# Wray Touts FBI Takedowns of Snake, Hive, LockBit

Published: 2024-04-04 · Severity: low
Canonical: https://vorant.io/reports/2a535c3b-54aa-5721-b9ec-79d310d09762/wray-touts-fbi-takedowns-of-snake-hive-lockbit

> FBI Director Wray detailed joint international operations that disrupted Snake malware, Hive and LockBit ransomware, and Genesis Market at a Kansas cybersecurity conference.

In an April 4 speech at the FBI and University of Kansas Cybersecurity Conference, Director Christopher Wray outlined the Bureau's strategy of 'joint, sequenced operations' against cybercriminal and nation-state threats. He highlighted recent successes including the disruption of Russia's FSB-linked Snake malware, the takeover of the Hive ransomware group's infrastructure (which enabled victim decryption and avoided tens of millions in ransom payments), the 12-country takedown of the Genesis Market stolen-credential marketplace, the eviction of Russian military intelligence (GRU) from over 1,000 compromised wireless routers used for a botnet, and the February 2024 disruption of LockBit's infrastructure across a 10-country operation.

Wray also addressed the broader nation-state threat landscape, naming China, Russia, Iran, and North Korea as adversaries increasingly using cyber operations to advance strategic goals, describing China's hacking capacity as exceeding that of all other major nations combined. He discussed the FBI's Model Cyber Squad initiative to build interdisciplinary cyber teams across all 56 field offices and used the venue to recruit students into cyber careers with the Bureau.

This is a policy and strategy communication rather than a new threat disclosure; it recaps previously reported takedowns and provides no new technical indicators, exploited vulnerabilities, or active campaigns requiring defensive action.

## Mentioned in this report

- Threat actors: APT28, Hive, LockBit, Turla
- Malware: Hive, LockBit, Snake
- Campaigns: Genesis Market takedown

Source reporting: https://www.fbi.gov/news/stories/fbi-countering-cyber-threats-through-joint-sequenced-operations-director-says

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/2a535c3b-54aa-5721-b9ec-79d310d09762/wray-touts-fbi-takedowns-of-snake-hive-lockbit.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup