FBI announces cyber strategy as Treasury 'cracks down' on China-linked criminals

The FBI has unveiled a comprehensive cyber strategy aimed at addressing domestic and international cyber threats. Assistant Director Brett Leatherman announced the report at the Billington Cyber Security Summit in Washington, emphasizing its dual purpose of providing cyber security guidance and signaling the bureau's resolve to counter adversaries in cyberspace.

The strategy outlines five key pillars: dismantling adversary tools, supporting victims, collaborating with the private sector, enhancing FBI cyber capabilities, and educating staff on safe AI usage.

While the strategy identifies China as the most significant cyber threat, the FBI's focus on state-sponsored cyber threats extends to other countries such as Russia, Iran, and North Korea. However, the US Treasury's Office of Foreign Assets Control (OFAC) has taken a specific stance against China, sanctioning Xinbi Guarantee, a Chinese-language platform that serves as a conduit for Chinese cyber criminals involved in various illicit activities.

The OFAC described Xinbi Guarantee as a central node connecting criminal syndicates with services and goods that facilitate their criminal operations.

Concerns over Iranian cyber activities persist, particularly in light of recent hacks targeting US water systems. Jason Bilnoski, deputy assistant director of the FBI's cyber operations branch, highlighted the bureau's collaborative approach with the private sector and allies to combat cybercriminals, botnets, and malware. Despite the escalation of Iranian-backed cyber attacks since the US and Israel's February strike against Iran, Bilnoski emphasized the importance of information sharing between various entities to stay ahead of evolving threats.

The recent Handala hack, which allegedly targeted FBI director Kash Patel's personal email and cloud services, serves as a stark reminder of the increasing sophistication of Iranian cyber operations. In addition to targeting government officials, Handala is suspected of breaching the systems of Stryker, a prominent medical technology company with over 50,000 employees worldwide.

Notably, Handala's attacks have shown restraint in some instances, as evidenced by their disclosure of limited data following a breach of the California Water Service.