FBI has conducted more than 30 disruption operations in 2024

Ransomware gangs take longer to re-establish themselves after disruptive operations, the bureau’s Cythia Kaiser says.

The FBI is seeing progress in the fight against ransomware gangs after conducting more than 30 disruption operations this year in which officials targeted the infrastructure used by those groups, one of the bureau’s top cybersecurity officials said Wednesday.

Cynthia Kaiser, deputy assistant director of the FBI’s cyber division, said during CyberScoop’s CyberTalks event that disruption operations against ransomware gangs have in some cases stopped gangs from further targeting the U.S.. Ransomware gangs often operate in safe harbor countries like Russia, where there is little hope for extraction to the U.S.

“The FBI emphasizes key services in our disruptions of ransomware groups, targeting the essential services that criminals rely on to conduct their attacks,” Kaiser said.

Ransomware attacks still represent a major national security concern, particularly to critical infrastructure. A recent report found that ransomware attacks are causing an increase in emergency patient care.

While the Justice Department continues to name and shame individuals who are not likely to be extradited, targeting the infrastructure of the criminal operations has become another major strategy to curb cyberattacks. 

During “Operation Cronos” in February, the FBI, the U.K.’s National Crime Agency and other international partners went after the notorious LockBit ransomware gang by seizing servers and disrupting other infrastructure. Authorities were also able to gain access to thousands of decryption keys for potential victim remediation efforts.

“The groups had to take a long time to re-establish infrastructure in order to continue operations,” Kaiser said. “Sometimes this means that we’ve seen them stop targeting the U.S. altogether.”

Kaiser also noted that the FBI and international allies have saved businesses more than $800 million in recent years through ransomware recovery efforts and additional services.

Even so, the FBI’s Internet Crime Complaint Center still sees a “high” number of ransomware attacks, she said. But business models are changing, Kaiser noted, citing ransomware variants that are more focused on data theft than file encryption attacks of old. 
Microsoft researchers reported earlier this month that they have seen fewer ransomware attacks in recent years that made it to the encryption stage.

Government

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Tina Peters, through attorney, backs off formal role in Shasta County elections

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Attackers exploit zero-days in consistently besieged SonicWall product

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• ATF confirms cyberattack hit system containing info on its investigation targets

• Unit 42 warns AI has shifted balance of power from defenders to attackers

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems