{
  "id": "case-hive-ransomware-dawnbreaker",
  "slug": "us-v-hive-ransomware-operation-dawnbreaker",
  "title": "Operation Dawnbreaker (Hive Ransomware Syndicate Takedown)",
  "summary": "Coordinated multinational law enforcement action led by the FBI and DOJ that penetrated Hive ransomware network infrastructure for seven months, secretly capturing decryption keys to liberate over 1,300 victims worldwide and preventing $130 million in extortive ransom payments before seizing servers.",
  "case_number": "2:23-mj-00124",
  "court": "U.S. District Court for the Central District of California",
  "district": "C.D. Cal.",
  "country": "United States",
  "opened_at": "2023-01-26",
  "status": "convicted",
  "victim_sector": "Healthcare & Hospital Systems",
  "victim_country": "United States",
  "loss_amount_usd": 100000000,
  "loss_amount_note": "Over $100 million in illicit payments extorted from more than 1,500 victim organizations in 80 countries.",
  "first_seen_at": "2021-06-01T00:00:00Z",
  "last_updated_at": "2026-10-18T10:00:00Z",
  "actor_slug": "alphv-blackcat",
  "defendant_slugs": [],
  "cves": [],
  "techniques": [
    {
      "technique_id": "T1486",
      "evidence_excerpt": "Hive affiliates deployed multi-threaded Go and Rust ransomware binaries terminating critical system processes and encrypting databases across local and network storage volumes.",
      "evidence_locator": "CISA Alert AA22-321A (Hive Ransomware)",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "CISA and FBI Joint Cybersecurity Advisory on Hive",
      "source_url": "https://www.cisa.gov",
      "technique_name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "technique_id": "T1562.001",
      "evidence_excerpt": "Affiliates systematically terminated endpoint security services, Windows Defender, volume shadow copies, and enterprise backup processes prior to payload execution.",
      "evidence_locator": "CISA Alert AA22-321A Technical Annex",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "CISA Technical Advisory",
      "source_url": "https://www.cisa.gov",
      "technique_name": "Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "events": [
    {
      "event_type": "advisory",
      "event_date": "2021-06-01",
      "description": "Hive ransomware observed deploying aggressive double-extortion against hospital health networks."
    },
    {
      "event_type": "law_enforcement_action",
      "event_date": "2022-07-26",
      "description": "FBI establishes covert access inside Hive communication channels, beginning distribution of 1,300 free decryptors."
    },
    {
      "event_type": "takedown",
      "event_date": "2023-01-26",
      "description": "DOJ, German Bundeskriminalamt, and Dutch Police seize control infrastructure and dark web leak portals."
    }
  ],
  "attack_anatomy": {
    "ground_zero": "Initial access established against Healthcare & Hospital Systems infrastructure via compromised credentials, unmonitored perimeter services, or targeted spearphishing lures. Coordinated multinational law enforcement action led by the FBI and DOJ that penetrated Hive ransomware network infrastructure for seven months, secretly capturing decryption keys to liberate over 1,300 victims worldwide and preventing $130 million in extortive ransom payments before seizing servers.",
    "blast_radius": "Resulted in $100,000,000 in documented financial liabilities. Over $100 million in illicit payments extorted from more than 1,500 victim organizations in 80 countries.",
    "kill_chain": [
      {
        "phase": "Phase 1: Defense Evasion",
        "title": "Defense Evasion & Security Blindfolding",
        "description": "Affiliates systematically terminated endpoint security services, Windows Defender, volume shadow copies, and enterprise backup processes prior to payload execution.",
        "technical_artifacts": [
          "T1562.001",
          "Disable or Modify Tools"
        ],
        "mitre_technique_id": "T1562.001"
      },
      {
        "phase": "Phase 2: Impact",
        "title": "Operational Disruption or Extortion Detonation",
        "description": "Hive affiliates deployed multi-threaded Go and Rust ransomware binaries terminating critical system processes and encrypting databases across local and network storage volumes.",
        "technical_artifacts": [
          "T1486",
          "Data Encrypted for Impact"
        ],
        "mitre_technique_id": "T1486"
      },
      {
        "phase": "Phase 3: Expansion",
        "title": "Internal Traversal & Privilege Escalation",
        "description": "Adversaries navigated internal subnets, elevating system permissions and harvesting credentials to expand administrative access across Healthcare & Hospital Systems infrastructure.",
        "technical_artifacts": [
          "Internal administrative sessions",
          "Network telemetry"
        ],
        "mitre_technique_id": "T1021.002"
      },
      {
        "phase": "Phase 4: Impact",
        "title": "Operational Disruption & Incident Resolution",
        "description": "Coordinated multinational law enforcement action led by the FBI and DOJ that penetrated Hive ransomware network infrastructure for seven months, secretly capturing decryption keys to liberate over 1,300 victims worldwide and preventing $130 million in extortive ransom payments before seizing servers.",
        "technical_artifacts": [
          "Incident response logs",
          "Forensic timeline"
        ],
        "mitre_technique_id": "T1486"
      }
    ],
    "defensive_takeaways": [
      "Enforce phishing-resistant multifactor authentication (FIDO2) across 100% of external and administrative access portals.",
      "Implement network microsegmentation to restrict lateral movement between user workstations and core enclaves.",
      "Maintain immutable, isolated offline backups of mission-critical databases and directory services.",
      "Conduct regular tabletop simulations and verify incident response escalation procedures with legal counsel."
    ]
  }
}