The US Department of Justice (DOJ) has reportedly seized $500,000 worth of Bitcoin from North Korean hackers. The threat actors are operators of the “Maui” ransomware, a new ransomware strain discovered in May 2021. The malware is solely used by North Korean state-sponsored attackers, unlike other ransomware strains that are used in ransomware-as-a-service operations. Maui is used in hands-on-keyboard attacks, meaning it is run manually by an operator post-breach. The healthcare sector has been the primary target for the North Korean operators deploying Maui since the malware was first discovered. The seized cryptocurrency comes from two (2) health care providers in Kansas and Colorado who paid Maui after successful ransomware attacks against their networks. The District of Kansas medical center cooperated with law enforcement and notified the FBI of a $100,000 cryptocurrency payment following an attack in May 2021. During the investigation, the FBI was able to seize the contents of two cryptocurrency accounts identified in the Kansas attack. In April 2022, the FBI traced an additional $120,000 Bitcoin payment into an already seized Bitcoin wallet which they traced to an attack against a Colorado healthcare provider. It is unknown how exactly the FBI seized the accounts used in the attacks, though there is some speculation. The North Korean threat actors used a network of China-based money launderer’s that could have transferred the Bitcoin through a cryptocurrency exchange. Exchanges are required to “know your customer” (KYC) and may be compelled by law enforcement to seize illegitimate cryptocurrency. While the DOJ has seized these assets, the Maui operators are still attacking healthcare organizations to this day. CTIX analysts recommend businesses in the healthcare sector harden their networks against ransomware attacks and report to law enforcement if they have been victimized by Maui.