Expect more sanctions and hacking operations on ransomware groups, top Justice official says

U.S. law enforcement and its international allies will continue to target ransomware actors with more sanctions and with more hacking operations, Deputy Attorney General Lisa Monaco said Friday.

Delivering the closing keynote at the Munich Cyber Security Conference in Germany, Monaco described the Justice Department’s collaboration with international partners as “very important” and stressed that everything from “export controls, sanctions, sanctions enforcement, evasion enforcement — all of this takes critical work with our partners.”

Read more: The feds are creating a ‘strike force’ to protect technology from foreign theft

“Every single notable cyber disruption, whether it’s ransomware networks that we’ve taken down, whether it’s the disruption of the GRU botnet, as we did with the operation CyclopsBlink last year, all of these things … the Hydra darknet marketplace that we took down with the help of our German colleagues — thank you very much — everything we are doing in this space has an international aspect,” Monaco said.

Last month the FBI and Justice Department said they had “hacked the hackers” behind the Hive ransomware group and been secretly monitoring the criminals since July 2022.

“Unbeknownst to Hive, in a 21st century cyber stakeout, our investigative team lawfully infiltrated Hive’s network and hid there for months, repeatedly swiping decryption keys and passing them on to victims to free them from ransomware,” Monaco said about the operation at the time.

More recently, alongside the United Kingdom in February, the U.S. sanctioned seven people connected to the Trickbot banking trojan and the Conti and Ryuk ransomware gangs — an action described as the first major move of a “new campaign of concerted action” between Britain and the United States.

Asked by The Record which of these kinds of operations we could expect more of going forward, Monaco said: “All of the above.”