FBI Cyber Branch

The FBI Cyber Branch Office of the Chief Information Officer (OCIO) leads the Bureau’s adoption of advanced super intelligence (SI) capabilities, driving mission-focused innovation that helps our investigators work smarter and faster. With more than 140 approved SI use cases already in operation, OCIO’s efforts position the FBI to confront emerging threats with greater precision, agility, and technological readiness.

The FBI is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor." The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ether (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages. How You Can Help: FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets. A list of addresses associated with this activity is available here: https://lnkd.in/e4_deZKN

Two members of a Ghanaian criminal organization pleaded guilty to charges stemming from their roles in an international romance scam conspiracy. Isaac Oduro Boateng and Inusah Ahmed both served as “chairmen” within the organization, which targeted older adults by deceiving them into believing they were in genuine online romantic relationships and convincing them to send money. The organization also carried out business email compromise (BEC) schemes. In total, the conspirators stole and laundered more than $100 million from dozens of victims. #FBI New York investigated the case with government partners. https://lnkd.in/eCQHKv35

A Syrian man was sentenced to 42 months in federal prison for a wide-ranging hacking conspiracy conducted on behalf of the Bashar Al Assad regime. Ahmad Umar Agha hacked nearly 50 Western media entities, businesses, NGOs, and American and allied government entities to spread the former Syrian government’s propaganda. In one instance, Agha’s actions caused a flash crash in the U.S. stock market, resulting in a temporary $136 billion loss in the value of stocks making up the Dow Jones Industrial Average. Agha spent more than a decade as a fugitive and now serves as a reminder that the #FBI never forgets those who target Americans. The FBI's Washington Field Office investigated the case, in coordination with the FBI’s Cyber Division. https://lnkd.in/e6NrNKZv

Cybercriminals are constantly adapting, even as law enforcement disrupts their operations. With Super Intelligence poised to transform the cyber threat landscape, how can defenders stay ahead? In the latest episode of Ahead of the Threat, Brett Leatherman, Operations Director of the #FBI’s Cyber Branch, sits down with John Fokker of Trellix to discuss ransomware, the growing role of SI in cyberattacks, and what organizations can do to protect themselves. They also explain why sharing threat intelligence is only the first step. The goal is to turn that intelligence into operational action. Watch the episode now, or listen wherever you get your podcasts: https://lnkd.in/evKsGWiV

The #FBI and the U.S. Department of Justice have announced the disruption of Virtualine, a so-called “bulletproof hosting” service designed to help cybercriminals evade detection and law enforcement action. Before the FBI and its partners shut it down, the Virtualine[.]net domain was used to facilitate the distribution of child sexual abuse material (CSAM), international money laundering, and numerous other cybercrimes. The case was investigated by the FBI's Washington Field Office, with significant assistance from Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland, the UK’s National Crime Agency, and private sector partners OverRIPE and Lumen. The Justice Department’s Office of International Affairs provided additional support. https://lnkd.in/ds_gRGF9

Earlier today, Artem Aleksandrovych Stryzhak, 35, of Barcelona, Spain, was sentenced to nearly six years in prison. Stryzhak conspired with others to deploy the Nefilim ransomware against victim computer networks in the United States and other countries, causing significant damage to victim computer systems. The #FBI is seeking further information on co-conspirator Volodymyr Viktorovych Tymoshchuk. Currently, there is an award of up to $10,000,000 for information leading to the arrest and/or conviction of Volodymyr Viktorovych Tymoshchuk, and up to $1,000,000 for information leading to the arrest and/or conviction of other key leaders of the Nefilim, LockerGoga, and MegaCortex ransomware variants. If you have any information concerning this person, please contact the FBI via WhatsApp or Signal (neither government-operated nor government-controlled platforms) at (917) 242-1407. You may also email TymoTips@fbi.gov, or contact your local FBI office or the nearest American Embassy or Consulate. https://lnkd.in/eqY2W29j

In an interview with John Riggi of the American Hospital Association, Brett Leatherman, Assistant Director of FBI’s Cyber Division, discussed Operation Riptide, which brought more than 200 arrests, six extraditions, and numerous takedowns of malicious infrastructure during a 60-day push against cybercrime and cyber-enabled fraud. AD Leatherman explained how those actions advance the FBI’s cyber strategy and help protect healthcare organizations and other critical infrastructure. #FBI cyber teams have become “exceptionally good at attribution,” AD Leatherman said, identifying people behind attacks and pursuing them aggressively. Even when actors are beyond the immediate reach of US law enforcement, the FBI is finding ways to seize their funds, dismantle their tools, and disrupt operations. Each of those actions reduces harm and makes it costlier to target US victims. That work couldn’t be done without private sector partners. In the #cyber domain, the FBI needs industry as an equal partner in the fight, with trust built before a crisis. The FBI wants to use its partnership with the AHA as a model for equally effective cooperation across critical infrastructure sectors. https://lnkd.in/e43CSpy3

Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks. The FBI urges organizations to take the following steps now: ➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated. ➡️ Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP. ➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation. ➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or www.ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims. For the latest information, follow PHP’s announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.

The #FBI and our partners are releasing detailed, actionable guidance to help network defenders protect their organizations from SafePay, one of 2026’s most active ransomware groups. SafePay actors have already targeted more than 600 victims worldwide across multiple critical infrastructure sectors. Today’s Joint Cybersecurity Advisory, developed with CISA, the U.S. Secret Service, and international partners, outlines steps organizations can take to reduce their risk and limit the impact of a SafePay #ransomware attack. https://lnkd.in/euWfzR_y