FBI investigating ‘suspicious activities’ on agency network following February incident

The FBI is investigating a potential cyberattack after an agency platform supporting wiretaps was allegedly accessed during a February incident.

Multiple sources told CNN and the Associated Press on Thursday that the FBI is addressing a cybersecurity breach focused around the Digital Collection System Network, which is connected to the agency’s wiretaps, pen register surveillance tools and other intelligence collection systems used in criminal and national security investigations.

The Associated Press said the FBI has informed Congress that the incident was first discovered on February 17 after irregular network behavior was witnessed. 

“The FBI identified and addressed suspicious activities on FBI networks, and we have leveraged all technical capabilities to respond,” an FBI spokesperson told Recorded Future News. “We have nothing additional to provide.”

Politico reported on Friday that the White House, Department of Homeland Security and National Security Agency are now involved in an investigation into the incident.  

While the system that was impacted by the incident is considered unclassified, it does hold sensitive information from investigations, surveillance and more. The FBI and the Department of Homeland Security did not respond to further questions about the nature of the incident or whether it involved ransomware. 

The letter to Congress from the FBI allegedly claimed the threat actors gained entry through an internet service provider that served as a vendor to the agency. 

In 2024, it was revealed that Chinese state-backed hackers connected to the Salt Typhoon operation breached systems at ​​AT&T, Verizon and Lumen and specifically targeted the systems U.S. law enforcement agencies used for wiretaps. 

Both nation-state hackers and cybercriminals have breached federal law enforcement systems over the past two years, including a ransomware attack on the U.S. Marshals Service and a breach involving a sensitive documents system used by U.S. federal courts.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Jonathan Greig

Jonathan Greig

is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

 

Total
0
Shares
Previous Post

UNC4899 Breached Crypto Firm After Developer AirDropped Trojanized File to Work Device

Related Posts

GoBruteforcer Botnet Targets Crypto Project Databases by Exploiting Weak Credentials

A new wave of GoBruteforcer attacks has targeted databases of cryptocurrency and blockchain projects to co-opt them into a botnet that's capable of brute-forcing user passwords for services such as FTP, MySQL, PostgreSQL, and phpMyAdmin on Linux servers. "The current wave of campaigns is driven by two factors: the mass reuse of AI-generated server deployment examples that propagate common
Read More

Manual Processes Are Putting National Security at Risk

Why automating sensitive data transfers is now a mission-critical priority More than half of national security organizations still rely on manual processes to transfer sensitive data, according to The CYBER360: Defending the Digital Battlespace report. This should alarm every defense and government leader because manual handling of sensitive data is not just inefficient, it is a systemic
Read More

“Getting to Yes”: An Anti-Sales Guide for MSPs

Most MSPs and MSSPs know how to deliver effective security. The challenge is helping prospects understand why it matters in business terms. Too often, sales conversations stall because prospects are overwhelmed, skeptical, or tired of fear-based messaging. That’s why we created ”Getting to Yes”: An Anti-Sales Guide for MSPs. This guide helps service providers transform resistance into trust and
Read More