VORANT. Threat Intelligence Sign in Get the full feed

FBI warns of coordinated swatting attacks targeting US institutions

routine vulnerability educationgovernment-nationalhealthcaretransportationnon-profit

The FBI reports ongoing coordinated swatting campaigns using VoIP to make hoax emergency calls against schools, government buildings, hospitals, and other public facilities to cause disruption and panic.

Swatting is a malicious tactic where threat actors make false emergency reports to law enforcement to trigger large-scale police responses at victim locations. The FBI has observed a shift from targeting private individuals to coordinated attacks against educational institutions, government buildings, religious sites, transportation centers, and hospitals across the United States. These campaigns aim to disrupt operations, cause fear and chaos, and waste emergency service resources that could otherwise respond to genuine emergencies.

The FBI identifies several technical and behavioral indicators of swatting activity: use of VoIP numbers (often appearing as blocked, unavailable, or sequences of zeros/nines) to target multiple victims, single-caller reports rather than multiple witness calls typical of real emergencies, calls originating internationally, vague or inconsistent incident details, mispronunciation of local place names suggesting unfamiliarity with targeted areas, and callers who maintain composure inconsistent with the described emergency or appear to read from a script.

Defenders should implement awareness training, review online information exposure, maintain operational security in social media sharing, and establish response procedures for law enforcement contact. Victims should preserve all incident evidence including call details, usernames, and platform information, and report to local law enforcement and the FBI.

Source reporting: https://www.ic3.gov/PSA/2026/PSA260804

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free