Is Salt Typhoon still hacking US telecoms in 2026?: Yes. An FBI official confirmed at CyberTalks 2026 in February that Salt Typhoon's compromise was 'still very, very much ongoing', with at least 200 companies in 80 countries affected as of August 2025.Source: FBI / CyberTalks 2026
What did the FBI seize from E-Note?: The FBI, Michigan State Police and German Federal Criminal Police seized E-Note Cryptocurrency exchange infrastructure and charged Russian national Mykhalio Petrovich Chudnovets with laundering over $70m in ransomware proceeds.Source: FBI / DOJ press release
How much is the FBI cyber budget being cut?: The Trump FY27 budget proposes cutting FBI cyber obligations by $560m, affecting approximately 1,900 staff across cyber and adjacent portfolios.Source: Trump FY27 budget proposal
What is the FBI's role in the Economic Fury Iran sanctions case?: The FBI's Los Angeles Field Office co-ordinated the 29 May 2026 Economic Fury action with OFAC and the Commerce Department. The operation targeted an Iranian procurement ring that used a US bank account, giving the FBI federal wire-fraud jurisdiction alongside the administrative sanctions action.Source: OFAC / DOJ / FBI
Why does using a US bank account matter in an Iran sanctions case?: A US financial footprint converts what would otherwise be a civil OFAC designation into a prosecutable federal crime. In the Economic Fury case, a Rome-based operative used a US account for domain registration, giving the FBI wire-fraud jurisdiction and making the individuals liable to criminal prosecution rather than just asset freezes.Source: OFAC / DOJ

Background

The Federal Bureau of Investigation is the United States' principal agency for domestic intelligence, counterterrorism, and federal criminal investigations. It operates field offices across every US state and in selected overseas postings, and its Cyber Division leads major ransomware takedowns, attribution actions, and joint advisories with CISA, NCSC, and allied national agencies. The FBI Internet Crime Complaint Center (IC3) issues public-facing threat alerts; its legal attaches embed with foreign partners including Europol and the UK National Crime Agency to coordinate cross-border enforcement.

An FBI official told CyberTalks 2026 in February that Salt Typhoon's compromise of telecoms infrastructure was "still very, very much ongoing," confirming at least 200 companies across 80 countries affected as of August 2025. The FBI co-issued attribution-backed advisory PSA260407 with NCSC and partnered with Michigan State Police and German Federal Criminal Police to seize Cryptocurrency exchange E-Note, charging Russian national Mykhalio Petrovich Chudnovets with laundering more than $70m in ransomware proceeds. The FBI's cyber obligations face a proposed $560m cut under the Trump FY27 budget, affecting roughly 1,900 staff across cyber and adjacent portfolios.

On 29 May 2026 the FBI's Los Angeles Field Office co-ordinated the "Economic Fury" action with OFAC and the Commerce Department, targeting an Iranian MODAFL/SAIRAN defence-electronics procurement ring that impersonated US small businesses to defraud American IT vendors into shipping spectrum analysers and non-linear junction detectors. Rome-based Saeid Zahedi used a US financial account for domain registration, converting the administrative sanctions case into a prosecutable federal wire-fraud offence. Eight individuals and five companies were designated under EO 13224; the State Department simultaneously posted a $15 million Rewards for Justice bounty on IRGC financial networks.

How the World Sees Them

US Congress

The $560m FBI cyber-budget cut lands as the agency confirms major ongoing compromises; appropriations committees face a direct conflict between fiscal targets and publicised threats.

Iran (MODAFL/IRGC)

The Economic Fury prosecution demonstrates that a US financial footprint, however minor, converts sanctions evasion into a federal criminal matter with extraterritorial reach to Rome and Dubai.

Ransomware victims

E-Note's seizure removes a major laundering rail; the FBI's prosecution of IR professionals using ALPHV signals that its enforcement extends to the defensive community as well as attackers.

Allied agencies (NCSC, Europol)

FBI co-attribution on APT28, joint seizures with European police, and the LA field office's sanctions coordination show operational breadth even as the domestic budget is squeezed.