FBI Countering Cyber Threats Through ‘Joint, Sequenced Operations,’ Director Says

Source: US FBI

The conference brings together U.S. experts in cybersecurity who present research, analysis, and best practices in the field.

In his remarks, Director Wray said the FBI works to strategically dismantle cybercriminal groups, piece by piece, by targeting the following:

  • Ransomware administrators, affiliates, and facilitators;
  • Cybercriminal group “infrastructure—like their servers and botnets;” and
  • The cryptocurrency wallets cybercriminals use to “stash their ill-gotten gains, hire associates, and lease infrastructure”

During his remarks, Wray also noted that hostile nation-states—such as China, Russia, Iran, and the Democratic People’s Republic of Korea—are increasingly using “cyber operations” to meet their strategic goals and undermine the United States. These adversaries are “growing stealthier,” he said, and are always devising fresh methods to make their cyber operations more far-reaching and impactful.

But the FBI is fighting back against the slew of cyber threats our nation faces by conducting joint operations with partners, he said. Wray spotlighted successes including:

Wray said the FBI has also engaged in “a steady stream of operations” against the Chinese military and the nation’s intelligence services.  

“As you’d expect, given that China wields a bigger hacking program than those of every major nation combined, we’re confronting them across the country and around the world, literally every day,” Wray said.

He also discussed the FBI’s Model Cyber Squad initiative, which looks to eventually equip each of the Bureau’s 56 field offices with at least one interdisciplinary team dedicating to detecting and deterring cyber threats.

Each Model Cyber Squad consists of about 12 FBI personnel, including special agents, intelligence analysts, and additional experts such as computer scientists and data analysts—”the perfect blend of investigative, technical, and analytical know-how to both identify cyber threats and take them down—Wray said.

These squads will help us focus on responding to cyber incidents, assisting victims, and outpacing malign efforts by foreign adversaries and other bad cyber actors, he added.

Finally, he encouraged the students in attendance to considering cyber careers with the FBI, since Bureau needs more technical experts to help us stay ahead of such threats. 

He emphasized the wide range of ways budding cyber minds could help support the FBI’s efforts in this arena, including by: 

  • Planning and executing the “joint, sequenced operations” of tomorrow 
  • Serving on a Cyber Action Team 
  • Working with victims
  • Otherwise assisting with cyber incident response here at home or overseas 

“For years, the Bureau has been laser-focused on hitting as many adversaries as we can and on getting the most bang for our buck out of every operation,” he said, “but with the cyber threat growing increasingly severe and complex, we’ve got both the room, and the need, to grow. So I hope some of you will apply to join us.” 

NICS Enhanced Background Checks for Under-21 Gun Buyers Showing Results

Source: US FBI

Since implementing enhanced background checks for under-21 gun buyers in October 2022, the NICS Section of the FBI’s Criminal Justice Information Services (CJIS) Division in Clarksburg, West Virginia, has conducted enhanced background checks on more than 200,000 under-21 transactions. Of those, it has denied more than 600 transactions based solely on “prohibitive” information provided during the enhanced background checks.

“Those people would have received a firearm under a traditional check,” said CJIS Division Assistant Director Michael A. Christman. He went on to say that NICS Section staff have spent the past year holding more than 500 training events and reaching more than 4,000 law enforcement agencies so they will understand why the NICS examiners may be reaching out someday soon, if they haven’t already. The outreach effort encourages agencies to respond to NICS quickly, even if it’s only to say they’re unable to assist because of local laws or privacy concerns.

“When you’re lacking those criminal history records, particularly a disposition that evidences a conviction for prohibiting offenses—typically a felony—you’re left short-handed,” Christman said.

The BSCA enhanced background checks for under-21 transactions began with a handful of states in late 2022 and opened fully in January 2023. The FBI’s NICS Section provides full-service background checks to federal firearms licensees in 31 states, five U.S. territories, and the District of Columbia. Fifteen states currently perform all their own background checks through the NICS application, and in the remaining four states, the FBI and the state each provide partial service, ensuring that, together, these states have full NICS access.

Early on, state and local law enforcement and mental health agencies were generally slower to respond to NICS examiners when enhanced background checks were sent. Some people didn’t know how to respond. And many state and local agencies restrict sharing juvenile criminal histories or juvenile mental health records. The NICS Section continues to consider and pursue all viable avenues for maximizing benefits, and mitigating impacts, to prospective transferees, state and local partners, and the NICS Section itself.

About 64%, and increasing, of the agencies contacted by NICS examiners respond. That’s up from about 30% a year ago.

Investigations and Oversight: Director Wray Discusses FBI’s Commitment to Government Accountability

Source: US FBI

The FBI pursues the cause of government accountability by investigating abuses of power by law enforcement officers and the corruption of public officials, and by holding our own workforce to a higher standard, FBI Director Christopher Wray said during the University of Georgia’s 2024 Getzen Lecture on Government Accountability on March 19. The lecture—which is held annually at the school’s Athens, Georgia, campus—invites current and former government leaders and other experts to share their thoughts on government accountability. 

“Our mission at the FBI is a broad one—to protect the American people and uphold the Constitution of the United States,” Wray said. “It covers everything from cyber to counterintelligence to counterterrorism to working with our partners to tackle violent crime. And, particularly relevant to this afternoon, it includes protecting the vulnerable and holding the powerful accountable.” 

In the United States, the rule of law comes first and applies to everyone—regardless of their socioeconomic status or position of power (or lack thereof), Wray said. This approach differentiates our nation from “authoritarian regimes, like Russia and China, where the rule of law is subordinated to their leaders’ despotic will,” he added. But to maintain the public’s trust in our justice system, he said, the FBI must demonstrate that it holds powerful people accountable when they break the law. 

“While there will always be people out there looking to exploit their positions of public trust by serving themselves rather than the American people, with an agency like the FBI on the job—and with institutions like UGA shining a light on why government accountability is so important in the first place—I like our chances,” Wray said. 

Holding Law Enforcement Accountable 

The FBI leads federal government efforts to investigate civil rights violations, including the responsibility to investigate what are known as color of law violations. 

“Those crimes occur when an individual acting under the authority of federal, state, or local laws—under what’s known as the color of law—willfully deprives someone of their constitutional rights,” he explained. “And that deprivation of rights can run the gamut, from excessive force, false arrest, or obstruction of justice to sexual assault, withholding medical care or the failure to keep an individual from harm.  

While color-of-law violations can be committed by anybody acting under their lawful authority— including probation and corrections officers, public officials, prosecutors, and judges—they too often involve law enforcement officers.” 

He then described an FBI Jackson Field Office investigation into a group of white law enforcement officers who in January 2023 “kicked in the door of a home where two Black men were staying and subjected them to an hour and a half of pure hell”—including physical and psychological abuse—even though the officers had “no probable cause to believe either had committed a crime.”  

The officers then went to extraordinary lengths to cover up their actions, including (but not limited to) destroying evidence, planting a gun on a victim, filing fraudulent reports, lying to investigators, and charging a victim with crimes he didn’t commit, Wray said. 

“All of that came out through the course of the FBI’s investigation,” Wray said, adding that the FBI also learned “three of the officers had committed color of law violations just a month earlier.” 

The investigation, which Wray said was a group effort between the FBI and “our state and federal partners” resulted in guilty pleas from all six officers, who are now awaiting sentencing. 

“I recognize that what happened in Mississippi is an extreme example,” he said. “In fact, it’s hard to imagine a more atrocious set of civil rights violations than those carried out by these guys. But, on the flip side, it’s hard to imagine more important work than investigating those crimes and seeking justice for the victims.” 

These criminals don’t represent “the vast majority of law enforcement officers,” Wray stressed. 

“I’m the leader of the country’s premier law enforcement agency, and I’ve spent most of my career working shoulder to shoulder with law enforcement officers … so I’ve seen firsthand what they’re made of and what they do to make our communities safer,” he said. These ingredients, he said, include selflessness, courage, character, dedication, and service.  

Wray added that officers are overworked and underpaid, largely operate outside the spotlight, and are rarely recognized or credited for their efforts. Yet, he said, they do their jobs knowing that each time they bid their families farewell to head to work, they might be doing so for the last time. “It takes a pretty extraordinary person to choose that life,” he said.  

Wray said the contrast between officers who wear the badge to serve and protect and those who wield their power to harm others makes color of law violations harmful to both their immediate victims and the public’s faith in the way our country holds criminals to account. 

“We’ve entrusted law enforcement officers with vast power and authority,” Wray said. “And when they abuse it—when they operate as though they’re above the law—they’re not just depriving victims of their civil rights. They’re degrading the public’s trust in our criminal justice system, one violation at a time.” 

Holding Public Officials Accountable 

Investigating public corruption is the FBI’s top criminal priority because of its dollars-and-cents cost to our nation’s’ government and taxpayers, which estimates put “at billions of dollars every year,” Wray said.

Public corruption—which can be carried out by public officials, regardless of how they get their jobs—can also infect and impact everything from border security and neighborhood protection to courtroom deliberations and even the quality of public infrastructure, he added. But at its core, public corruption denigrates the American people’s trust in their government and “undermines the strength of our democracy,” he said. 

The “secretive nature” of many public corruption violations can make them tricky to detect and prove, Wray said, but the Bureau’s long track record of investigating these types of crimes gives us an advantage. 

“On any given day, we’re working about 3,500 public corruption investigations with our federal, state, and local partners across the country—and our efforts pay off,” he said. “Over the past five years, we’ve disrupted nearly 2,000 criminal schemes and helped secure more than 3,000 convictions in this arena.”  

Those convictions include that of former Ohio House Speaker Larry Householder, who, Wray said, led “the most elaborate and extensive corruption scandal the state has ever seen.” 

Householder orchestrated a bribery scheme in which FirstEnergy—a company that owned two “failing nuclear power plants”—regularly paid off a tax-exempt organization run by Householder. In exchange, Householder’s organization worked to helped get a bill passed that provided “a billion-dollar bailout” for the troubled facilities, Wray explained.  

These corporate funds helped bankroll Householder’s bid for speaker and other state House candidates’ campaigns and pad the pockets of Householder and his team.  

“All in all, the FBI’s investigation found FirstEnergy paid upwards of $61 million in bribes to bail out their plants and to put and keep in office politicians like Householder who’d be loyal to the company over their constituents,” Wray said. 

But what the corrupt politicians and his cronies didn’t know was that the FBI had an inside source who “cooperated with our agents, recorded incriminating phone calls and conversations, and shared text messages sent by members of the conspiracy,” Wray said. As a result, he said, Householder was eventually convicted of racketeering and sentenced to 20 years in federal prison. FirstEnergy signed a deferred prosecution settlement and agreed to pay a $230 million penalty for conspiring to bribe elected officials and others. 

Holding Ourselves Accountable 

The FBI’s authority and power enable our public corruption investigations, but they also rightly force us to carry tremendous responsibility and undergo careful scrutiny, Wray said.  
“The work of the FBI is subject to a wide range of internal and external controls, all with the aim of holding our organization accountable for what we do,” he said. 

The Bureau’s internal checks and balances include the Office of Professional Responsibility, the Inspection Division’s Internal Affairs Section, and whistleblower protections for all Bureau employees, he said. Department of Justice-level accountability includes oversight from the DOJ Office of Professional Responsibility and the department’s Office of the Inspector General, he added. On top of that, our efforts are monitored by Congress and our investigative steps are subject to judicial review, he noted. 

“All of those components are in place to make sure people have avenues for reporting violations of the law, dangers to public health and safety, and gross waste, fraud, and abuse” for the FBI to address and correct, he said. The oversight makes the FBI stronger and the public safer, he said. 

“For the FBI to be the world’s leading law enforcement agency, and for the American public to continue placing their trust in us as an organization, people need to know we’re committed to doing the right thing in the right way,” he said. He stressed that this commitment to process includes maintaining consistent operational rigor, “upholding the Constitution and rule of law,” and “following the facts, wherever they lead.”  

“Process is what enables us to say, ‘You may not like the result we reached, but you cannot credibly say we didn’t do our work by the book,’ and it’s what allows people to trust us in the long run: the people we do the work for and the people we do the work with,” he said. 

Learning from the Past 

Wray also acknowledged the FBI’s missteps with respect to Dr. Martin Luther King Jr.—including an October 1963 wiretap request against the civil rights leader that failed to “present a shred of evidence.” He also reflected on the psychological toll FBI surveillance took on Dr. King. 

“I do not think any organization can aspire to have an unbiased loyalty to process and truth if it’s not willing to turn the spotlight around and look at itself,” he said. “So that’s something we work hard to do.” 

The FBI’s mission requires its personnel to simultaneously preserve Americans’ constitutional rights and safeguard their communities, Wray said. And neither requirement may be ignored in the name of the other. 

New special agents and intelligence analysts now complete a curriculum that incorporates “those difficult historical lessons and how they relate to our core values: respect, compassion, fairness, integrity, accountability, leadership, diversity, and rigorous obedience to the Constitution” to ensure they understand the importance of balancing these professional obligations, Wray said.  

“Looking back on that dark chapter in our history reminds us what can happen when we become untethered from the rule of law, and from oversight and accountability for our actions,” he added. “And I’m proud to be part of an organization that does not hide from its history, but learns from it, instead.” 

FBI Boston Recovers and Returns 22 Historic Artifacts to Okinawa, Japan

Source: US FBI

In total, the FBI recovered 22 artifacts: six painted scrolls from the 18th-19th centuries (three of which were one piece and appear to have been divided into three pieces), a hand-drawn map of Okinawa dating back to the 19th century, and various pieces of pottery and ceramics. A typewritten letter was also found with the artifacts in Massachusetts that helped confirm they were looted during the last days of World War II. 

“When taken together, they really represent a substantial piece of Okinawan history,” said Kelly.

The FBI transported the artifacts from Massachusetts to Smithsonian Institution’s National Museum of Asian Art in Washington, D.C., where the scrolls were unfurled for the first time in many years, revealing portraits of Okinawan royalty in vivid reds, golds, and blue accents. 

“It’s an exciting moment when you when you watch the scroll unfurl in front of you,” said Kelly. “You witness history, and you witness something that hasn’t been seen by many people in a very long time.”

A hand-drawn map of Okinawa dates back to the 19th century.

FBI Jacksonville Program Aims to Keep Connected Kids Safe

Source: US FBI

Hardwick and Markovsky urged parents to have those difficult conversations with kids ahead of time so they are comfortable enough to reach out if they need help. The sheriff’s office and FBI have resources for to help. “Don’t hesitate to contact us,” Markovsky said. 

During the recent outreach event, officials highlighted investigations that the FBI and partners worked in the area, and they showed how predators and violent extremists are exploiting new and emerging technologies. In sextortion cases, for example, predators are using sophisticated software to manipulate images teens freely share to then threaten and extort them.

“When parents understand both the devices and schemes in-depth, they can better explain the risks to their kids and help them take steps to safeguard personal information and secure their online profiles,” said FBI Community Outreach Coordinator Josh Chancey.

Sara Peters found the support of law enforcement to be empowering. “I know we’ll have to get her a phone at some point,” she said, “but now I feel like I know what to do, and maybe I can stay one step ahead with their help.”

ASAC Markovsky said when the time comes to get your child a phone, first have an open and honest talk about the people they could meet online and what those people might do.

“It will probably be a difficult, uncomfortable conversation,” he said. “But it’s necessary because no matter their age, the unfortunate reality is that they will likely be targeted.”

A Proven Partnership: Director Discusses FBI-Military Collaboration at West Point

Source: US FBI

On March 4, FBI Director Christopher Wray visited the U.S. Military Academy at West Point to speak with future U.S. Army officers about the Bureau’s legacy of collaboration with the Defense Department. 

“The FBI’s special agents, intelligence analysts, and professional staff are motivated by the same sense of patriotism and duty as the Corps and soldiers around the world,” Wray said in his address to the West Point Corps of Cadets. “Like you, everything we do is driven by our mission—protecting the American people and upholding the Constitution. We’ll always have a bond with those in careers of service protecting Americans, and with anyone committed to the values of duty, honor, country.” 

He also spoke to the persistence of great-power competition, threats posed by generative artificial intelligence, and counterterrorism. 

Finally, he invited the cadets in attendance to consider a career with the FBI once they leave uniform. If they do, he said, they’ll be in good company. 

“At the FBI, we’ve got almost 8,000 veterans among our 38,000 employees—including 179 who attended West Point—and it’s easy to see why so many veterans find working at the Bureau a natural fit: It’s a chance to keep serving a cause greater than themselves,” Wray said. “Among those is our Associate Deputy Director Brian Turner, who was Class of ’91. … Brian is now the number-three executive in the Bureau and our second-highest ranking special agent.” 

The speech was followed by a question-and-answer session, during which cadets posed candid questions to Director Wray.

FBI Director Christopher Wray (center) poses for a photo with cadets from the U.S. Military Academy at West Point during a visit to the school on March 4, 2024. U.S. Army photo by Christopher Hennen/USMA Public Affairs Office.

Partnering with the Military 

West Point cadets should expect to partner with the FBI during their tenures, no matter what career field they pursue once they’re commissioned into the Army, Wray said.  

Wray said that examples of the Bureau’s partnership with the military in action include: 

  • Supporting the Joint Interagency Task Force, South, which detects and monitors the illegal trafficking of human, drug, and weapons trafficking  
  • Collaborating on trials held at Naval Station Guantanamo Bay 
  • “Collaborating on emerging technology at the Army Futures Command—where our current FBI detailee is himself a West Point grad” 
  • Teaming up “on mission areas as diverse as hostage rescue, human intelligence, and special warfare” 

And, he added, the partnership works both ways, noting that military representatives serve on FBI task forces throughout the country. 

Wray also praised the FBI’s use of teamwork with the military in cyberspace. 

“Even within that mission set, we’ve worked together across government to innovate—moving from a defensive mindset to one that’s more offensive,” he said. “That means coordinating with our partners on joint, sequenced operations designed to maximize impact on our adversaries.”

He said the fruits of that collaboration have included an operation that forced the Russian Federal Security Service’s Snake malware to “effectively cannibalize” itself. “We took down Snake in over 50 countries, with the help of our U.S. and more than half a dozen foreign partners,” Wray said. 

“Another example: the year-and-a-half-long campaign we waged—with our European partners—to hack the hackers of Hive, a ransomware group targeting hospitals, schools, and emergency services, whose servers and websites we seized and shut down, and whose victims we saved from tens of millions in ransom payments by using our access to decrypt their networks,” Wray said. 

And in February, he added, the military helped the Bureau and our international law enforcement partners conduct an operation that evicted Russia’s Main Intelligence Directorate from more than 1,000 wireless internet routers and prevented it from getting that access back. As a result, Russia lost access “to a botnet it was piggybacking to run cyber operations against countries around the world,” such as the U.S. and our European allies.

Wray noted that he meets with the dual-hatted commander of U.S. Cyber Command (CYBERCOM) and director of the National Security Agency (NSA) “just about every other week.”

FBI Director Christopher Wray addresses cadets at the U.S. Military Academy at West Point during a Commandant’s Hour lecture on March 4, 2024. U.S. Army photo by Christopher Hennen/USMA Public Affairs Office.

Counterterrorism 

Wray also addressed a recent influx in foreign terrorist threats against the U.S. and our allies from Hezbollah, al Qaeda, al Qaeda in the Arabian Peninsula (an offshoot of the main organization), and ISIS stemming from the ongoing Israel-Hamas conflict following the October 7, 2023, terror attacks in the region. 

“Although we cannot and do not discount the possibility of another coordinated 9/11-style attack by a foreign terrorist organization, our most immediate concern has been that individuals or small groups will draw twisted inspiration from the events in the Middle East to carry out attacks here at home,” Wray said.  

Since October 7, 2023, Wray said, the FBI’s Counterterrorism Division has investigated “thousands of reported threats stemming from the conflict.” And while he says those reports are beginning to “level off,” the Bureau anticipates that the situation in the Gaza region “will feed a pipeline of radicalization and mobilization for years to come.” 

Great-Power Competition 

The FBI is also hard at work ensuring to shield U.S. national security from threats posed by hostile nation-states. Wray also pointed to China’s outsized hacking program and the amount of American data it’s stolen as proof that great-power competition persists. 

“The Chinese Communist Party has shown it’s willing to lie, cheat, and steal its way to achieve its ambition of becoming the world’s one and only superpower,” he said. 

China’s government poses “the greatest long-term threat to” American ideas and the security of both our country and its economy, by Wray’s estimation. 

But, he noted, China isn’t alone in its quest to challenge America’s standing on the world stage. 

The FBI’s counterintelligence workforce also spends “countless hours” fighting off Russian attempts to pilfer U.S. “government secrets and sow division through human intelligence operations, sophisticated cyber intrusions, signals collection platforms, and foreign malign influence campaigns,” he said. 

FBI Director Christopher Wray (left) speaks with U.S. Military Academy Superintendent Army Lt. Gen. Steve Gilland following his Commandant’s Hour lecture at West Point on March 4, 2024. U.S. Army photo by Christopher Hennen/USMA Public Affairs Office.

Generative AI as a Double-Edged Sword 

Wray also addressed the topic of emerging technology, noting that while it can help the Bureau and military achieve its missions, it also comes with risks.  

Wray used generative artificial intelligence to illustrate this point. While this kind of AI can help law enforcement more efficiently work with data and detect threats, it’s also helping bad actors—including terrorists and hackers.  

“There’s a lot of AI-enhanced or -enabled danger for us to battle already, and more coming down the road—all of which highlights the importance, for both the FBI and our nation’s military, of innovation: finding new ways to be more efficient, more agile, and more resilient to prepare ourselves for five, 10, 20 years down the road,” Wray said. 

Resources

San Diego Physician and Medical Practice Pay $3.8 Million to Resolve False Claims Act Allegations

Source: US FBI

SAN DIEGO – Dr. Janette J. Gray of San Diego and her former medical practice, The Center for Health & Wellbeing in San Diego, have agreed to pay $3.8 million to settle allegations that they violated the False Claims Act by knowingly submitting false claims to the Medicare and TRICARE programs.

Dr. Gray and The Center claimed to operate an “alternative,” “integrative,” and “holistic” clinic, which was staffed by medical doctors, nurse practitioners, naturopathic doctors, chiropractors, acupuncturists, and mental health professionals, along with ancillary medical and administrative staff. Dr. Gray and The Center promoted IV infusion therapy, hormone/supplement therapy, and a variety of other alternative treatments.

The settlement resolves allegations that from 2012 to 2022, Dr. Gray and her practice billed Medicare and TRICARE for services that were not covered under either program by disguising the rendering provider, misrepresenting the services provided, “unbundling” services (by billing for a procedure or service in separate parts instead of a single code), or billing for services not medically necessary. In addition to paying $3.8 million to resolve the allegations, Dr. Gray will now be excluded from participating in Medicare, Medicaid, and all other Federal health care programs for five years.

“There’s no price tag on the integrity of our healthcare system,” said U.S. Attorney Tara McGrath. “When a doctor engages in billing fraud, we will protect patients and taxpayers from deceit.”

“The civil settlement holds Dr. Gray and her former medical practice accountable for questionable actions that circumvented the TRICARE billing guidelines and allowed them to receive payments for services that should not have been reimbursed by TRICARE, costing American taxpayers millions of dollars,” said Bryan D. Denny, Special Agent in Charge of the Department of Defense Office of Inspector General, Defense Criminal Investigative Service (DCIS), Western Field Office.  “DCIS and its partners will always aggressively investigate those who defraud TRICARE, because those deceptive actions ultimately harm those defending our country and their families.”

“This investigation is proof that the FBI and its law enforcement partners remain committed to investigating and bringing to justice anyone who tries to violate the American health care system,” said FBI San Diego Acting Special Agent in Charge Houtan Moshrefi.

The resolution obtained in this matter was the result of a coordinated effort between the U.S. Attorney’s Office for the Southern District of California; the United States Department of Health and Human Services, Office of Inspector General; DCIS; and the FBI. This matter was handled by Assistant U.S. Attorney Maritsa A. Flaherty.

The resolution of this matter illustrates the government’s emphasis on combating healthcare fraud. One of the most powerful tools in this effort is the False Claims Act. Tips and complaints from all sources about potential fraud, waste, abuse, and mismanagement can be reported to the Department of Health and Human Services at 800-HHS-TIPS (800-447-8477).

The claims resolved by the settlement are allegations only, and there has been no determination of liability.

Court-Authorized Operation Disrupts Worldwide Botnet Used by People’s Republic of China State-Sponsored Hackers

Source: US FBI

Note: View the affidavit here.

The Justice Department today announced a court-authorized law enforcement operation that disrupted a botnet consisting of more than 200,000 consumer devices in the United States and worldwide. As described in court documents unsealed in the Western District of Pennsylvania, the botnet devices were infected by People’s Republic of China (PRC) state-sponsored hackers working for Integrity Technology Group, a company based in Beijing, and known to the private sector as “Flax Typhoon.”

The botnet malware infected numerous types of consumer devices, including small-office/home-office (SOHO) routers, internet protocol (IP) cameras, digital video recorders (DVRs), and network-attached storage (NAS) devices. The malware connected these thousands of infected devices into a botnet, controlled by Integrity Technology Group, which was used to conduct malicious cyber activity disguised as routine internet traffic from the infected consumer devices. The court-authorized operation took control of the hackers’ computer infrastructure and, among other steps, sent disabling commands through that infrastructure to the malware on the infected devices. During the course of the operation, there was an attempt to interfere with the FBI’s remediation efforts through a distributed denial-of-service (DDoS) attack targeting the operational infrastructure that the FBI was utilizing to effectuate the court’s orders. That attack was ultimately unsuccessful in preventing the FBI’s disruption of the botnet.

“The Justice Department is zeroing in on the Chinese government backed hacking groups that target the devices of innocent Americans and pose a serious threat to our national security,” said Attorney General Merrick B. Garland. “As we did earlier this year, the Justice Department has again destroyed a botnet used by PRC-backed hackers to infiltrate consumer devices here in the United States and around the world. We will continue to aggressively counter the threat that China’s state- sponsored hacking groups pose to the American people.”

“Our takedown of this state-sponsored botnet reflects the Department’s all-tools approach to disrupting cyber criminals. This network, managed by a PRC government contractor, hijacked hundreds of thousands of private routers, cameras, and other consumer devices to create a malicious system for the PRC to exploit,” said Deputy Attorney General Lisa Monaco. “Today should serve as a warning to cybercriminals preying on Americans – if you continue to come for us, we will come for you.”

“This dynamic operation demonstrates, once again, the Justice Department’s resolve in countering the threats posed by PRC state-sponsored hackers,” said Assistant Attorney General Matthew G. Olsen of the National Security Division. “For the second time this year, we have disrupted a botnet used by PRC proxies to conceal their efforts to hack into networks in the U.S. and around the world to steal information and hold our infrastructure at risk. Our message to these hackers is clear: if you build it, we will bust it.”

“The disruption of this worldwide botnet is part of the FBI’s commitment to using technical operations to help protect victims, expose publicly the scope of these criminal hacking campaigns, and to use the adversary’s tools against them to remove malicious infrastructure from the virtual battlefield,” said FBI Deputy Director Paul Abbate. “The FBI’s unique legal authorities allowed it to lead an international operation with partners that collectively disconnected this botnet from its China-based hackers at Integrity Technology Group.”

“The targeted hacking of hundreds of thousands of innocent victims in the United States and around the world shows the breadth and aggressiveness of PRC state-sponsored hackers,” said U.S. Attorney Eric G. Olshan for the Western District of Pennsylvania. “This court-authorized operation disrupted a sophisticated botnet designed to steal sensitive information and launch disruptive cyber attacks. We will continue to work with our partners inside and outside government, using every tool at our disposal, to defend and maintain global cybersecurity.”

“The FBI’s investigation revealed that a publicly-traded, China-based company is openly selling its customers the ability to hack into and control thousands of consumer devices worldwide. This operation sends a clear message to the PRC that the United States will not tolerate this shameless criminal conduct,” said Special Agent in Charge Stacey Moy of the FBI San Diego Field Office.

According to the court documents, the botnet was developed and controlled by Integrity Technology Group, a publicly-traded company headquartered in Beijing. The company built an online application allowing its customers to log in and control specified infected victim devices, including with a menu of malicious cyber commands using a tool called “vulnerability-arsenal.” The online application was prominently labelled “KRLab,” one of the main public brands used by Integrity Technology Group.

The FBI assesses that Integrity Technology Group, in addition to developing and controlling the botnet, is responsible for computer intrusion activities attributed to China-based hackers known by the private sector as “Flax Typhoon.” Microsoft Threat Intelligence described Flax Typhoon as nation-state actors based out of China, active since 2021, who have targeted government agencies and education, critical manufacturing, and information technology organizations in Taiwan, and elsewhere. The FBI’s investigation has corroborated Microsoft’s conclusions, finding that Flax Typhoon has successfully attacked multiple U.S. and foreign corporations, universities, government agencies, telecommunications providers, and media organizations.

A cybersecurity advisory describing Integrity Technology Group tactics, techniques and procedures was also published today by the FBI, the National Security Agency, U.S. Cyber Command’s Cyber National Mission Force, and partner agencies in Australia, Canada, New Zealand and the United Kingdom. 

The government’s malware disabling commands, which interacted with the malware’s native functionality, were extensively tested prior to the operation. As expected, the operation did not affect the legitimate functions of, or collect content information from, the infected devices. The FBI is providing notice to U.S. owners of devices that were affected by this court-authorized operation. The FBI is contacting those victims through their internet service provider, who will provide notice to their customers.

The FBI’s San Diego Field Office and Cyber Division, the U.S. Attorney’s Office for the Western District of Pennsylvania, and the National Security Cyber Section of the Justice Department’s National Security Division led the domestic disruption effort. Assistance was also provided by the Criminal Division’s Computer Crime and Intellectual Property Section. These efforts would not have been successful without the collaboration of partners, including French authorities, and Lumen Technologies’ threat intelligence group, Black Lotus Labs, which first identified and described this botnet, which it named Raptor Train, in July 2023.

If you believe you have a compromised computer or device, please visit the FBI’s Internet Crime Complaint Center (IC3) or report online to CISA. You may also contact your local FBI field office directly.

The FBI continues to investigate Integrity Technology Group’s and Flax Typhoon’s computer intrusion activities.

The Terrorist Screening Center Changes Name to the Threat Screening Center

Source: US FBI

The FBI’s Terrorist Screening Center (TSC) has been renamed the Threat Screening Center to reflect an expanded mission. For more than 20 years, the Terrorist Screening Center has been the U.S. government’s lead terrorist watchlisting entity. As national security threats continue to evolve, the TSC has expanded beyond terrorism watchlisting and screening to address other national security threats, like transnational organized crime (TOC).

With the recent designation of eight drug cartels and gangs as foreign terrorist organizations (FTOs), the TSC is well positioned to significantly increase its available identity information on transnational organized crime actors. To reflect this broader mission and increased focus on watchlisting FTO-designated TOC members, the TSC has changed its name to the Threat Screening Center.

“Border security is essential to protecting our country and providing safer communities for our citizens,” said FBI Director Kash Patel. “We’re expanding the watchlist to include cartel and gang members from newly designated foreign terrorist organizations. This change will assist our law enforcement and Intelligence Community partners as we all work together toward the goal of crushing violent crime within our borders.”

“With expanding and growing threats, we are reflecting that in our name,” added TSC Director Michael Glasheen. “Transnational organized crime watchlisting plays an important role in U.S. security interests while we continue to prevent terrorist attacks. The name change is a signal to the American people that the TSC is a powerful tool that can be used to fight all national security threats.”

Fausto Isidro Meza-Flores Agregado a La Lista de Los Diez Fugitivos Más Buscados del FBI

Source: US FBI

El FBI agregó hoy a Fausto Isidro Meza-Flores a la lista de los Diez Fugitivos Más Buscados. Es la adición número 533 a la lista.

Meza-Flores, también conocido como “Chapo Isidro”, es el presunto líder de la organización criminal transnacional Meza-Flores, con sede en Sinaloa, México. La organización es presuntamente responsable de la posesión, distribución e importación de grandes cantidades de cocaína, fentanilo, heroína, metanfetamina y marihuana a los Estados Unidos.

“Durante décadas, el público ha compartido información con el FBI que nos ha ayudado a capturar criminales peligrosos”, dijo el Agente Especial a Cargo Sean Ryan. “Hoy, les pedimos que nos ayuden a encontrar a Fausto Isidro Meza-Flores, para que podamos llevarlo ante la justicia y frenar el flujo de drogas ilegales a nuestro país”.

Meza-Flores fue acusado originalmente el 2 de mayo de 2012 en el Tribunal de Distrito de los Estados Unidos para el Distrito de Columbia. El 26 de noviembre de 2019, un gran jurado federal emitió una acusación formal sustitutiva acusando a Meza-Flores de violaciones de tráfico de drogas y posesión de un arma de fuego. Según la acusación, Meza-Flores supuestamente conspiró para fabricar y distribuir cocaína, heroína, metanfetamina y marihuana en los Estados Unidos entre 2005 y 2019.

Como presunto líder de la organización criminal transnacional Meza-Flores, Meza-Flores lidera un grupo de pistoleros fuertemente armados que utilizan la violencia para mantener el control de áreas en México utilizadas para la producción y transporte de estupefacientes destinados a los Estados Unidos.

FAUSTO ISIDRO MEZA-FLORES

Conspiracy to Manufacture and Distribute Five Hundred Grams or More of Methamphetamine, Distribute Five Kilograms or More of Cocaine, Distribute One Kilogram or More of Heroin, and Distribute One Thousand Kilograms or More of Marijuana for Importation into the United States; Use and Possession of a Firearm