FBI Cyber Division

The #FBI and its partners have released a joint #CybersecurityAdvisory to highlight cyber espionage and ransomware activity associated with the North Korean Reconnaissance General Bureau (RGB). This group targets defense, aerospace, nuclear, and engineering entities to obtain sensitive technical information and intellectual property to advance the DPRK regime’s military and nuclear programs. The authoring agencies assess this group poses an ongoing threat to various industry sectors worldwide, including those in the United States, South Korea, Japan, and India, and funds its espionage activity through ransomware operations against U.S. healthcare entities. Click to learn about TTPs and mitigation measures: https://lnkd.in/g6yp7gzz

A North Korean government hacker has been indicted on charges for his involvement in a conspiracy to extort US hospitals and use the proceeds to fund cyber espionage activities against defense and technology organizations. Learn more about the indictment here: https://lnkd.in/gG7QWAyH

Meet the #FBI Cyber Action Team (CAT)! Major cyberattacks require a rapid response. Fortunately, CAT can deploy around the globe in hours, providing expert support onsite to federal government structures, the private sector, or sometimes even foreign partners. Learn more: https://lnkd.in/gjDHD-cd

#FBI Cyber Assistant Director Bryan Vorndran and others from FBI Cyber Division have been nominated for #CyberScoop50 Awards for their contributions to advancing cybersecurity efforts. Be sure to follow us on LinkedIn to stay up to date with the latest cybersecurity updates you need to know.

When you contact the #FBI in response to a cyber incident, we will treat your organization with dignity and respect, and we will protect your privacy and data, with rigorous adherence to the U.S. Constitution, applicable laws, regulations, and policies, as well as the FBI’s core values. If you’ve been a victim of a #cyber incident, contact your local FBI field office or report the compromise to IC3: https://www.ic3.gov/

Today, the #FBI joins the UK’s National Crime Agency and the West Midlands Police to announce the arrest of an individual connected to a global cybercrime group which has victimized major companies, including MGM Resorts. Read more about the arrest here: https://lnkd.in/eFM52TvK

#ICYMI, the #FBI and our global partners joined together and performed searches, arrests, and the disruption of more than 100 servers, debilitating the criminal infrastructure of multiple malware groups. These malware groups have infected millions of computers and claimed countless victims around the world and throughout the United States, including a hospital network, which not only cost millions of dollars but alarmingly put people’s lives at risk due to the compromised critical care online system. For more information on the major worldwide disruption known as Operation Endgame, visit: https://lnkd.in/e3C3V9u5

#ICYM, the FBI Cyber Division. Cybersecurity and Infrastructure Security Agency, National Security Agency, and partners released an APT40 joint advisory, which highlights PRC state-sponsored tradecraft and network exploitation techniques. Click to read case studies of APT40’s intrusions into victim networks: https://lnkd.in/e2_8g6qs

Operating system (OS) command injection vulnerabilities continue to appear in software products and present significant risks, despite being well-documented and preventable. Malign actors exploit software structures that do not validate and sanitize user input during command construction to execute malign commands on the OS itself.   The FBI Cyber Division and Cybersecurity and Infrastructure Security Agency urge technical leaders to take action to protect product security and make certain that software maintains intended command and argument syntax when taking user input. To read the Secure by Design Alert and learn more about what steps to take, visit: https://lnkd.in/dJ9WaX9a

Affiliates of Russian state-sponsored media organization RT used covert AI-enhanced software to create fictitious online personas to post content on X (formerly Twitter) and disseminate disinformation. Although the tool was only identified on X, our analysis indicates its developers intended to expand its functionality to other social media platforms. Read the joint Cybersecurity Advisory from the #FBI and its partners to learn more about this malign foreign influence activity: https://lnkd.in/eRuc8_KX