The FBI is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor." The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages. How You Can Help: FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets. A list of addresses associated with this activity is available here:

Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks. The FBI urges organizations to take the following steps now: ➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated. ➡️ Immediately update affected PHP installations following the guidance on Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP. ➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation. ➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or Those reports help us identify the actors involved and warn other organizations before they become victims. For the latest information, follow PHP’s announcement on CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.

This week, the @FBI and DOJ announced coordinated actions in Ohio and Texas to counter the North Korean IT worker threat. The effort included raids on suspected “laptop farms” and resulted in charges, arrests, and the seizure of nearly 190 devices. Brett Leatherman, Assistant Director of the FBI’s Cyber Division, sat down with CrowdStrike’s Adam Meyers to examine the broader threat behind these actions. They discussed North Korea’s ongoing efforts to infiltrate American companies through remote IT workers and how the FBI and industry are working together to combat the threat. These recent actions, like many of the FBI’s most significant cyber operations, were made possible by intelligence and technical expertise from industry partners. The FBI is strengthening these partnerships to “move upstream” against cyber threat actors. That means going beyond responding to individual incidents to proactively target the command-and-control infrastructure, tools, and criminal ecosystems that enable their activity.

🚨U.S. Department of State-Rewards for Justice is offering a reward up to $10 million for information on Zhang Yu, who is accused of working on behalf of China’s Ministry of State Security to gain unauthorized access into COVID-19 research conducted by U.S.-based universities and scientists. His co-conspirator, Xu Zewei, was arrested and extradited to the U.S. earlier this year. If you have information on Zhang, his associates, or their malicious cyber activities, send a tip via the Tor-based tip line.

The FBI and DOJ are announcing the seizure of internet domains associated with NightmareStresser, one of the world’s longest running Distributed Denial of Service (DDoS) for-hire services. Since 2022, the NightmareStresser Booter service was used to launch hundreds of thousands of actual or attempted DDoS attacks targeting victims worldwide. These actions were taken in conjunction with Operation PowerOFF, an ongoing effort among international law enforcement agencies aimed at dismantling criminal DDoS-for-hire infrastructure worldwide. The seizures announced today were performed by @FBIAnchorage in coordination with the Royal Canadian Mounted Police. 🔗

The @FBI, @NCSC, and @AIVD have released a joint cybersecurity advisory providing insight regarding Iran’s use of malware to target those who speak out against the Iranian regime. Click for more information and mitigations: For the FBI’s deep-dive malware analysis, click here for an updated FLASH:

The @FBI, @NSAGov and @US_CYBERCOM have issued a Joint Cybersecurity Advisory to warn organizations about cyber threat activity by the China-linked hacking group QTFY. Since 2018, QTFY has developed malicious tooling, traded malware and exploits within freelance hacking networks, created an obfuscation botnet, and targeted critical systems in the United States—to include telcos, higher education, government agencies, and the defense industrial base. We urge network defenders to review the advisory for TTPs and IOCs associated with QTFY and implement our recommended mitigations 👉

Today, the @FBI and @TheJusticeDept announced the disruption of a global botnet used by Chinese state-sponsored group known as QTFY to target U.S. critical infrastructure. Our investigation attributes QTFY to the Nanjing Xinjiuwei Network Technology Company, which sells stolen data and hacking services to Chinese military and intelligence agencies. Their services include a scanning platform that scours the internet for vulnerable smart devices—like home routers and security cameras—infects thousands of them, and feeds them into a botnet, or a network of machines secretly controlled by the adversary. These platforms hide the origin of PRC-linked cyberattacks. Thanks to the work of @FBISanDiego, FBI Cyber Division, and partners at DOJ—we shut those platforms down 🔗

The creator and administrator of the Ransom Cartel ransomware group received a 16-year federal prison sentence. From 2021 to 2023, Belarusian national Maksim Silnikau and his Ransom Cartel conspirators launched ransomware attacks on at least 18 companies around the world, including companies based in California, New York, and Nebraska. After his arrest, Silnikau was extradited from Poland to face prosecution in the United States. By leveraging its global investigative reach and international partnerships, the @FBI will continue to pursue ransomware actors and dismantle their infrastructure. 🔗

🚨 FBI PSA: Malicious Cyber Actors Targeting Water and Wastewater Sector PLCs The FBI warns that malicious cyber actors are conducting cyber attacks targeting operational technology devices. These threat actors are remotely accessing internet-facing PLCs, changing IPs and passwords, and causing operational disruption, including pressure loss and flooding. Key Protective Measures: ➡️ Disconnect PLCs from the public-facing internet ➡️ Change default passwords ➡️ Restrict network access ➡️ Set physical PLC mode switches to “Run” ➡️ Maintain manual operation capability ➡️ Review PLC project files ➡️ Plan for end-of-life replacements If you or someone you know has sustained similar OT outages, please contact your local FBI field office and file a complaint at For full details and guidance:

Operation Riptide continues to deliver results. Over the past two weeks, the FBI and our partners took coordinated action to hold cybercriminals and those who enable them accountable, while disrupting the infrastructure they rely on. ➡️ @FBILosAngeles worked with Spanish partners to secure the arrest of a member of pro-Russia hacktivist group Cyber Army of Russia Reborn. ➡️ @FBIMiamiFL obtained a sentence of 70 months in prison for a former ransomware negotiator for his role in conspiring with Blackcat/ALPHV ransomware actors to extort victims. ➡️ @FBICleveland announced a set of actions targeting Russia-based bulletproof hosting services company Media Land and its operators. ➡️ @FBIBoston, in coordination with @FBIChicago and @FBILosAngeles, charged three individuals with allegedly laundering more than $3 million in proceeds from BEC schemes using Market Shark LLC. ➡️ @FBIOmaha obtained a sentence of 36 months in prison for a former bank CEO for submitting fraudulent invoices and concealing outstanding debts in loan applications. ➡️ @FBIColumbia announced that a credit repair operator was found guilty of wire fraud for a fraudulent credit repair services scheme estimated to produce nearly $1 million in fraudulent proceeds. Cybercrime carries real-world consequences, and the FBI will continue working with partners around the world to protect victims and increase the costs of cybercrime.

The FBI is warning the public that scammers are impersonating FBI personnel facilitating Internet Crime Complaint Center (IC3) complaints to deceive and revictimize individuals. Criminals are using AI-generated videos, spoofed websites, and fraudulent claims of fund recovery to gain trust and steal personal information. If you or someone you know has fallen victim to this scam, file a complaint with the IC3 at For more on how the scam works, tips to protect yourself, and what to report, read the FBI’s #PSA#:

Florida resident Angelo Martino, formerly employed as a ransomware negotiator in the cybersecurity industry, pleaded guilty to conspiring to commit ransomware attacks and facilitate extortion efforts against US companies in 2023. 🔗