cyberscoop.com
Written by Tim Starks
The FBI found evidence that its networks had been targeted in a suspected cybersecurity incident, the bureau confirmed on Thursday, without sharing any further details.
“The FBI identified and addressed suspicious activities on FBI networks, and we have leveraged all technical capabilities to respond,” the agency said in a statement. “We have nothing additional to provide.”
CNN and CBS reported that the suspicious activity targeted a digital system the FBI uses to manage and conduct surveillance, including work related to foreign surveillance warrants, wiretaps and pen registers, which are used to trace phone and computer data like IP addresses and dialed phone numbers.
News broke in 2024 that the Chinese hacking group Salt Typhoon had exploited the U.S. wiretapping system under the Communications Assistance for Law Enforcement Act that law enforcement and intelligence agencies rely upon, but CNN reported that it wasn’t clear if there was a connection between the 2024 and recent suspected incidents.
It also wasn’t clear when the incident occurred, or who was responsible.
The FBI, like virtually every federal agency, is no stranger to being targeted or infiltrated by hackers.
In 2023, the FBI said it had isolated and contained a cyber intrusion in its New York Field Office. In 2021, hackers exploited a misconfigured FBI server to send hoax emails, although the bureau said its own systems weren’t affected.
Congress, former agents and others have raised concerns about the FBI’s cyber capabilities among budget cuts and the loss of personnel under the second Trump administration. Brett Leatherman, leader of the bureau’s cyber division, told CyberScoop recently that it has suffered no diminishment of its ability to respond to threats and incidents.
Tim Starks
GreyNoise has identified a notable surge in scanning activity targeting MOVEit Transfer systems, beginning on May 27, 2025. Prior to this date, scanning was minimal — typically fewer than 10 IPs observed per day.
In April 2025, the Global Threat Hunting system of NSFOCUS Fuying Lab detected a significant increase in the activity of a new Botnet Trojan developed based on Go language. Given that many of its built-in DDoS attack methods are HTTP-based, Fuying Lab named it HTTPBot. The HTTPBot Botnet family first came into our monitoring scope in August 2024. Over the past few months, it has expanded aggressively, continuously leveraging infected devices to launch external attacks. Monitoring data indicates that its attack targets are primarily concentrated in the domestic gaming industry. Additionally, some technology companies and educational institutions have also been affected. The attack of this Botnet family is highly targeted, with attackers employing a periodical and multi-stage attack strategy to conduct continuous saturation attacks on selected targets.
In terms of technical implementation, the HTTPBot Botnet Trojan uses an “attack ID” to precisely initiate and terminate the attack process. It also incorporates a variety of innovative DDoS attack methods. By employing highly simulated HTTP Flood attacks and dynamic feature obfuscation techniques, it circumvents traditional rule-based detection mechanisms, including but not limited to the following detection bypass mechanisms:
GreyNoise observed a 9X spike in suspicious scanning activity targeting Ivanti Connect Secure or Ivanti Pulse Secure VPN systems. More than 230 unique IPs probed ICS/IPS endpoints. This surge may indicate coordinated reconnaissance and possible preparation for future exploitation.
GreyNoise has observed a significant surge in login scanning activity targeting Palo Alto Networks PAN-OS GlobalProtect portals. Over the last 30 days, nearly 24,000 unique IP addresses have attempted to access these portals. The pattern suggests a coordinated effort to probe network defenses and identify exposed or vulnerable systems, potentially as a precursor to targeted exploitation.
Recent patterns observed by GreyNoise suggest that this activity may signal the emergence of new vulnerabilities in the near future:
“Over the past 18 to 24 months, we’ve observed a consistent pattern of deliberate targeting of older vulnerabilities or well-worn attack and reconnaissance attempts against specific technologies,” said Bob Rudis, VP of Data Science at GreyNoise. “These patterns often coincide with new vulnerabilities emerging 2 to 4 weeks later.”
What does APT Activity Look Like on macOS?I often get asked what Advanced Persistent Activity (APT) or nation state hacking looks like on a macOS system. This is a great question and the answer is no
The activity we have observed has been attributed to a threat group that Microsoft tracks as DEV-0537, also known as LAPSUS$. DEV-0537 is known for using a pure extortion and destruction model without deploying ransomware payloads.
