FBI Cyber Branch

Official FBI Cyber Branch X. Submit tips at Public info may be used for authorized purposes:

[FBI Cyber Branch @FBICyberBranch]

A Syrian man was sentenced to 42 months in federal prison for a wide-ranging hacking conspiracy conducted on behalf of the Bashar Al Assad regime.

Ahmad Umar Agha hacked nearly 50 Western media entities, businesses, NGOs, and American and allied government entities to spread the former Syrian government’s propaganda. In one instance, Agha’s actions caused a flash crash in the U.S. stock market, resulting in a temporary $136 billion loss in the value of stocks making up the Dow Jones Industrial Average.

Agha spent more than a decade as a fugitive and now serves as a reminder that the #FBI never forgets those who target Americans.

@FBIWFO investigated the case, in coordination with the FBI’s Cyber Division. https://t.co/r1MKibrihZ

[FBI San Juan @FBISanJuan]

On October 28, the FBI San Juan #Cyber Program joined the Cybersecurity and the New Business Landscape event. During the presentation and panel discussion, the #FBI highlighted the importance of protecting businesses from cyber threats. Through education, prevention, and collaboration, we continue working to raise awareness and help businesses stay safe in an evolving digital world.

#Partnership #CyberSecurity #PuertoRico

[FBI Omaha @FBIOmaha]

During Cybersecurity Awareness Month, FBI Omaha teamed up with community partners to strengthen cyber resilience. ASAC Woltz met with IT professionals from a local medical facility yesterday to discuss common intrusions like business email compromise and share resources for reporting cyber incidents.

[FBI Washington Field @FBIWFO]

“Bulletproof” Website Domain Seized in International Law Enforcement Operation: With the assistance of our partners in Germany, the Netherlands, and the United Kingdom, #FBIWFO seized Virtualine's website, which facilitated criminal activity, including the advertisement of child sexual abuse material, the disclosure of nonconsensual intimate images, and international money laundering. https://t.co/xN2Y1vpG5B

@EDVAnews @LKA_Hessen @NCA_UK @Politie

[FBI Cyber Branch @FBICyberBranch]

Cybercriminals are constantly adapting, even as law enforcement disrupts their operations. With Super Intelligence poised to transform the cyber threat landscape, how can defenders stay ahead?

In the latest episode of Ahead of the Threat, Brett Leatherman, Operations Director of the @FBI’s Cyber Branch, sits down with John Fokker of Trellix to discuss ransomware, the growing role of SI in cyberattacks, and what organizations can do to protect themselves. They also explain why sharing threat intelligence is only the first step. The goal is to turn that intelligence into operational action.

Watch the episode now, or listen wherever you get your podcasts: https://t.co/xsTYJfz4ew

[FBI @FBI]

This FBI is transforming how we protect the American people using Superintelligence: a dedicated working group, our first‑ever Chief SI Officer, and an agency‑wide SI Review Board to ensure we deploy this technology responsibly and aggressively.

We expanded our use of SI by 605%, supercharging threat detection, triage, analysis, and processing, all while reducing spending by $300 million and identifying more than $1.2 billion in contract ceiling savings—resources we can redirect toward our core national security and public safety mission.

By integrating this technology into the work of this FBI, we can spot dangers faster, disrupt them earlier, and make communities safer.

[FBI San Juan @FBISanJuan]

On October 27, an FBI San Juan Cyber Program Special Agent briefed 140 high school students on emerging cyber threats and shared practical online safety guidance, including social media best practices, the importance of strong passwords, and how to check whether personal data has been compromised.

Students also received information on threats such as sextortion and ransomware, as well as steps to take if they become victims of a cybercrime.

FBI San Juan remains committed to empowering our communities, especially those most vulnerable to exploitation, with the knowledge and tools to stay safe online.

If you believe you may be a victim of a cybercrime, submit a report at https://t.co/dlZDS1sf8u or contact the San Juan Field Office at 787-987-6500.

#Cyber #Cybersecurity #PublicSafety

[FBI Cyber Branch @FBICyberBranch]

The @FBI and @TheJusticeDept have announced the disruption of Virtualine, a so-called “bulletproof hosting” service designed to help cybercriminals evade detection and law enforcement action.

Before the FBI and its partners shut it down, the Virtualine[.]net domain was used to facilitate the distribution of child sexual abuse material (CSAM), international money laundering, and numerous other cybercrimes.

The case was investigated by @FBIWFO, with significant assistance from Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland, the UK’s National Crime Agency, and private sector partners OverRIPE and Lumen. The Justice Department’s Office of International Affairs provided additional support.

https://t.co/AqE9SfAW0O

[FBI Cyber Branch @FBICyberBranch]

Earlier today, Artem Aleksandrovych Stryzhak, 35, of Barcelona, Spain, was sentenced to nearly six years in prison. Stryzhak conspired with others to deploy the Nefilim ransomware against victim computer networks in the United States and other countries, causing significant damage to victim computer systems.

The @FBI is seeking further information on co-conspirator Volodymyr Viktorovych Tymoshchuk. Currently, there is an award of up to $10,000,000 for information leading to the arrest and/or conviction of Volodymyr Viktorovych Tymoshchuk, and up to $1,000,000 for information leading to the arrest and/or conviction of other key leaders of the Nefilim, LockerGoga, and MegaCortex ransomware variants.

If you have any information concerning this person, please contact the FBI via WhatsApp or Signal (neither government-operated nor government-controlled platforms) at [phone]. You may also email [email protected], or contact your local FBI office or the nearest American embassy or consulate.

https://t.co/mNZbFnhJy4

[FBI Louisville @FBILouisville]

Last week, #FBI Louisville participated in the 2026 Cyber Bluegrass Blue Team Summit, Kentucky's premier cybersecurity training and exercise event. It brings together government, military, and private sector professionals to strengthen our collective cyber resilience.

[FBI @FBI]

The FBI continues to warn about two critical security flaws in PHP, a programming language used to build many websites and online services. Attackers could exploit these vulnerabilities to break into systems, putting sensitive information and business operations at risk. Security updates are available and should be applied immediately.

If you are a business owner or website operator, check whether your systems are affected. Contact your IT support team, website developer, or hosting provider for help identifying vulnerable systems and applying the necessary updates.

The FBI urges organizations to take the following steps now:

➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.

➡️ Immediately update affected PHP installations following the guidance on https://t.co/JFOW6jG9Ws. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.

➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.

➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or https://t.co/ZWC7Se2YdU. Those reports help us identify the actors involved and warn other organizations before they become victims.

For the latest information on these vulnerabilities (CVE-2026-109618 and CVE-2026-109619), follow PHP’s announcements on https://t.co/JFOW6jG9Ws, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.

[FBI Cyber Branch @FBICyberBranch]

In an interview with John Riggi of the American Hospital Association, Brett Leatherman, Assistant Director of FBI's Cyber Division, discussed Operation Riptide, which brought more than 200 arrests, six extraditions, and numerous takedowns of malicious infrastructure during a 60-day push against cybercrime and cyber-enabled fraud. AD Leatherman explained how those actions advance the FBI’s cyber strategy and help protect healthcare organizations and other critical infrastructure.

@FBI cyber teams have become “exceptionally good at attribution,” AD Leatherman said, identifying people behind attacks and pursuing them aggressively. Even when actors are beyond the immediate reach of US law enforcement, the FBI is finding ways to seize their funds, dismantle their tools, and disrupt operations. Each of those actions reduces harm and makes it costlier to target US victims.

That work couldn’t be done without private sector partners. In the #cyber domain, the FBI needs industry as an equal partner in the fight, with trust built before a crisis. The FBI wants to use its partnership with the AHA as a model for equally effective cooperation across critical infrastructure sectors.

https://t.co/X5dnmzwhCD

[FBI Cyber Branch @FBICyberBranch]

Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.

The FBI urges organizations to take the following steps now:

➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.

➡️ Immediately update affected PHP installations following the guidance on https://t.co/rDrPSxB3zX. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.

➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.

➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or https://t.co/iqgVZIbCru. Those reports help us identify the actors involved and warn other organizations before they become victims.

For the latest information, follow PHP’s announcement on https://t.co/rDrPSxB3zX, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.

[FBI Cyber Branch @FBICyberBranch]

The @FBI and our partners are releasing detailed, actionable guidance to help network defenders protect their organizations from SafePay, one of 2026’s most active ransomware groups.

SafePay actors have already targeted more than 600 victims worldwide across multiple critical infrastructure sectors. Today’s Joint Cybersecurity Advisory, developed with @CISAgov, @SecretService, and international partners, outlines steps organizations can take to reduce their risk and limit the impact of a SafePay ransomware attack.

https://t.co/wGWO3F4hNp

[FBI Cyber Branch @FBICyberBranch]

A Nigerian man has been sentenced to eight years in prison for a series of fraud, hacking, and identity theft offenses.

Beginning in 2019, Chukwuemeka Amachukwu and his co conspirators carried out a scheme targeting U.S.-based tax preparation businesses. They used spearphishing emails to break into these firms’ systems, stealing sensitive customer information. With this compromised PII, the conspirators filed fraudulent tax returns with the IRS and state tax authorities, obtaining at least $2.5 million in illicit refunds.

Learn more about @NewYorkFBI's investigation: https://t.co/o3ixYOcMdb

[FBI Director Kash Patel @FBIDirectorKash]

North Korea thought American companies were its personal ATM — to bankroll its nuclear weapons program. NOT ON OUR WATCH.

Operation Lonestar Roundup: 14 charged. 2 arrested. 187 devices seized. 40+ suspected Texas laptop farms. 70+ U.S. companies affected. ~$3M allegedly funneled to the DPRK.

-DKP🇺🇸

[FBI Jacksonville @FBIJacksonville]

Strengthening International Cybercrime Partnerships!

Last week in Skopje, #FBI Jacksonville joined U.S. and North Macedonia partners for a specialized cybercrime investigative workshop. Coordinated by the U.S. Department of Justice’s International Criminal Investigative Training Assistance Program (ICITAP), the workshop brought together approximately 30 investigators, including representatives from North Macedonia’s Ministry of Interior, Bureau for Public Security, Sector for Cybercrime and Digital Forensics.

The workshop opened with remarks from the Director of the Bureau of Public Security for the Ministry of Interior in North Macedonia and provided an opportunity to exchange investigative expertise and share best practices.

The engagement reflects continued collaboration among ICITAP, the U.S. Department of State’s Bureau of International Narcotics and Law Enforcement Affairs (INL), the U.S. Embassy in Skopje, the FBI Law Enforcement Attaché Office in Sofia and North Macedonia law enforcement partners on cybercrime investigations and emerging digital threats.

#FBI #FBIJacksonville #Cybercrime #NorthMacedonia

[FBI Albany @FBIAlbany]

#ICYMI: We sat down with Spectrum News to talk about how cyber criminals are utilizing SI to exploit our systems and what you can do to keep yourself safe.

Watch here, and don't forget to report any online crime to the Internet Crime Complaint Center (IC3): https://t.co/wljdpwinhp

[FBI Cyber Branch @FBICyberBranch]

This week, the @FBI and DOJ announced coordinated actions in Ohio and Texas to counter the North Korean IT worker threat. The effort included raids on suspected “laptop farms” and resulted in charges, arrests, and the seizure of nearly 190 devices.

Brett Leatherman, Assistant Director of the FBI’s Cyber Division, sat down with CrowdStrike’s Adam Meyers to examine the broader threat behind these actions. They discussed North Korea’s ongoing efforts to infiltrate American companies through remote IT workers and how the FBI and industry are working together to combat the threat.

These recent actions, like many of the FBI’s most significant cyber operations, were made possible by intelligence and technical expertise from industry partners. The FBI is strengthening these partnerships to “move upstream” against cyber threat actors. That means going beyond responding to individual incidents to proactively target the command-and-control infrastructure, tools, and criminal ecosystems that enable their activity.

https://t.co/CcExE8kpeD

[FBI Cyber Branch @FBICyberBranch]

Cyber threats cross borders, so the @FBI must maintain global reach. Our Cyber ALATs work alongside partners around the world to turn shared intelligence into coordinated action against threat actors.

This week, FBI Cyber Assistant Law Enforcement Attaché (Cyber ALAT) Kathryn Sherman spoke with BNY employees at the U.S. embassy in London about the threat landscape. In banking, trust is everything. ALAT Sherman discussed how criminals exploit that trust through increasingly sophisticated manipulation of human behavior.

The FBI will continue to deploy Cyber ALATs in strategic locations to assist our partners and combat the evolving cyber threat.