The US Department of Justice has announced that it seized approximately $500,000 in Bitcoin that was paid to the operators of the Maui ransomware group by several American health care providers.
Earlier this month, the FBI, the US Cybersecurity and Infrastructure Security Agency (CISA), and the Department of the Treasury published a joint advisory, highlighting the Maui ransomware group as a North Korean-backed ransomware operation specifically targeting western healthcare and public health organisations.
According to the US Department of Justice, the new strain of ransomware was discovered when a security incident was reported by a Kansas hospital to the FBI. “Thanks to rapid reporting and cooperation from a victim, the FBI, and Justice Department prosecutors have disrupted the activities of a North Korean state-sponsored group deploying ransomware known as ‘Maui’.
“Not only did this allow us to recover their ransom payment as well as a ransom paid by previously unknown victims, but we were also able to identify a previously unidentified ransomware strain,” said Deputy Attorney General Lisa O. Monaco.
According to court documents, North Korean hackers used a ransomware strain called Maui in May 2021 to encrypt the files and servers of a hospital in Kansas. After more than a week of being unable to access encrypted servers, the hospital agreed to pay approximately $100,000 in Bitcoin to the Maui ransomware gang to restore its IT network.
While investigating the incident, the FBI tracked down another payment of $120,000 in Bitcoin from another healthcare provider in Colorado. Several other undisclosed payments, totalling $280,000, were also seized by law enforcement agencies in May 2022.
In all, the agencies were able to recover a total of roughly half a million US dollars that the ransomware actors extracted from their victims.
Bryan Vorndran, an Assistant Director at the FBI’s Cyber Division, said, “The FBI is dedicated to working with our federal and private sector partners to disrupt nation-state actors who pose a critical cyber threat to the American people.
“Today’s success demonstrates the result of reporting to the FBI and our partners as early as possible when you are a victim of a cyber attack. This provides law enforcement with the ability to best assist the victim.
“We will continue to pursue these malicious cyber actors, such as these North Korean hackers, who threaten the American public regardless of where they may be and work to successfully retrieve ransom payments where possible,” he added.
