Wray Touts FBI Takedowns of Snake, Hive, LockBit
FBI Director Wray detailed joint international operations that disrupted Snake malware, Hive and LockBit ransomware, and Genesis Market at a Kansas cybersecurity conference.
Sourcefbi.gov — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
In an April 4 speech at the FBI and University of Kansas Cybersecurity Conference, Director Christopher Wray outlined the Bureau's strategy of 'joint, sequenced operations' against cybercriminal and nation-state threats. He highlighted recent successes including the disruption of Russia's FSB-linked Snake malware, the takeover of the Hive ransomware group's infrastructure (which enabled victim decryption and avoided tens of millions in ransom payments), the 12-country takedown of the Genesis Market stolen-credential marketplace, the eviction of Russian military intelligence (GRU) from over 1,000 compromised wireless routers used for a botnet, and the February 2024 disruption of LockBit's infrastructure across a 10-country operation.
Wray also addressed the broader nation-state threat landscape, naming China, Russia, Iran, and North Korea as adversaries increasingly using cyber operations to advance strategic goals, describing China's hacking capacity as exceeding that of all other major nations combined. He discussed the FBI's Model Cyber Squad initiative to build interdisciplinary cyber teams across all 56 field offices and used the venue to recruit students into cyber careers with the Bureau.
This is a policy and strategy communication rather than a new threat disclosure; it recaps previously reported takedowns and provides no new technical indicators, exploited vulnerabilities, or active campaigns requiring defensive action.
Mentioned in this report
Source reporting: https://www.fbi.gov/news/stories/fbi-countering-cyber-threats-through-joint-sequenced-operations-director-says
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the actors, malware, and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs