How a Toronto-area police force helped take down a Russian-linked ransomware group
A Toronto-area police force is opening up about how it became involved in the international efforts to legally hack one of the most aggressive ransomware groups in the world.
The contributions by Peel Regional Police are one reason a Canadian flag is among the icons displayed on what used to be the dark website for the Russian-linked ransomware group Hive, along with the logos of the U.S. Department of Justice, the FBI, and a variety of police forces around the world.
Peel’s officers got involved early when a business in the area came to them in 2021, saying their systems were down and a text message on their desktops showed a ransom note, said Detective Const. Karim Hussain in an interview with CTV News Toronto.
“We had one of the first cases in Canada of Hive ransomware,” said Hussain. “It was the first to market. At the time we started gathering evidence, Hive was a fairly new ransomware group. Everything we brought to the table was interesting because no one had seen it before.”
Details of the case matched with other high-profile incidents, including a hospital in Louisiana where hackers accessed data on 270,000 patients, and a hospital in Ohio that was attacked and couldn’t accept new patients even as COVID-19 cases were surging.
Those were among more than 1,500 attacks worldwide that had the digital fingerprints of Hive, a group whose affiliates have netted some $150 million since 2021, police say, as they extort businesses for money in exchange for getting access to their data or their system back.
The attacks are done through a “ransomware as a service” model, meaning a small group of people design malicious software, and then share the tool with many others, rapidly scaling up their attacks before the security holes they exploit can be plugged.
“You have an overarching group that provides everything down to the infrastructure, to lesser-capable cyber criminals, and they provide them the tools to conduct the hack,” Hussain said.
The case brought Peel Police together with other forces wrestling with the impact of Hive, including the RCMP, the FBI, police in France, Germany, Norway, and Lithuania.
Earlier this year, the group struck back, taking control of Hive’s website and replacing it with a landing page bearing the logos of many investigating agencies.
“Simply put, using lawful means, we hacked the hackers,” said U.S. Deputy Attorney General Lisa Monaco in a press conference in January.
She added that the police discovered and then freely distributed decryptor keys that could help anyone who had been attacked recover their data or free their systems on their own.
FBI director Christopher Wray said those actions had stopped some $130 million in ransoms from being paid.
“This cut off the gas that is fueling Hive’s fire,” Wray said.
The investigation is still ongoing, said Hussain, as ransomware continues to surge. Statistics Canada reported that ransomware attacks amounted to 11 per cent of all cyber security incidents in 2021.
“There’s no end in sight to cybercrime right now,” Hussain said.
CTVNews.ca Top Stories
Winning $70 million Lotto Max ticket sold in Toronto
A winning Lotto Max ticket was sold in Toronto from last night's draw.
They were from different countries and barely spoke each other's languages. More than 20 years later, they're still happily in love
He decided to spend Christmas somewhere that wouldn't involve snowstorm disasters. She was spending the holidays with family, travelling for the first time outside of her native country of Venezuela. 23 years later, they're still in love.
Man who set himself on fire outside Trump trial dies of injuries, police say
A man who doused himself in an accelerant and set himself on fire outside the courthouse where former U.S. President Donald Trump is on trial has died, police said.
What's a Barnacle? It's yellow, sticks and screams if you try to pry it off your car
Barnacles, bright yellow devices used to make sure parking scofflaws pay their tickets, could soon be making their way to cities across Canada.
Verdun Airbnb listing taken down amid complaints, fines and frustration from neighbours
An Airbnb in Montreal's Verdun borough was the source of much frustration from neighbours who say there were constant parties at the location. It has been taken down from the app, but housing advocates remain upset about short-term rentals.
Young people 'tortured' if stolen vehicle operations fail, Montreal police tell MPs
One day after a Montreal police officer fired gunshots at a suspect in a stolen vehicle, senior officers were telling parliamentarians that organized crime groups are recruiting people as young as 15 in the city to steal cars so that they can be shipped overseas.
Moscow says 50 Ukrainian drones shot down as attacks spark fires at Russian power stations
Ukraine launched a barrage of drones across Russia overnight, the Defence Ministry in Moscow said Saturday, in attacks that appeared to target the country's energy infrastructure.
A Nigerian chess champion plays the royal game for 60 hours - a new global chess record
A Nigerian chess champion and child education advocate played chess nonstop for 60 hours in New York City's Times Square to break the Guinness World Record for the longest chess marathon.
Fire in Labrador town under control, officials tells residents to stay away
RCMP say the fire that prompted a state of emergency in a Labrador town is now under control.