication, effectively disrupting the group’s ability to attack and extort victims.

Hive, believed to have its base in Russia, has long been operating as a safe haven for cybercriminal organizations. As previously reported by Insider’s Katie Canales, the Kremlin tacitly approves hackers to operate within its borders, as long as Russia and its allies are not targeted.

Cybersecurity experts find it unusual for the FBI to carry out such a comprehensive operation without making any arrests. However, Justin Crenshaw, a supervisory agent in the bureau’s Tampa office, confirmed to Politico that this is just the starting point.

Crenshaw and Bryan Smith, a 20-year FBI veteran and the bureau’s cybercriminals section chief, revealed that prior to the Hive takedown announcement, the FBI discovered that the group was renting two main servers in Los Angeles. The bureau seized these servers two weeks later. This discovery has provided law enforcement officials with an opportunity to uncover other ransomware groups associated with Hive, potentially leading to more arrests in the future.

During their surveillance of Hive’s networks starting from July 2022, investigators likely gathered valuable information, including crucial details about the individuals responsible for the group’s operations. “For us, that’s just round one,” stated Crenshaw to Politico.