In an interview with John Riggi of the American Hospital Association, Brett Leatherman, Assistant Director of FBI's Cyber Division, discussed Operation Riptide, which brought more than 200 arrests, six extraditions, and numerous takedowns of malicious infrastructure during a 60-day push against cybercrime and cyber-enabled fraud. AD Leatherman explained how those actions advance the FBI’s cyber strategy and help protect healthcare organizations and other critical infrastructure. @FBI cyber teams have become “exceptionally good at attribution,” AD Leatherman said, identifying people behind attacks and pursuing them aggressively. Even when actors are beyond the immediate reach of US law enforcement, the FBI is finding ways to seize their funds, dismantle their tools, and disrupt operations. Each of those actions reduces harm and makes it costlier to target US victims. That work couldn’t be done without private sector partners. In the #cyber domain, the FBI needs industry as an equal partner in the fight, with trust built before a crisis. The FBI wants to use its partnership with the AHA as a model for equally effective cooperation across critical infrastructure sectors. aha.org/advancing-health-pod…

Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks. The FBI urges organizations to take the following steps now: ➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated. ➡️ Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP. ➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation. ➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims. For the latest information, follow PHP’s announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.

The @FBI and our partners are releasing detailed, actionable guidance to help network defenders protect their organizations from SafePay, one of 2026’s most active ransomware groups. SafePay actors have already targeted more than 600 victims worldwide across multiple critical infrastructure sectors. Today’s Joint Cybersecurity Advisory, developed with @CISAgov, @SecretService, and international partners, outlines steps organizations can take to reduce their risk and limit the impact of a SafePay ransomware attack. ic3.gov/CSA/2026/261020.pdf

A Nigerian man has been sentenced to eight years in prison for a series of fraud, hacking, and identity theft offenses. Beginning in 2019, Chukwuemeka Amachukwu and his co conspirators carried out a scheme targeting U.S.-based tax preparation businesses. They used spearphishing emails to break into these firms’ systems, stealing sensitive customer information. With this compromised PII, the conspirators filed fraudulent tax returns with the IRS and state tax authorities, obtaining at least $2.5 million in illicit refunds. Learn more about @NewYorkFBI's investigation: justice.gov/usao-sdny/pr/nig…

This week, the @FBI and DOJ announced coordinated actions in Ohio and Texas to counter the North Korean IT worker threat. The effort included raids on suspected “laptop farms” and resulted in charges, arrests, and the seizure of nearly 190 devices. Brett Leatherman, Assistant Director of the FBI’s Cyber Division, sat down with CrowdStrike’s Adam Meyers to examine the broader threat behind these actions. They discussed North Korea’s ongoing efforts to infiltrate American companies through remote IT workers and how the FBI and industry are working together to combat the threat. These recent actions, like many of the FBI’s most significant cyber operations, were made possible by intelligence and technical expertise from industry partners. The FBI is strengthening these partnerships to “move upstream” against cyber threat actors. That means going beyond responding to individual incidents to proactively target the command-and-control infrastructure, tools, and criminal ecosystems that enable their activity. ic3.gov/PSA/2026/PSA261013

Cyber threats cross borders, so the @FBI must maintain global reach. Our Cyber ALATs work alongside partners around the world to turn shared intelligence into coordinated action against threat actors. This week, FBI Cyber Assistant Law Enforcement Attaché (Cyber ALAT) Kathryn Sherman spoke with BNY employees at the U.S. embassy in London about the threat landscape. In banking, trust is everything. ALAT Sherman discussed how criminals exploit that trust through increasingly sophisticated manipulation of human behavior. The FBI will continue to deploy Cyber ALATs in strategic locations to assist our partners and combat the evolving cyber threat.

Today at the 10th annual Boston College Cyber Security Conference, @FBI Operations Director Joe Perez, who oversees the Criminal and Cyber Branch, discussed the evolving threat landscape and how the FBI is putting the National Cyber Strategy into action. OD Perez congratulated @FBIBoston on this year’s Operation Masquerade, a worldwide effort to disrupt a Russian military intelligence campaign that hijacked internet traffic and stole sensitive data. He also highlighted the FBI’s efforts to combat “cyber-enabled crime,” from overseas scam centers that systematically target Americans to criminal organizations stealing millions through healthcare and investment schemes. He emphasized that we are disrupting these networks, seizing illicit proceeds, dismantling call-center infrastructure, rescuing victims when possible, and working with international partners to bring perpetrators to justice.

The @FBI congratulates our partners at the North Macedonia Bureau of Public Security's Cybercrime Unit from the Ministry of Interior on the successful arrest of the OLVX criminal marketplace administrator. Active between 2023 and 2025, OLVX is alleged to have unlawfully sold victims’ personally identifiable information (“PII”) and login credentials via over 1,500 seller accounts. The existence of this marketplace directly endangered the digital security of thousands of American citizens who rely on the integrity of accounts they use. This disruption marks the first-ever cyber operation coordinated between the FBI and North Macedonia and reflects the FBI’s commitment to working with partners around the world to protect the American people in cyberspace. mvr.gov.mk/en-GB/odnosi-so-j…

Thousands of North Korean IT workers are infiltrating companies across the world, generating millions of dollars for the North Korean regime and gaining access to sensitive corporate networks. Posing as legitimate remote employees, they use stolen identities, earn salaries from unwitting companies, exploit their access to steal data, and funnel their earnings back to North Korea. The scheme relies on a network of facilitators – including Americans – who are paid to appear on camera, participate in job interviews, verify fraudulent identities, and keep employment-related devices connected to the internet at personal residences. U.S. companies should recognize the scale and persistence of the threat and review our updated @FBI PSA for mitigation guidance: ic3.gov/PSA/2026/PSA261013

🚨 Today, the @FBI and @TheJusticeDept announced a series of coordinated actions against the North Korean IT Worker threat – securing charges against 14 individuals, making two arrests, seizing nearly 190 devices, and conducting operations at more than 40 suspected “laptop farms” across Texas. These actions were taken in response to North Korea’s ongoing deployment of thousands of remote IT workers to infiltrate Western companies, earn revenue for the regime, and gain access to sensitive information. These workers are often supported by domestic enablers and laptop farms. Disrupting these schemes remains a top priority for the FBI. In 2026 alone, 8 individuals have been sentenced to prison for their roles in this activity. Coordination between the private sector and federal law enforcement was central to the latest effort. CrowdStrike’s Counter Adversary Operations team provided vital support to the FBI’s effort to identify and disrupt these laptop farms. justice.gov/opa/pr/justice-d…

Two Dominican Republic nationals were extradited to the United States to face cyberstalking and sextortion conspiracy charges. Patricia Joanna Almonte-Frías and Rineldys Feliciano Díaz-Cuevas allegedly operated an international, financially motivated “sextortion” scheme that targeted victims using social media platforms. The defendants extorted victims to send money under threat of exposing compromising images to the victims’ family and friends. @FBISanJuan investigated the case. justice.gov/usao-pr/pr/two-d…

A Virginia man who co-created and operated “Empire Market”—a dark web marketplace that enabled users to anonymously buy and sell illegal goods and services—has been sentenced to 40 years in federal prison. Raheim Hamilton co-owned and operated Empire Market from 2018 to 2020. During that time, the online market facilitated more than four million transactions between vendors and buyers valued at more than $430 million. The illegal products and services available on the site included controlled substances, compromised or stolen account credentials, stolen personally identifying information, counterfeit currency, and computer-hacking tools. @FBIChicago investigated the case. justice.gov/usao-ndil/pr/co-…

Zohar Pinhasi, owner of Florida-based MonsterCloud, was charged with fraud for allegedly promising to decrypt ransomware for potential clients without paying the hackers. According to the indictment, Pinhasi had no special decryption technology; instead, he paid the criminals for a key and then billed clients fees that were higher than the ransom. Learn more about the #FBI’s investigation: justice.gov/opa/pr/known-cyb…