Operation Riptide: Inside the FBI's Cybercrime Crackdown

00:00:00:00 - 00:00:20:15
Tom Haederle
Welcome to Advancing Hell. Law enforcement's ongoing battle against healthcare cybercrime requires a strategic mix of offense and defense. As we hear in today's podcast, this approach has scored some important victories lately and reminded bad cyber actors there is no such thing as a safe harbor.

00:00:20:17 - 00:00:50:13
John Riggi
Welcome to Advancing Health. I'm John Riggi, your national advisor for cybersecurity and risk at the American Hospital Association. There have been thousands of ransomware and data theft attacks targeting U.S. healthcare over the last several years, compromising millions of U.S. citizens personal health care data and unfortunately, disrupting life saving care delivery during these high impact ransomware attacks, which delay and disrupt health care delivery.

00:00:50:16 - 00:01:24:19
John Riggi
Folks, when that happens, let's be clear: these are not data theft crimes. They are threat to life crimes. The FBI recently released its new cyber strategy based on four key pillars focused on disrupting adversaries, supporting victims, strengthening partnerships, including with the private sector, and building the capabilities this mission demands. This strategy builds upon key FBI initiatives such as operation Winter Shield and Operation Riptide, as well as partnerships with the private sector, including healthcare.

00:01:24:22 - 00:01:54:12
John Riggi
Joining me again today is my good friend and colleague Brett Leatherman, assistant director of the FBI Cyber Division, to talk about new FBI cyber strategy, how it helps supporting healthcare in key takeaways every healthcare leader needs to know to protect their organization. He's got well over 20 years of experience leading these really high impact, innovative strategies to help reduce cyber risk that we all face as a nation.

00:01:54:13 - 00:02:01:18
John Riggi
Brett, thanks for joining us today.

00:02:01:18 - 00:02:03:24
Brett Leatherman
John, it was great working with you. Years ago, and it's equally great working with you today, thanks to you and the AHA for having me on.

00:02:03:27 - 00:02:36:04
John Riggi
Thanks, Brett. So since we last spoke in January, just a few things have changed. We went to war with Iran. Iran retaliated fairly quickly with cyber attacks against a mission critical third party provider having pretty significant impact across the sector. Since then, we've also had multiple health care third party providers attacked with innovative technological attacks. And quite frankly, deception types attacks. The standard vishing and phishing and certain groups have become very effective at that.

00:02:36:06 - 00:03:03:12
John Riggi
And then, of course, we have the development and discussion debate over frontier AI models. So the FBI, since that time releasing operation Winter Shield, the defensive strategy. It was great to see you all launch Operation Riptide, the complementary offensive initiative. Brett, could you talk to us a little bit about Operation Riptide and some of the results you've seen?

00:03:03:28 - 00:03:32:04
Brett Leatherman
Yeah, thanks, John. Operation Riptide was a 60 day push by the FBI to really implement the president's executive order on cybercrime and cyber enabled fraud - EO 14390, which was really focused on mitigating the risk to the homeland from cyber criminals and cyber fraudsters. During that 60 day push, the FBI Cyber Division partnered with the FBI's Criminal Division. There's four operational divisions in the FBI.

00:03:32:06 - 00:03:59:12
Brett Leatherman
Cybercrime falls under the cyber division and cyber enabled fraud under the criminal division. And together we did a push over 60 days to impose cost on malicious cyber actors domestically and abroad. So that 60 day push was compelling in that we conducted 13 joint sequenced operations against malicious cyber actors. We conducted over 200 arrests of cybercrime and cyber enabled fraud actors.

00:03:59:15 - 00:04:25:16
Brett Leatherman
We saw 50 plus additional subjects charged. Six alleged cybercriminal actors extradited back to the United States to face charges here, as well as numerous domain and infrastructure takedowns of malicious bad actors. So that is taking the fight to the bad guys and removing their capacity and capability to continue to conduct those attacks against healthcare and critical infrastructure here in the US.

00:04:25:18 - 00:04:54:15
John Riggi
Thanks for that summary. Really a remarkable operation. Often within cyber operations, I often get the question, why can't the FBI just arrest these folks? And traditionally the answer has been, they're beyond the reach of U.S. law enforcement countries like Russia, China and North Korea, in Iran providing safe harbor for these groups. So it's really extraordinary for me to hear you say we made 200 arrests, multiple extraditions, which used to be the exception.

00:04:54:22 - 00:05:21:13
John Riggi
And I know that's not done alone. Obviously, working with international partners and private sector probably helping in some capacity to feed that intelligence to all of you and the disruption of the infrastructure, technical and financial, huge impact, just as we used to see in counterterrorism days. Brett, you've heard me often say we can't win on defense alone. And I think Operation Riptide really exemplifies the offensive piece.

00:05:21:16 - 00:05:26:25
John Riggi
How do we work together going forward in the future? And why can't we win on defense alone?

00:05:26:28 - 00:06:02:29
Brett Leatherman
Yeah, that's a great point. And listen, as a 23 year plus FBI special agent, I love nothing more than holding actors accountable in a court of law. Arrests matter. But like you said,  often that's not always possible. You know, some of these subjects sit in sanctuary countries that just don't cooperate with U.S. law. And that really is the FBI cyber strategy that we released just a few weeks ago is focused on imposing cost, supporting victims, increasing the impact through partnerships, enhancing the FBI cyber capabilities because deterrence comes through a lot of these joint sequenced operations that we talk about.

00:06:03:00 - 00:06:20:25
Brett Leatherman
So even when we can't get to the actors themselves, we can often get to their infrastructure, we can get to their money, we can get to their tools. And any one of those that we remove as part of one of these operations are impactful, but the more of those we remove in any one operation is even more impactful to victims as well.

00:06:20:27 - 00:06:45:08
Brett Leatherman
And partnerships are key to that. There's two kinds of partnerships we look at. Number one, victims of cyber crime. Reaching out to the FBI quickly help us to see adversary infrastructure and move upstream against the actors themselves. And my team's hear me say that a lot. We've got to move upstream and we've got to do it quickly. That can only happen when victims report to us and they report to us quickly.

00:06:45:10 - 00:07:09:21
Brett Leatherman
The second kind of engagement we see is operational partners who sit in industry. Those who are able to take action in their own environments because of the telemetry they see or the infrastructure they operate. At the same time, we take action, and that's equally important to us to join forces and do that work simultaneously to have outsized impact on the actors.

00:07:09:24 - 00:07:15:19
Brett Leatherman
Our goal is to reduce gaps between us in those industry partners on both fronts.

00:07:15:22 - 00:07:34:11
John Riggi
It's great to hear you talk in those terms about beyond just threat information sharing, right? The old cliché, we used to say it's still valid, but, you know, establish a relationship with your local FBI. We got that. We're way beyond that. What we're talking about here now is not just threat information sharing, but operational engagement with the private sector.

00:07:34:16 - 00:08:02:19
John Riggi
Vast amount - as you know and you astutely leverage - vast amount of technical expertise, technical capability lies in the private sector. You know what I really find, I think, fascinating, an example for the rest of government, quite frankly, is that you operationalize the strategy really before even announcing it. You did operation Winter shield. We're going to help tell victims, tell potential victims, the whole country how to best defend against cyber attacks.

00:08:02:23 - 00:08:26:22
John Riggi
Ten practices under operation Winter shield. Pretty common sense, but you distilled it down. Let's do these things on defense. And knowing that defense alone will not prevent all the attacks, you followed with the complementary operation of Operation Riptide, then issued the strategy, said, here's the strategy and we're already doing it. So my hat's off to you in the entire FBI for doing that, taking that action.

00:08:26:29 - 00:08:39:05
John Riggi
Could you go into a little bit more about disruption strategies and wherever you could add a little more detail about the pillars and how you're working with private sector?

00:08:39:07 - 00:09:03:19
Brett Leatherman
Yeah, that's a great point. So pillar one is investigate, disrupt and impose cost on cyber adversaries. That's kind of what you're talking about in the disruption space. And what this really was is a codification of what we were already doing. Let me just give you some color to that. For the last 18 months, in particular, FBI cyber teams alone have charged 497 hackers.

00:09:03:19 - 00:09:06:17
Brett Leatherman
That's a significant increase year over year. That is a tremendous number.

00:09:06:17 - 00:09:13:19
John Riggi
I don't think in the time I was in the FBI, which was 28 years, and of course cyber was I've ever heard those kind of numbers.

00:09:13:22 - 00:09:42:12
Brett Leatherman
Yep. And equally important is the disruptions, not just the charges, but 476 malicious cyber operations that we disrupted. Thirty-four cyber criminal enterprises dismantled. That is just on kind of that threat side. Look at the extraditions. 50 cyber actors extradited. That's a 32% increase year over year, which means there is no safe harbor. And John, I love the slogan of Operation Riptide, which is no safe harbor.

00:09:42:12 - 00:10:02:23
Brett Leatherman
And what we meant was to convey and signal to the actors that this FBI strategy gives you no safe harbor. We will work with traditional and nontraditional partners to hold you accountable domestically and abroad, but to also, again, go after the infrastructure and the underlying ecosystem that you use to attack the United States.

00:10:02:25 - 00:10:20:19
John Riggi
Great explanation about that. I love the slogan as well. No safe harbor, because unfortunately, when I, you know, I speak to a lot of people around the country. I always say that one of the impediments for the FBI and the government to go after these bad guys is they're being provided safe harbor by Russia, China, North Korea and Iran.

00:10:20:23 - 00:10:55:06
John Riggi
So it's great to see you're taking that away from them. And you're implementing a strategy we use quite a bit in counterterrorism as well, in the sense that if we cannot put hands on them, we don't rely just on law enforcement actions. We work with partners across the intelligence community, foreign partners, to conduct disruptive, offensive cyber operations. And again, if we can't reach you and put handcuffs on you, we're going to, as you just said, take away your infrastructure, financial, technical in perhaps human through other arrests or cooperating witnesses that come forward.

00:10:55:10 - 00:11:08:00
John Riggi
I loved your message, talking about some of the recent arrests, pointing out to the bad guys that, hey, these folks that we have our hands on will probably act in their best interest and they may be telling us about you.

00:11:08:03 - 00:11:27:17
Brett Leatherman
I love that part of it. Right. You know, we recently announced a video message related to our work with Dutch authorities. And again, that's going to the partnerships, working with the Dutch. That's part of the best athlete model that the FBI cyber strategy talks about. And it's the FBI supporting the Dutch to get to where they need to charge

00:11:27:17 - 00:11:54:04
Brett Leatherman
In that case, a key administrator of Shiny Hunters, a very impactful group right now. They were able to arrest them, and we were very supportive of kind of their work to do that in filling the gap intelligence gaps that they had. But in the message, I shifted to talk to the rest of the group to say, listen, there are things that you see that maybe the public doesn't see - actions that the FBI takes covertly, that maybe the public is not aware of.

00:11:54:06 - 00:12:15:28
Brett Leatherman
And those are signs that we are moving upstream and identifying who you are. And that's part of my goal is there so much psychological impact to patients of hospitals, to people whose surgeries were canceled when a cyber attack prevents that. It's time to turn the tables on the bad guys and to say, listen, it's only a matter of time.

00:12:15:29 - 00:12:35:27
Brett Leatherman
Our teams have gotten exceptionally good at attribution. If you look at what we did against Lock Bit and Hive and all these ecosystems that thought they were impermeable by law enforcement, we dismantled them. And the same thing is going to be true of Shiny and some of the other groups as well. We're going to continue to pursue them aggressively under this strategy.

00:12:35:28 - 00:12:39:13
Brett Leatherman
And they need to take note that the teams are looking for them.

00:12:39:19 - 00:13:01:25
John Riggi
Thanks, Brett. You know, it's just a great direct message to the bad guys. It shows the government that you and all of FBI are very aggressive, and you're not going to let their bad actions, they're really sometimes evil actions when they threaten lives as we've seen with ransomware attacks on hospitals go unanswered. Go unaccounted for. And you know what else I love?

00:13:01:25 - 00:13:20:29
John Riggi
We said in the in your video message, is you said to the private sector very directly, we need you in this fight. And I know you obviously very well and I've worked with you obviously right up through this last weekend we had another major incident. You answered the call on Saturday night and help us understand what's going on.

00:13:21:06 - 00:13:41:18
John Riggi
The fact that that you will provide information back to the private sector, and you were very candid what you had and what you didn't have over the weekend. So that allowed me to inform the entire sector. So we appreciate that. And again, if there's anything else you'd like to add in your last phrase there about, on that video, we need you in this fight.

00:13:41:21 - 00:13:41:29

00:13:42:00 - 00:14:03:09
Brett Leatherman
Yeah. I think that's so important. And thank you, by the way, for engaging us over the weekend and providing some tipping information, because to us getting that that intelligence from industry is incredibly important. But yes, bilateral sharing is important. We are actor focused, victim centric and partner driven. And that's kind of really all three of those are important to us.

00:14:03:11 - 00:14:22:24
Brett Leatherman
And what I frequently say here when I talk to industry partners, whether it's at the board of directors level, the C-suite executive or the folks who are fighting in the trenches on the cyber defense side is: unfortunately for good or for bad, generally for bad, you've been drafted into this fight. It was not your choice to get drafted into the cyber fight.

00:14:22:24 - 00:14:43:09
Brett Leatherman
There is no other discipline the FBI does - counterterrorism, counterintelligence, criminal investigations - where we need industry as an equal partner in this fight, but we do in industry. And so you've been drafted. Unfortunately, you've been drafted, now we all need to step up and work together and trust each other. And trust is built before the crisis. And that's where we're looking to build that trust now.

00:14:43:09 - 00:14:59:13
Brett Leatherman
It's spent during crisis. It's built before the crisis. So we really appreciate the partnership with the AHA, and we want to model that across the sectors out there as well, the various sectors of critical infrastructure, so that we can have equally impactful relationships in every sector.

00:14:59:16 - 00:15:18:12
John Riggi
Brett, last question here. How do you see the threat evolving 2027? Obviously with China, frontier AI models, adversaries trying to use them? We're trying to use them to defend against them. Where do you see again, it's hard to think what we're going to happen next month. But how do you see the threat of in 2027?

00:15:18:18 - 00:15:47:10
Brett Leatherman
Yeah, sophistication was is going to be there. But really where everybody listening to this should think is compression of time frames to conduct cyber effects, meaning the bad guys are not going to look to leverage zero days. We talk a lot about AI development of zero days and sophisticated attacks. Right now where we're at, in the coming months, where we're at is the bad guys are going to look at the fundamentals of cybersecurity and exploiting those quicker in ways that are more impactful.

00:15:47:12 - 00:16:08:07
Brett Leatherman
So things like Winter shield still apply today. I would encourage the audience to still go to FBI.gov/Wintershield and look at those ten controls that we recommended, because AI is going to allow the adversary to move more quickly through those controls. Just a few weeks ago, NSA released a cybersecurity hygiene guide, which is very similar to Winter Shield.

00:16:08:07 - 00:16:33:16
Brett Leatherman
It talks about the controls that adversaries are using. NSA actually used AI to red team and understand the controls that are most needed today to defend against these AI based attacks. And not surprisingly, a lot of those aligned to Winter Shield. So if the nation's signals intelligence agency and the nation's domestic law enforcement and intelligence service are telling you these are the things that matter in the next few months, that's where you should focus.

00:16:33:16 - 00:16:38:12
Brett Leatherman
Because even with AI driven attacks, it's those fundamentals that really matter.

00:16:38:15 - 00:16:57:17
John Riggi
Thanks, Brett. Totally agreed. When folks come to me and say, John, where do we start? Or which practices and said, folks, you don't have to spend a lot of time doing this. Hundreds if not thousands of analysts across government have already done that work. They've reviewed thousands of cases, thousands of incidents, and they have access to classified intelligence.

00:16:57:17 - 00:17:19:11
John Riggi
And they say these are the best practices that help reduce risk. Start there. That's what I always tell them. Brett, so much going on and we won't keep you any longer. But I wanted to thank you personally. You, all the men and women in the cyber division and in the FBI for what you do every day to defend our networks, to defend our way of life, and to keep this country safe.

00:17:19:15 - 00:17:20:10
John Riggi
Great to see you.

00:17:20:17 - 00:17:23:05
Brett Leatherman
Good seeing you. Thanks, John.