FBI
US domestic intelligence and federal law enforcement agency; leads counterterrorism, cybercrime, and sanctions-enforcement actions.
An FBI official told CyberTalks 2026 in February that Salt Typhoon's compromise of telecoms infrastructure was 'still very, very much ongoing', with at least 200 companies across 80 countries confirmed affected as the FBI's own cyber budget faces a proposed $560m FY27 cut.
Last refreshed: 3 August 2026 · Appears in 3 active topics
How does the FBI turn a sanctions case into a federal criminal prosecution?
Timeline for FBI
Contributed a separate bulletin on the same controller targeting without it being reproduced
Cybersecurity: Threats and Defences: The alert's citations predate the alertMentioned in: One firm hedged, heise online named APT28
Cybersecurity: Threats and DefencesCo-published joint advisory AA26-204A
Cybersecurity: Threats and Defences: Zimbra preview leaks mail to RussiaMentioned in: TfL hackers jailed five and a half years
Cybersecurity: Threats and DefencesMentioned in: FEMA deploys $1.47bn on World Cup
2026 FIFA World CupBackground
The Federal Bureau of Investigation is the United States' principal agency for domestic intelligence, counterterrorism, and federal criminal investigations. It operates field offices across every US state and in selected overseas postings, and its Cyber Division leads major ransomware takedowns, attribution actions, and joint advisories with CISA, NCSC, and allied national agencies. The FBI Internet Crime Complaint Center issues public-facing threat alerts; its legal attaches embed with foreign partners including Europol and the UK National Crime Agency to coordinate cross-border enforcement.
That cross-border reach showed in two separate 2026 cases: the FBI co-issued attribution-backed advisory PSA260407 with NCSC and partnered with Michigan State Police and German Federal Criminal Police to seize Cryptocurrency exchange E-Note, charging Russian national Mykhalio Petrovich Chudnovets with laundering more than $70m in ransomware proceeds. Separately, US prosecutors unsealed charges on 28 April against Peter Stokes, a 19-year-old dual US-Estonian national arrested at Helsinki airport, for alleged membership of the Scattered Spider hacking group, the second alleged member arrested outside the US within six months.
It says the breach is still live
An FBI official told CyberTalks 2026 in February that Salt Typhoon's compromise of telecoms infrastructure was 'still very, very much ongoing', confirming at least 200 companies across 80 countries affected as of August 2025. Norway's own domestic security service confirmed it was among the victims on 23 April, pushing the public country count past nine and validating the FBI's assessment that the campaign remains active rather than contained.
The Bureau's cyber division is meanwhile absorbing budget pressure of its own: the Trump administration's FY27 request proposes a $560m cut affecting roughly 1,900 staff across cyber and adjacent portfolios, a reduction that would land on the same division running Salt Typhoon's investigation and the joint advisories that track it.
It turns a sanctions case into fraud
On 29 May 2026 the FBI's Los Angeles Field Office co-ordinated the 'Economic Fury' action with OFAC and the Commerce Department, targeting an Iranian MODAFL/SAIRAN defence-electronics procurement ring that impersonated US small businesses to defraud American IT vendors into shipping spectrum analysers and non-linear junction detectors.
Rome-based Saeid Zahedi had used a US financial account for domain registration, a detail that let the FBI convert what began as an administrative sanctions case into a prosecutable federal wire-fraud offence. Eight individuals and five companies were designated under EO 13224, and the State Department simultaneously posted a $15 million Rewards for Justice bounty on IRGC financial networks, pairing the FBI's criminal case with a parallel financial-intelligence incentive.