Deputy Attorney General Lisa Monaco speaks during the Chiefs of Police Executive Forum, at the United States Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) headquarters in Washington, May 6, 2022. The FBI and Justice Department recently disrupted the activities of a hacking group that was sponsored by the North Korean government and that targeted U.S. hospitals with ransomware, ultimately recovering half a million dollars in ransom payments, Monaco said Tuesday, July 19. Photo: Sarah Silbiger/Pool Photo via AP

Monaco revealed new details of the attacks during a speech in which she encouraged organizations hit by ransomware to report the crime to law enforcement, both so that officials can investigate and so that they can help victim companies try to get ransom payments back.

In this case, Monaco said, a Kansas hospital that paid a ransom last year after being attacked by ransomware also contacted the FBI, which traced the payment and identified China-based money launderers who assisted the North Korean hackers in cashing out the illicit proceeds. The FBI was able to recover half a million dollars, including the entire ransom payment from the hospital.

“If you report that attack, if you report the ransom demand and payment, if you work with the FBI, we can take action,” Monaco said at the International Conference on Cyber Security, hosted by Fordham University. “We can follow the money and get it back; we can help prevent the next attack, the next victim; and we can hold cybercriminals accountable.”

U.S. officials in 2021 scrambled to confront a wave of high-profile ransomware attacks — in which hackers encrypt or lock up a victim’s data and demand exorbitant sums to return it — including against a crucial fuel pipeline on the East Coast. Though the pace of such large-scale, front-page attacks seems to have slowed, smaller targets — such as hospitals — continue to be affected.

FBI Director Christopher Wray said at the same conference that a particular challenge is that ransomware, once largely the province of garden-variety cybercriminals looking to extort cash, is now being increasingly deployed by hostile governments who are eager for destruction.

“The other thing we’re seeing more and more of is ransomware actors doing more than just locking up the system,” Wray said. “They’re exfiltrating the information, they’re threatening to release your proprietary information.”