FBI Cyber Division

This week, the #FBI and DOJ announced coordinated actions in Ohio and Texas to counter the North Korean IT worker threat. The effort included raids on suspected “laptop farms” and resulted in charges, arrests, and the seizure of nearly 190 devices. Brett Leatherman, Assistant Director of the FBI’s Cyber Division, sat down with CrowdStrike’s Adam Meyers to examine the broader threat behind these actions. They discussed North Korea’s ongoing efforts to infiltrate American companies through remote IT workers and how the FBI and industry are working together to combat the threat. These recent actions, like many of the FBI’s most significant cyber operations, were made possible by intelligence and technical expertise from industry partners. The FBI is strengthening these partnerships to “move upstream” against cyber threat actors. That means going beyond responding to individual incidents to proactively target the command-and-control infrastructure, tools, and criminal ecosystems that enable their activity. https://lnkd.in/e9ZQZNQk

Cyber threats cross borders, so the #FBI must maintain global reach. Our Cyber ALATs work alongside partners around the world to turn shared intelligence into coordinated action against threat actors. This week, FBI Cyber Assistant Law Enforcement Attaché (Cyber ALAT) Kathryn Sherman spoke with BNY employees at the U.S. embassy in London about the threat landscape. In banking, trust is everything. ALAT Sherman discussed how criminals exploit that trust through increasingly sophisticated manipulation of human behavior. The FBI will continue to deploy Cyber ALATs in strategic locations to assist our partners and combat the evolving cyber threat.

Yesterday at the 10th annual Boston College Cyber Security Conference, FBI Operations Director Joe Perez, who oversees the Criminal and Cyber Branch, discussed the evolving threat landscape and how the FBI is putting the National Cyber Strategy into action. OD Perez congratulated FBI Boston on this year’s Operation Masquerade, a worldwide effort to disrupt a Russian military intelligence campaign that hijacked internet traffic and stole sensitive data. He also highlighted the FBI’s efforts to combat “cyber-enabled crime,” from overseas scam centers that systematically target Americans to criminal organizations stealing millions through healthcare and investment schemes. He emphasized that we are disrupting these networks, seizing illicit proceeds, dismantling call-center infrastructure, rescuing victims when possible, and working with international partners to bring perpetrators to justice.

The #FBI congratulates our partners at the North Macedonia Bureau of Public Security's Cybercrime Unit from the Ministry of Interior on the successful arrest of the OLVX criminal marketplace administrator. Active between 2023 and 2025, OLVX is alleged to have unlawfully sold victims’ personally identifiable information (“PII”) and login credentials via over 1,500 seller accounts. The existence of this marketplace directly endangered the digital security of thousands of American citizens who rely on the integrity of accounts they use. This disruption marks the first-ever cyber operation coordinated between the FBI and North Macedonia and reflects the FBI’s commitment to working with partners around the world to protect the American people in cyberspace. https://lnkd.in/eWQfzDJq

Thousands of North Korean IT workers are infiltrating companies across the world, generating millions of dollars for the North Korean regime and gaining access to sensitive corporate networks. Posing as legitimate remote employees, they use stolen identities, earn salaries from unwitting companies, exploit their access to steal data, and funnel their earnings back to North Korea. The scheme relies on a network of facilitators – including Americans – who are paid to appear on camera, participate in job interviews, verify fraudulent identities, and keep employment-related devices connected to the internet at personal residences. U.S. companies should recognize the scale and persistence of the threat and review our updated #PSA for mitigation guidance: https://lnkd.in/e9ZQZNQk

🚨 Today, the #FBI and DOJ announced a series of coordinated actions against the North Korean IT Worker threat – securing charges against 14 individuals, making two arrests, seizing nearly 190 devices, and conducting operations at more than 40 suspected “laptop farms” across Texas. These actions were taken in response to North Korea’s ongoing deployment of thousands of remote IT workers to infiltrate Western companies, earn revenue for the regime, and gain access to sensitive information. These workers are often supported by domestic enablers and laptop farms. Disrupting these schemes remains a top priority for the FBI. In 2026 alone, 8 individuals have been sentenced to prison for their roles in this activity. Coordination between the private sector and federal law enforcement was central to the latest effort. CrowdStrike’s Counter Adversary Operations team provided vital support to the FBI’s effort to identify and disrupt these laptop farms. https://lnkd.in/eaUm5XRM

Two Dominican Republic nationals were extradited to the United States to face cyberstalking and sextortion conspiracy charges. Patricia Joanna Almonte-Frías and Rineldys Feliciano Díaz-Cuevas allegedly operated an international, financially motivated “sextortion” scheme that targeted victims using social media platforms. The defendants extorted victims to send money under threat of exposing compromising images to the victims’ family and friends. #FBI San Juan investigated the case. https://lnkd.in/er74Vs7d

A Virginia man who co-created and operated “Empire Market”—a dark web marketplace that enabled users to anonymously buy and sell illegal goods and services—has been sentenced to 40 years in federal prison. Raheim Hamilton co-owned and operated Empire Market from 2018 to 2020. During that time, the online market facilitated more than four million transactions between vendors and buyers valued at more than $430 million. The illegal products and services available on the site included controlled substances, compromised or stolen account credentials, stolen personally identifying information, counterfeit currency, and computer-hacking tools. #FBI Chicago investigated the case. https://lnkd.in/en5f8_KH

Zohar Pinhasi, owner of Florida-based MonsterCloud, was charged with fraud for allegedly promising to decrypt ransomware for potential clients without paying the hackers. According to the indictment, Pinhasi had no special decryption technology; instead, he paid the criminals for a key and then billed clients fees that were higher than the ransom. Learn more about the #FBI’s investigation: https://lnkd.in/dQhFVjHt

Flax Typhoon threat actors use automated scanning tools, large-scale botnets, and hands-on exploitation techniques to steal sensitive data from organizations around the world. These actors are linked to the PRC government and associated with Integrity Technology Group, a China-based company. The #FBI, CISA, NSA, and international partners have issued a joint cybersecurity advisory on these actors to help network defenders and reduce the risk of compromise. Organizations across critical infrastructure sectors should review the TTPs, IOCs, and mitigation strategies in this report 🔗 https://lnkd.in/eTJc9GC5