FBI Director Christopher Wray Announces Actions To Disrupt And Prosecute Russian Criminal Activity

FBI Director Christopher Wray delivered the following remarks during a press conference at the Department of Justice in Washington, D.C., with partner agency officials announcing actions to prosecute criminal Russian activity. (Remarks as delivered):

I’m pleased to be here today to help announce this series of actions countering threats originating from Russia.

I want to focus for a few minutes on the FBI’s role in one of the actions the Attorney General mentioned, and what it says about the FBI’s unique cyber capabilities and what we can accomplish together with the private sector.

Today, we’re announcing a sophisticated, court-authorized operation disrupting a botnet of thousands of devices controlled by the Russian government—before it could do any harm.

We removed malware from devices used by thousands of mostly small businesses for network security all over the world. And then we shut the door the Russians had used to get into them.

Yesterday’s Darknet takedown struck a blow against Russian criminals and the ecosystem of cryptocurrency tumblers, money launders, malware purveyors, and other supporting them. The botnet disruption we’re announcing today strikes a blow against Russian intelligence, the Russian government.

The bot network we disrupted was built by the GRU—the Russian government’s military intelligence agency. And in particular it was the unit within GRU known to security researchers as Sandworm Team.

This GRU team, Sandworm, had implanted a specific type of malware known as Cyclops Blink on thousands of WatchGuard Technologies’ Firebox devices—these are security appliances, mainly firewalls, that are typically deployed in home office environments and in small to mid-size businesses.

Sandworm strung them together to use their computing power in a way that would obfuscate who was really running the network and let them then launch malware or to orchestrate distributed denial of service attacks like the GRU has already used to attack Ukraine. I should note here, that the GRU’s Sandworm team has a long history of outrageous, destructive attacks: The disruption of the Ukrainian electric grid in 2015, attacks against the Winter Olympics and the Paralympics in 2018, a series of disruptive attacks against the nation of Georgia in 2019, and, in 2017, the NotPetya attack that devastated Ukraine but also ended up hitting systems here in the U.S., throughout Europe, and elsewhere, causing more than 10 billion dollars in damages­—one of the most damaging cyberattacks in the history of cyberattacks.

With the court-authorized operations we’re announcing today, we’ve disrupted this botnet before it could be used. We were largely able to do that because we had close cooperation with WatchGuard.

We’ve worked closely with WatchGuard to analyze the malware and develop detection tools and remediation techniques over the past several weeks. And our operation removed Russia’s ability to control these Firebox devices on the botnet network, and then copied and removed malware from the infected devices. Now I should caution that as we move forward, any Firebox devices that acted as bots may still remain vulnerable in the future until mitigated by their owners, so those owners should still go ahead and adopt WatchGuard’s recommended detection and remediation steps as soon as possible.

We’re continuing to conduct a thorough and methodical investigation, but as we’ve shown, we are not going to wait for our investigations to end to act. We are going to act as soon as we can, with whatever partners are best situated to help, to protect the public.

This announcement today shows the value of the FBI’s technical expertise and unique authorities—both as a law enforcement agency and an intelligence service. And that unique combination, both of which were essential to the success of this operation. 

It also shows what we can accomplish with our partners to help companies—like the thousands of mostly small business affected by this botnet—hit by threats like these posed by the Russian government.

Our partnership with the private sector was key here. WatchGuard enthusiastically cooperated with the FBI to figure out the source of the infection and to counter it. That kind of cooperation makes successes like the one we’re announcing today possible, and it will continue to be important going forward.

The Russian government has shown it has no qualms about conducting this kind of criminal activity, and they continue to pose an imminent threat. And this global botnet disruption, in conjunction with the other actions discussed today, reflect an aggressive effort by the FBI and our partners to go on offense against Russian cyber threats, wherever they appear.

I’d also like to commend our partners at the DEA, IRS, and our foreign partners on the Hydra Darknet takedown and all of the men and women of the FBI involved with both of those operations, as well as the indictments and property seizures involving Russian oligarchs this week.

I should emphasize that we will continue to rely on companies to work with us the way WatchGuard has so that we can protect our nation’s cybersecurity together. For businesses, I would encourage you to have a cybersecurity plan and to include contacting your local FBI field office as an important part of that plan. And if you suspect a cyber intrusion, please contact your local FBI field office immediately—the more quickly we get involved, the more we can do to protect you. We are laser focused on disrupting the threat, on preventing harm from dangerous adversaries. Sometimes that means making arrests, and other times—like both yesterday and today—that means taking adversaries’ capabilities off the field.

No agency or business can do this alone. It takes everyone's cooperation. And the FBI will be there to work with you on cyber threats from Russia or anywhere else.

Finally, I would like to thank and congratulate our FBI teams in a wide number of field offices here in the U.S. and our legal attaches overseas for their work that has paid off this week—with seizing sanctioned assets here and in Spain, with the indictments we’re announcing today, and with the disruption of both criminal and hostile intelligence activities that we’re here to discuss this morning.

Thank you. 

FBI Director Wray: China’s Quest For Economic, Political Domination Threatens America’s Security

 The FBI released the below:

The Chinese government’s disregard for global leadership norms, ruthless hunger for economic superiority, and desire to influence American politics make it a threat to U.S. national security, FBI Director Christopher Wray said on January 31.

“There is so much good we could do with a responsible Chinese government: crack down on cybercriminals, stop money launderers, reduce opioid overdose deaths. But at the FBI, we’re focused on the reality of the Chinese government today,” Wray said during a keynote address at the Ronald Reagan Presidential Library and Museum in Simi Valley, California.

The threat’s complexity is rooted in the intrinsic entanglement of the American and Chinese economies, which is fueled by a high U.S. demand for Chinese-made products and a steady exchange of students between American and Chinese borders. Wray stressed that China has pulled no punches about capitalizing on this interconnectedness to chase economic superiority.

“When we tally up what we see in our investigations—over 2,000 of which are focused on the Chinese government trying to steal our information or technology—there is just no country that presents a broader threat to our ideas, our innovation, and our economic security than China,” Wray said, adding that the Bureau opens a new counterintelligence case against China about twice a day.

China’s strategy is especially dangerous because it pursues economic espionage on multiple fronts—some so subtle that they don’t set off alarms. But once China sets its sights on a technology, Wray explained, it uses every available resource to try to steal it. He pointed to a foiled Chinese plot to use a combination of industrial espionage and hacking to steal trade secrets from GE Aviation to illustrate this approach.

This theft not only gives China an unfair advantage in the global marketplace but also directly harms American companies and workers.

Yet the Chinese government’s thirst for power can’t be quenched by economic dominance alone, Wray noted. China also ultimately seeks to undermine and infiltrate the U.S. government and silence dissent whenever possible.

The Chinese Communist Party (CCP) aims to win American leaders’ loyalty through money or intimidation and “to undermine our democratic process by influencing our elected officials.” Wray said. The CCP is patient in this pursuit, aiming to recruit early-career politicians—often at the state and local level—who can then be called on to do Beijing’s bidding when their power and influence grow.

The Chinese government is also increasingly using a program it calls Fox Hunt to target, threaten, intimidate, and ultimately repatriate former Chinese citizens living overseas whom it sees as a political or financial threat. Many of them are green card holders and naturalized citizens here in the United States.

Through Fox Hunt, the Chinese government has sought to intimidate and silence Chinese and Chinese American students who are studying at U.S. universities. If a student voices or posts an opinion critical of the Chinese government, their family members back in China may receive threats.

“China may be the first government to combine authoritarian ambitions with cutting-edge technical capability,” Wray said. “It’s like the surveillance nightmare of East Germany combined with the tech of Silicon Valley.”

Fortunately, as China’s thirst for power has grown, the FBI’s strategy and capabilities have evolved to deter it.

One such advance has been the FBI’s use of intelligence to identify and disrupt threats early, as it did in response to China’s recent compromise of Microsoft Exchange email servers.

The FBI also now shares information with domestic and international partners to help them defend against future plots and has boosted private-sector engagement.

Additionally, the Bureau has repurposed lessons learned from the counterterrorism arena to deter China. This included standing up Cyber Task Forces and Counterintelligence Task Forces in every FBI field office and forming a National Counterintelligence Task Force.

America’s democratic and legal processes also play a role, Wray explained, since our ability to make substantiated allegations can move allies to act, and indictments can inspire increased public scrutiny of bad actors.

“So, we’re confronting this threat and winning important battles, not just while adhering to our values, but by adhering to our values,” Wray said. “I believe that in the course of doing so, we’re showing why the Chinese government needs to change course—for all our sakes.”

Wray’s appearance marked the opening of the Reagan Library’s “FBI: From Al Capone to al Qaeda” exhibition. He is the first sitting Bureau director to visit the library.

FBI Director Christopher Wray’s Remarks At Briefing On Inauguration Security

 The FBI released the below information:

During a briefing to Vice President Mike Pence with other agency officials at FEMA Headquarters in Washington, D.C., on January 14, 2021, FBI Director Christopher Wray discussed the FBI's efforts regarding inauguration security. Remarks as delivered.

Mr. Vice President, just as we’re doing with our investigation into last week’s violent activities at the Capitol, we’re bringing our aggressive operational capabilities and deep investigative and intelligence expertise to next week’s inauguration.

As Director Murray said, while the Secret Service takes the lead in inaugural security, the FBI is the lead federal agency for crisis response, for counterterrorism investigations, and intelligence analysis. In that vein, as Director Murray said, we’ve been planning for months and months on this, which is part of what I think gives us the confidence that we have. At the FBI, we’ve set up a national command post at FBI Headquarters as well as a command post in our Washington Field Office, which I know you visited before and you would recognize.

As well, we have command posts in all 56 of our field offices. Those command posts bring together personnel—not just from the FBI but from across the government—to gather intelligence, to assess potential threats, to coordinate investigations, and to surge resources where needed. They make it possible to share information in real time and allow our personnel to continually update those threat assessments.

Those command posts are going to be running 24/7 through the inauguration and, in some cases, in the days to follow.

We’re monitoring all incoming leads, whether they’re calls for armed protest, potential threats that grow out of the January 6 breach of the Capitol, or other kinds of potential threats leading up to inaugural events and in various other targets. We’re latched up with all of our partners in that regard.

When we talk about potential threats—maybe I’ll just say a word or two about that—we are seeing an extensive amount of concerning online chatter—that’s the best way I would describe it—about a number of events surrounding the inauguration. Together with our partners, we evaluate those threats and what kind of resources to deploy against them. Right now, we‘re tracking calls for potential armed protests and activity leading up to the inauguration.

The reason I use the word “potential” is because one of the real challenges in this space is trying to distinguish what’s aspirational versus what’s intentional. We’re concerned about the potential for violence at multiple protests and rallies planned here in D.C. and at state Capitol buildings around the country in the days to come that could bring armed individuals within close proximity to government buildings and officials.

As you can imagine, the volume of information out there is significant, but we’ve been pushing that information as rapidly as possible to all of our relevant law enforcement and intelligence partners. If we find that an individual poses a violent threat, then we and our partners will take advantage of every lawful authority and method we’ve got to disrupt any attempt or attack. Our posture is aggressive; it’s going to stay that way through the inauguration.

In that vein, we and our partners have already arrested more than 100 individuals for their criminal activities in last week’s siege of the Capitol and continue to pursue countless other related investigations. Those help not only prevent those individuals from any effort to repeat that kind of activity, but also should serve as a very stern warning to anybody else who might be inclined to try to engage in that activity.

But we’re also taking other steps. The American people may not hear about every disruption in the media and may not see the FBI’s hand in everything we do, but they should be confident that there’s an awful lot of work all across the country going on behind the scenes, out of the spotlight, where we’re feeding relevant information to all of our partners so that they can harden targets as appropriate.

And as I said, we’re looking at individuals who may have an eye toward repeating that same kind of violence that we saw last week. I mean, from January 6 alone, we’ve already identified over 200 suspects. We know who you are, if you’re out there, and FBI agents are coming to find you.

My advice to people who might be inclined to follow in the footsteps of those who engaged in the kind of activity that we saw last week is: Stay home. Look at what’s happening now to the people who were involved in the Capitol siege. Wherever they scattered to—whether it was Memphis, Phoenix, Dallas, Honolulu—what they’re finding is that we’ve got FBI agents tracking them down and arresting them.

If I were those people, you don’t want to be the ones to have FBI agents knocking on your door at 6:00 a.m. So anybody who plots or attempts violence in the coming week should count on a visit.

So together with our partners here in the District and across the country, we’re going to be doing everything we can to ensure a smooth transition of power in the days to come. This is a team effort, and I’m really proud of the team that you have assembled here.

Terrorists, Spies, And Cyber Criminals: My Counterterrorism Magazine Piece On The FBI And Threats To The Homeland

Counterterrorism magazine published my piece on the FBI and threats from terrorists, spies, and cyber criminals.

You can read the piece above and below.

Note: You can click on the above to enlarge.

Homegrown Terrorists: My Counterterrorism Magazine Piece On The Threat Of Domestic Terrorism

My piece on the threat of domestic terrorism was published by Counterterrorism magazine.

You can read the piece above and below:

 

FBI: International Conference On Cyber Security - Director Wray Touts FBI Cyber Capabilities, Addresses Current Threats

The FBI released the below information:

FBI Director Christopher Wray is seen through the phone of an audience member at the Fordham University/FBI-sponsored International Conference on Cyber Security in New York City on July 25, 2019.

The FBI is working to address evolving cyber threats facing the country, including foreign influence and foreign investment, FBI Director Christopher Wray said at a cybersecurity conference today.

“These threats strike—and they strike hard—at our security. That means our economic security and our ability to keep our companies safe from theft and intrusion,” Wray said. “It means our national security ... it means our safety as everyday citizens walking the streets and sending our kids to school.”

Wray served as the closing speaker at the International Conference on Cyber Security in New York, co-sponsored by the FBI and Fordham University. He was joined by Rev. Joseph McShane, president of Fordham University, and FBI New York Special Agent in Charge Aristedes Mahairas.

Wray described the many resources the FBI brings to its cyber mission—from Cyber Action Teams to the 24-hour command post known as CyWatch to the addition of cyber-focused legal attachés in FBI offices around the world.

“Our role isn’t limited to investigations,” Wray explained. We’re using our expertise to warn the public and private sectors about what we’re seeing and to spotlight risks and vulnerabilities.”

Foreign influence is one of today’s most pressing cyber-related threats, and Wray discussed the FBI’s role in mitigating these threats to the 2020 elections. Through its Foreign Influence Task Force, the FBI has foreign influence-related investigations open across the country. The Bureau’s efforts also involve building relationships with the private sector and information sharing.

“But the foreign influence threat isn’t just limited to election season,” Wray said. “We have to remain vigilant all year round. We have to raise public awareness and increase our country’s resilience in a more sustained and enduring way."

Another threat of concern to the U.S. government is foreign investment in American companies, which can sometimes lead to the theft of intellectual property, sensitive data, or proprietary research. He urged U.S. companies to exercise caution in working with companies from adversarial countries because adversaries are willing to buy access to American proprietary information. 

Additionally, Wray called on the public and private sectors to work together to address the growing inability for law enforcement to lawfully access encrypted data of terrorists and criminals, sometimes referred to as “going dark.” This data may be on phones or other devices or transmitted over encrypted apps or platforms.

While the FBI supports strong cybersecurity, Wray said that no place should be completely off-limits to lawful access. He called it a “fundamental public safety issue” that hampers not only the FBI but also state and local law enforcement efforts.

Wray cited the example that nearly two years after the shooting at a church in Sutherland Springs, Texas, the FBI still cannot get into the shooter’s phone. While the gunman is dead and no longer a threat, access to that information could potentially help prevent a future attack. “If we were dealing with a living subject—someone we were still trying to track down, who could be out planning another attack—the situation could be even more dangerous,” said Wray.

This trend is made more complex by the advent of virtual currency, which some criminals use to hide their transactions.

“It cannot be a sustainable end state for us to be creating some kind of unfettered space beyond the reach of lawful access for terrorists, hackers, and child predators to hide,” Wray said. “But that’s the path we’re on now if we don’t somehow come together to find a solution.”

FBI Director: China Is Stealing Its Way Up The Economic Ladder

The FBI released the below information:

FBI Director Christopher Wray called China’s sweeping spying and hacking efforts a threat to U.S. economic and national security and said the FBI is working diligently to stay ahead of the diverse and evolving threats our country faces.

In remarks today at the Council on Foreign Relations in Washington, D.C., Wray described a threat landscape ranging from terrorism to cybercrime to espionage. He specifically called out the Chinese government, which is considered a major counterintelligence threat to the U.S. and other countries. The Chinese intelligence services strategically use every tool at their disposal—including state-owned businesses, students, researchers, and ostensibly private companies—to systematically steal information and intellectual property.

“China has pioneered a societal approach to stealing innovation any way it can, from a wide array of businesses, universities, and organizations,” Wray said.

Wray said the FBI has China-related economic espionage investigations in nearly all of its 56 field offices and in nearly every industry.

“Put plainly, China seems determined to steal its way up the economic ladder, at our expense,” Wray said.

In recent months, the U.S. government charged Chinese tech giant Huawei with theft of trade secrets and other offenses. Chinese government-affiliated hackers have also been subjected to indictments in the U.S.

Wray described the variety of resources that the FBI uses to thwart terrorists, spies, and criminals, such as multi-agency task forces, international legal attaché offices, and rapid response teams. Partnerships, whether with other government agencies or the private sector, are key to carrying out the FBI’s mission and something the FBI continues to strengthen. Wray said he meets with law enforcement, private sector, academic, and other FBI partners during his travels throughout the U.S.

“In our country, the vast majority of our critical infrastructure and intellectual property is of course in the hands of the private sector,” Wray said. “You own it, you run it, you're on the front lines. … That’s why it’s so important for these lines of communication to be open.”

Wray also said the recent terrorist attacks in Sri Lanka are a reminder that terrorism remains a persistent danger, although smaller plots from homegrown violent extremists are also a threat—one that is more challenging for law enforcement to thwart ahead of time.

“These are people moving from radicalization to attack in weeks, or even days, not years,” Wray said. “And they’re doing it online and in encrypted messaging platforms, not in some camp or cave.”

Addressing The Cyber Threat: FBI Director Discusses FBI Approach At Cybersecurity Conference

The FBI released the below information:

With cyber threats to the United States and across globe reaching unprecedented levels, the FBI uses a full spectrum of expertise, technology, and partnerships to root out cyber criminals, FBI Director Christopher Wray said at the annual RSA Conference in San Francisco yesterday.

“Today’s cyber threat is bigger than any one government agency—frankly, bigger than government itself,” Wray said in an on-stage interview at the cybersecurity conference. “But I think no agency brings the same combination of scope and scale, experience, tools, and relationships that the FBI has.”

You can read the rest of the piece and watch a video clip via the below link:

https://www.fbi.gov/news/stories/director-wray-speaks-at-rsa-cybersecurity-conference-030619?utm_campaign=email-Daily&utm_medium=email&utm_source=fbi-top-stories&utm_content=%5B719215%5D-%2Fnews%2Fstories%2Fdirector-wray-speaks-at-rsa-cybersecurity-conference-030619 

CIA Offfical: China Waging 'Quiet' Cold War Against US

The New York Post offers a piece on intelligence officials naming Communist China as a threat to the US.

ASPEN, Colo. — China is waging a “quiet kind of cold war” against the United States, using all its resources to try to replace America as the leading power in the world, a top CIA expert on Asia said Friday.

Beijing doesn’t want to go to war, he said, but the current communist government, under President Xi Jingping, is subtly working on multiple fronts to undermine the U.S. in ways that are different than the more well-publicized activities being employed by Russia.

“I would argue … that what they’re waging against us is fundamentally a cold war — a cold war not like we saw during THE Cold War (between the U.S. and the Soviet Union) but a cold war by definition,” Michael Collins, deputy assistant director of the CIA’s East Asia mission center, said at the Aspen Security Forum in Colorado.

Rising U.S.-China tension goes beyond the trade dispute playing out in a tariff tit-for-tat between the two nations.

There is concern over China’s pervasive efforts to steal business secrets and details about high-tech research being conducted in the U.S. The Chinese military is expanding and being modernized and the U.S., as well as other nations, have complained about China’s construction of military outposts on islands in the South China Sea.

“I would argue that it’s the Crimea of the East,” Collins said, referring to Russia’s brash annexation of Ukraine’s Crimean Peninsula, which was condemned throughout the West.

… On Wednesday, FBI Director Christopher Wray said China, from a counterintelligence perspective, represents the broadest and most significant threat America faces. He said the FBI has economic espionage investigations in all 50 states that can be traced back to China.

“The volume of it. The pervasiveness of it. The significance of it is something that I think this country cannot underestimate,” Wray said.

National Intelligence Director Dan Coats also warned of rising Chinese aggression. In particular, he said, the U.S. must stand strong against China’s effort to steal business secrets and academic research.

You can read the rest of the piece via the below link:

https://nypost.com/2018/07/21/cia-official-china-waging-quiet-cold-war-against-us/  

Statement By Attorney General Sessions On The Swearing In Of FBI Director Chris Wray

The U.S. Justice Department released the below information:

Attorney General Jeff Sessions day issued the following statement on the swearing in of the new Federal Bureau of Investigation Director Chris Wray:

"Moments ago I had the honor of swearing in Chris Wray as our new Director of the Federal Bureau of Investigation.

"Chris has the experience and the strength of character that the American people want in an FBI Director and I congratulate him for being overwhelmingly confirmed to that post and look forward to working with him every day to keep America safe.

“As a former federal prosecutor and head of the Department of Justice's Criminal Division, Chris Wray has successfully prosecuted terrorists, drug kingpins, and white-collar criminals. He has earned the respect of his colleagues at DOJ, receiving our highest honor, the Edmund Randolph award, and bipartisan support in the Senate.

"I am confident that the FBI, the premier investigative agency in the world, is in great hands with Director Chris Wray at the helm."

Note: FBI Director Wray is seen in the above photo.