The FBI and DOJ are announcing the seizure of internet domains associated with NightmareStresser, one of the world’s longest running Distributed Denial of Service (DDoS) for-hire services. Since 2022, the NightmareStresser Booter service was used to launch hundreds of thousands of actual or attempted DDoS attacks targeting victims worldwide. These actions were taken in conjunction with Operation PowerOFF, an ongoing effort among international law enforcement agencies aimed at dismantling criminal DDoS-for-hire infrastructure worldwide. The seizures announced today were performed by @FBIAnchorage in coordination with the Royal Canadian Mounted Police. 🔗

The @FBI, @NCSC, and @AIVD have released a joint cybersecurity advisory providing insight regarding Iran’s use of malware to target those who speak out against the Iranian regime. Click for more information and mitigations: For the FBI’s deep-dive malware analysis, click here for an updated FLASH:

The @FBI, @NSAGov and @US_CYBERCOM have issued a Joint Cybersecurity Advisory to warn organizations about cyber threat activity by the China-linked hacking group QTFY. Since 2018, QTFY has developed malicious tooling, traded malware and exploits within freelance hacking networks, created an obfuscation botnet, and targeted critical systems in the United States—to include telcos, higher education, government agencies, and the defense industrial base. We urge network defenders to review the advisory for TTPs and IOCs associated with QTFY and implement our recommended mitigations 👉

Today, the @FBI and @TheJusticeDept announced the disruption of a global botnet used by Chinese state-sponsored group known as QTFY to target U.S. critical infrastructure. Our investigation attributes QTFY to the Nanjing Xinjiuwei Network Technology Company, which sells stolen data and hacking services to Chinese military and intelligence agencies. Their services include a scanning platform that scours the internet for vulnerable smart devices—like home routers and security cameras—infects thousands of them, and feeds them into a botnet, or a network of machines secretly controlled by the adversary. These platforms hide the origin of PRC-linked cyberattacks. Thanks to the work of @FBISanDiego, FBI Cyber Division, and partners at DOJ—we shut those platforms down 🔗

The creator and administrator of the Ransom Cartel ransomware group received a 16-year federal prison sentence. From 2021 to 2023, Belarusian national Maksim Silnikau and his Ransom Cartel conspirators launched ransomware attacks on at least 18 companies around the world, including companies based in California, New York, and Nebraska. After his arrest, Silnikau was extradited from Poland to face prosecution in the United States. By leveraging its global investigative reach and international partnerships, the @FBI will continue to pursue ransomware actors and dismantle their infrastructure. 🔗

🚨 FBI PSA: Malicious Cyber Actors Targeting Water and Wastewater Sector PLCs The FBI warns that malicious cyber actors are conducting cyber attacks targeting operational technology devices. These threat actors are remotely accessing internet-facing PLCs, changing IPs and passwords, and causing operational disruption, including pressure loss and flooding. Key Protective Measures: ➡️ Disconnect PLCs from the public-facing internet ➡️ Change default passwords ➡️ Restrict network access ➡️ Set physical PLC mode switches to “Run” ➡️ Maintain manual operation capability ➡️ Review PLC project files ➡️ Plan for end-of-life replacements If you or someone you know has sustained similar OT outages, please contact your local FBI field office and file a complaint at For full details and guidance:

Operation Riptide continues to deliver results. Over the past two weeks, the FBI and our partners took coordinated action to hold cybercriminals and those who enable them accountable, while disrupting the infrastructure they rely on. ➡️ @FBILosAngeles worked with Spanish partners to secure the arrest of a member of pro-Russia hacktivist group Cyber Army of Russia Reborn. ➡️ @FBIMiamiFL obtained a sentence of 70 months in prison for a former ransomware negotiator for his role in conspiring with Blackcat/ALPHV ransomware actors to extort victims. ➡️ @FBICleveland announced a set of actions targeting Russia-based bulletproof hosting services company Media Land and its operators. ➡️ @FBIBoston, in coordination with @FBIChicago and @FBILosAngeles, charged three individuals with allegedly laundering more than $3 million in proceeds from BEC schemes using Market Shark LLC. ➡️ @FBIOmaha obtained a sentence of 36 months in prison for a former bank CEO for submitting fraudulent invoices and concealing outstanding debts in loan applications. ➡️ @FBIColumbia announced that a credit repair operator was found guilty of wire fraud for a fraudulent credit repair services scheme estimated to produce nearly $1 million in fraudulent proceeds. Cybercrime carries real-world consequences, and the FBI will continue working with partners around the world to protect victims and increase the costs of cybercrime.

The FBI is warning the public that scammers are impersonating FBI personnel facilitating Internet Crime Complaint Center (IC3) complaints to deceive and revictimize individuals. Criminals are using AI-generated videos, spoofed websites, and fraudulent claims of fund recovery to gain trust and steal personal information. If you or someone you know has fallen victim to this scam, file a complaint with the IC3 at For more on how the scam works, tips to protect yourself, and what to report, read the FBI’s #PSA#:

Florida resident Angelo Martino, formerly employed as a ransomware negotiator in the cybersecurity industry, pleaded guilty to conspiring to commit ransomware attacks and facilitate extortion efforts against US companies in 2023. 🔗