ISOSOC2 Type 1SOC2 Type 2PCI DSSHIPAAGDPR

This is the official Federal Bureau of Investigation (FBI) LinkedIn account and is used to build awareness of workplace culture, engagement opportunities, and the FBI mission. The FBI does not collect comments or messages through this account. The FBI is the premier law enforcement agency in the world. We are an intelligence-driven, outcome-focused national security organization. Steeped in a history of innovation and determination, the Bureau is a collective of individuals united under one unwavering mission: to protect the American people and uphold the U.S. Constitution. The FBI mission guides our efforts and focuses our resources on critical threats, while our core values—respect, integrity, accountability, leadership, compassion, fairness, and rigorous obedience to the Constitution—serve as the foundation of everything we do. The FBI has more than 500 purpose-driven careers—such as special agent, forensic accountant, victim specialist, and IT specialist—to safeguard the nation against cyberattacks, financial fraud, organized crime, and more. We leverage our varied backgrounds, from art history to engineering, to investigate illegal activity. The FBI collaborates worldwide with law enforcement partners and intelligence agencies, providing resources including biometric identification, laboratory examinations, comprehensive training, and more. And while you are investing in us, the FBI is investing in you: Bureau benefits include unparalleled leadership development, advancement and growth opportunities, and an impactful career that enables our workforce to evolve with the mission. Set yourself apart by joining the FBI. Apply today. Note: Submit tips at tips.fbi.gov. Public info may be used for authorized purposes only: justice.gov/doj/privacy-policy.

Federal Bureau of Investigation (FBI) A.I CyberSecurity Scoring

FBI

Company Details

Linkedin ID:

fbi

Employees number:

10,118

Number of followers:

936,451

NAICS:

92212

Industry Type:

Law Enforcement

Homepage:

fbijobs.gov

IP Addresses:

Scan still pending

Company ID:

FED_3365900

Scan Status:

In-progress

AI scoreFBI Risk Score (AI oriented)

Between 600 and 649

https://images.rankiteo.com/companyimages/fbi.jpeg
FBI Law Enforcement
Updated:
  • Powered by our proprietary A.I cyber incident model
  • Insurance preferes TPRM score to calculate premium
globalscoreFBI Global Score (TPRM)

XXXX

https://images.rankiteo.com/companyimages/fbi.jpeg
FBI Law Enforcement
  • Instant access to detailed risk factors
  • Benchmark vs. industry & size peers
  • Vulnerabilities
  • Findings

Federal Bureau of Investigation (FBI)

Poor
Current Score
617
Caa (Poor)
01000
8 incidents
-37.0 avg impact

Incident timeline with MITRE ATT&CK tactics, techniques, and mitigations.

JANUARY 2026
632
Cyber Attack
05 Jan 2026 • FBI, CISA, U.S. Department of Homeland Security and Defense Department's Cyber Crime Center: US Homeland Security warns of escalating Iranian cyberattack risks
DHS Warning of Escalating Cyberattack Risks by Iran-Backed Hacking Groups

**DHS Warns of Escalating Cyber Threats from Iran-Backed Hackers Amid Rising Tensions** The U.S. Department of Homeland Security (DHS) issued a **National Terrorism Advisory System (NTAS) bulletin** on Sunday, warning of heightened cyberattack risks from **Iran-backed hacking groups and pro-Iranian hacktivists** following recent geopolitical escalations. The advisory highlights a **"heightened threat environment"** in the U.S., with **low-level cyberattacks** likely targeting vulnerable networks. The DHS cautioned that **violent extremists** within the U.S. could mobilize in response to the Israel-Iran conflict, particularly if Iranian leadership issues a **religious ruling calling for retaliatory violence**. The bulletin also noted that **anti-Semitic and anti-Israel sentiment** has already motivated recent domestic attacks, raising concerns about further violence. The warning follows a pattern of **Iranian state-affiliated hackers and hacktivists** exploiting poorly secured U.S. networks. In **October**, authorities in the **U.S., Canada, and Australia** reported that Iranian hackers were acting as **initial access brokers**, breaching organizations in **healthcare, government, IT, engineering, and energy sectors** through **brute-force attacks, password spraying, and MFA fatigue (push bombing)**. A separate **August advisory** from **CISA, the FBI, and the Defense Department’s Cyber Crime Center (DC3)** identified **Br0k3r** (also known as Pioneer Kitten, Fox Kitten, and other aliases) as a **state-sponsored Iranian threat group** involved in selling access to compromised networks to **ransomware affiliates** in exchange for a share of profits. While the DHS did not explicitly link the NTAS bulletin to recent events, the warning comes after **U.S. strikes on Iranian nuclear facilities**—including **Fordow, Natanz, and Isfahan**—on **Saturday**, just over a week after **Israel targeted Iranian nuclear and military sites** on **June 13**. Iran’s Foreign Minister, **Abbas Araghchi**, responded by warning of **"everlasting consequences"** and asserting Iran’s right to defend its sovereignty.

615
critical -17
FBICISUS-UNI1767786135
Cyberattack, Initial Access Brokerage, Ransomware
Brute-force attacks Password spraying MFA fatigue (push bombing)
Poorly secured networks, MFA vulnerabilities
Retaliation for U.S. attacks on Iranian nuclear facilities Financial gain (ransomware payments) Political/ideological (anti-Semitic or anti-Israel sentiment)
Brute-force attacks Password spraying MFA fatigue (push bombing) Data Sold On Dark Web: Yes (ransomware affiliates)
DECEMBER 2025
635
NOVEMBER 2025
633
OCTOBER 2025
630
SEPTEMBER 2025
627
AUGUST 2025
679
Breach
15 Aug 2025 • FBI (Federal Bureau of Investigation)
Compromised FBI.gov and Other Government Email Accounts Sold on Dark Web for Fraudulent Use

Compromised **FBI.gov email accounts** are being sold on dark web channels (e.g., Telegram, Signal) for as low as **$40**, granting buyers full **SMTP/POP3/IMAP access**. These credentials enable attackers to impersonate law enforcement, submit **fraudulent emergency data requests** to tech companies (bypassing legal processes like subpoenas), and extract sensitive user data (IPs, emails, phone numbers). Criminals also exploit these accounts to distribute **malware campaigns**, access **government-restricted intelligence tools** (e.g., Shodan, Intelligence X), and infiltrate **law enforcement portals**. The breach stems from **credential stuffing, infostealer malware, and targeted phishing**, exploiting human/technical vulnerabilities rather than direct system hacking. The commoditization of **institutional trust** amplifies risks of large-scale fraud, unauthorized data disclosure, and erosion of public confidence in government communications. Accounts from domains like **.gov** bypass security filters, increasing phishing success rates and potential for **supply-chain attacks** on private sector entities relying on government verification.

622
critical -57
FBI833081625
Account Compromise Credential Theft Dark Web Marketplace Activity Phishing/Social Engineering Malware (Infostealer) Fraud (Forged Emergency Data Requests)
Credential Stuffing (Password Reuse Exploitation) Infostealer Malware (Browser/Email Client Credential Theft) Targeted Phishing/Social Engineering Dark Web/Encrypted Messaging Platforms (Telegram, Signal) Mainstream Platforms (TikTok, X)
Weak/Reused Passwords Lack of Multi-Factor Authentication (MFA) Human Vulnerability (Phishing/Social Engineering Susceptibility) Saved Credentials in Browsers/Email Clients Trust in .gov/.police Domain Emails (Bypassing Technical Filters)
Financial Gain (Selling Access for $40–$X per Account) Fraud (Impersonation, Forged EDRs, Malware Distribution) Exploitation of Institutional Trust Access to Premium OSINT Tools Data Theft (IP Addresses, Emails, Phone Numbers)
Email Account Credentials (SMTP/POP3/IMAP) Potential Disclosure of Sensitive Data via Forged EDRs (e.g., IP Addresses, Phone Numbers, Emails) Access to Law Enforcement Portals/OSINT Tools FBI.gov Email Accounts Other U.S. Government Email Accounts (.gov, .police Domains) Tech Company/Telecom Provider Systems (via Forged EDRs) OSINT Platforms (Shodan, Intelligence X) Risk of Large-Scale Malware Campaigns Erosion of Trust in Government Communications Potential Legal Liabilities for Tech Companies Complying with Forged EDRs FBI/Government Agencies (Loss of Credibility) Tech Companies (If Tricked by Forged EDRs) Potential Violations of Data Protection Laws (If Sensitive Data Disclosed via Forged EDRs) Liability for Tech Companies Complying with Fraudulent Requests Identity Theft Risk: High (Impersonation of Law Enforcement)
Abnormal AI (Research/Reporting)
Email Credentials (SMTP/POP3/IMAP) Potentially Sensitive Data via Forged EDRs (e.g., Subscriber Information) Sensitivity Of Data: High (Government Email Access, Potential PII via EDRs) Data Exfiltration: Likely (Credentials Sold; Data Accessed via Forged EDRs) Personally Identifiable Information: Potential (If Disclosed via Forged EDRs)
Government agencies must enforce stronger authentication (e.g., MFA, hardware tokens) for email accounts. Credential stuffing and infostealer malware remain effective due to password reuse and saved credentials. Trust in .gov/.police domains can be weaponized to bypass technical filters (e.g., phishing/malware delivery). Commoditization of compromised accounts on dark web/mainstream platforms enables scalable fraud. Tech companies must verify emergency data requests more rigorously to prevent abuse.
Implement mandatory MFA (preferably phishing-resistant) for all government email accounts. Conduct regular credential hygiene audits to detect reused/weak passwords. Deploy endpoint detection and response (EDR) tools to detect infostealer malware. Enhance employee training on phishing/social engineering tailored to government targets. Monitor dark web/mainstream platforms for leaked government credentials. Establish stricter verification protocols for emergency data requests (e.g., secondary confirmation channels). Limit premium OSINT tool access to verified devices/IPs beyond just email verification. Collaborate with platforms (Telegram, TikTok, X) to takedown listings selling government credentials.
['Ongoing (Reported by Abnormal AI; No Official FBI Statement)']
Credential Stuffing Infostealer Malware Phishing/Social Engineering FBI.gov Email Accounts Law Enforcement Portals OSINT Tools (Shodan, Intelligence X) Full Email Credentials (SMTP/POP3/IMAP) Bundles of Government Accounts Access to Premium OSINT Features
Weak Authentication Practices (No MFA, Password Reuse) Lack of Monitoring for Credential Theft (Dark Web/Infostealer Activity) Over-Reliance on Domain Trust (.gov/.police Bypassing Filters) Insufficient Verification for Emergency Data Requests
JULY 2025
678
JUNE 2025
675
MAY 2025
673
APRIL 2025
670
MARCH 2025
668
FEBRUARY 2025
666
DECEMBER 2024
715
Breach
01 Dec 2024 • FBI
Investigation of Radical Ideology Inspired by 'The Turner Diaries'

In the film 'The Order,' the FBI investigates the proliferation of a radical ideology that leads to significant acts of domestic terrorism, including armed revolt and assassination. Based on historical events, the narrative identifies the influence of 'The Turner Diaries' in inspiring Timothy McVeigh's Oklahoma City bombing. Given the profound effect on national security and the potential for sparking wide-ranging violence, the involvement of law enforcement to thwart such threats is imperative.

658
critical -57
FBI001121924
Domestic Terrorism Armed Revolt Assassination
Radical Ideology Proliferation
Influence of Radical Literature
Radical Ideology Political Motives
Law Enforcement Notified: Yes
Root Causes: Proliferation of Radical Ideology
AUGUST 2024
766
Breach
01 Aug 2024 • FBI
Dissemination of Propaganda and Child Abuse Material by FBI Informant

An FBI informant, Joshua Caleb Sutter, linked to extreme right-wing and neo-Nazi movements disseminated propaganda contributing to the rise of violent groups and networks engaged in child abuse. His actions, along with other radical elements, have led to the proliferation of child sexual abuse material (CSAM) and potentially influenced ultraviolent terrorist acts. Despite Sutter's past as an informant and implication in serious crimes, the FBI's stance and handling of his case remain unclear, raising concerns over informant accountability and the extent of malfeasance overlooked in intelligence operations.

709
critical -57
FBI001080624
Dissemination of Propaganda and Child Abuse Material
Propaganda and Child Sexual Abuse Material Distribution
Informant Malfeasance
Right-wing Extremism Neo-Nazism
Brand Reputation Impact: Concerns over FBI's handling of informants
JUNE 2021
749
Cyber Attack
16 Jun 2021 • Federal Bureau of Investigation (FBI)
Man pardoned for Jan. 6 gets life in prison for plotting to incite 'civil war,' attack FBI agents

Edward Kelley, a Tennessee man pardoned for his role in the Jan. 6, 2021, U.S. Capitol assault, was sentenced to life in prison for plotting to attack FBI agents and seeking to incite a 'civil war.' Kelley created a 'kill list' of FBI agents and distributed it to a co-conspirator. He was convicted of conspiracy charges and viewed the FBI as the enemy, targeting them for assassination. The Justice Department stated that Kelley identified 36 law enforcement personnel to target, including names, titles, and cell phone numbers.

732
critical -17
FBI501070425
Conspiracy to incite civil war and attack FBI agents
Physical assault and targeted killings
Incite civil war Target law enforcement for assassination
Legal Actions: Life imprisonment
['Completed']
JUNE 2021
750
Cyber Attack
01 Jun 2021 • CISA, Symantec, FBI and Fortinet: Medusa Ransomware Hits 40+ Victims in 2025, Demands $100K–$15M Ransom
Medusa Ransomware Surges, Targeting Critical Infrastructure with Double Extortion Tactics

**Medusa Ransomware Surges, Targeting Critical Infrastructure with Double Extortion Tactics** The Medusa ransomware operation, tracked by Symantec as *Spearwing*, has claimed nearly 400 victims since its emergence in January 2023, with attacks rising 42% between 2023 and 2024. In the first two months of 2025 alone, the group has attributed over 40 incidents, signaling an aggressive expansion amid the disruption of other major ransomware-as-a-service (RaaS) players like LockBit and BlackCat. Medusa employs *double extortion*, stealing sensitive data before encrypting networks to pressure victims into paying ransoms ranging from $100,000 to $15 million. Targets span healthcare, financial services, government, education, legal, and manufacturing sectors many within critical infrastructure. If victims refuse to pay, the group threatens to leak stolen data via its dedicated leak site. ### **Attack Methods & Tools** Medusa’s intrusion chains often begin with exploiting known vulnerabilities in public-facing applications, particularly Microsoft Exchange Server, or through initial access brokers. Once inside, attackers deploy remote management tools like *SimpleHelp*, *AnyDesk*, and *MeshAgent* for persistence, alongside the *Bring Your Own Vulnerable Driver (BYOVD)* technique to disable antivirus software using *KillAV* a tactic previously seen in BlackCat attacks. Other tools in Medusa’s arsenal include: - **PDQ Deploy** for lateral movement and payload delivery - **Navicat** for database access - **RoboCopy** and **Rclone** for data exfiltration - **Advanced IP Scanner** and **SoftPerfect Network Scanner** for reconnaissance - **Ligolo** and **Cloudflared** for command-and-control (C2) evasion The group also employs *living-off-the-land (LotL)* techniques, such as PowerShell commands (Base64-encoded to avoid detection) and *Mimikatz* for credential theft, alongside legitimate remote access tools like *ConnectWise* and *PsExec* to move undetected. ### **Evasion & Triple Extortion Risks** Medusa actors take steps to evade detection, including deleting PowerShell command histories and terminating endpoint detection and response (EDR) tools. In at least one case, a victim who paid the ransom was later contacted by a separate Medusa affiliate, who claimed the original negotiator had stolen the funds and demanded an additional payment suggesting a potential *triple extortion* scheme. ### **CISA Advisory & Historical Context** A joint advisory from CISA, the FBI, and MS-ISAC, released on March 12, 2025, revealed that Medusa has compromised over 300 critical infrastructure victims as of December 2024. The group, unrelated to *MedusaLocker* or the *Medusa mobile malware*, first appeared in June 2021 as a closed ransomware variant before shifting to an affiliate-based model. While affiliates execute attacks, core developers retain control over ransom negotiations. Recent campaigns have exploited vulnerabilities in *ConnectWise ScreenConnect (CVE-2024-1709)* and *Fortinet EMS (CVE-2023-48788)*. Despite the RaaS landscape’s volatility with new groups like *Anubis*, *LCRYX*, and *Xelera* emerging Medusa has established itself as a persistent threat, ranking among the top ransomware actors in late 2024.

725
low -25
CISSYMFBIFOR1768715192
Ransomware
Exploiting known vulnerabilities in public-facing applications Initial access brokers
Microsoft Exchange Server ConnectWise ScreenConnect (CVE-2024-1709) Fortinet EMS (CVE-2023-48788)
Financial gain Data extortion
Financial Loss: Ransoms ranging from $100,000 to $15 million Data Compromised: Sensitive data stolen before encryption Identity Theft Risk: High (due to data exfiltration)
Type Of Data Compromised: Sensitive data (including personally identifiable information) Sensitivity Of Data: High
CISA FBI MS-ISAC
Exploiting vulnerabilities in public-facing applications Initial access brokers
Exploitation of known vulnerabilities Use of remote management tools for persistence Living-off-the-land techniques
JUNE 2017
741
Breach
16 Jun 2017 • Federal Bureau of Investigation (FBI)
Alleged Unauthorized Media Leak by Former FBI Director James Comey Involving Daniel Richman

The FBI faced a high-profile breach involving unauthorized leaks of sensitive information tied to its investigation into Hillary Clinton’s private email server. Former FBI Director **James Comey** was indicted for allegedly authorizing **Daniel Richman**, a Columbia University law professor and former federal prosecutor, to act as an anonymous media source. The leak, investigated under **Operation Arctic Haze**, involved classified details appearing in a 2017 *New York Times* article, though no charges were filed against Richman or Comey for the leak itself. The incident stemmed from Comey’s 2020 Senate testimony, where he denied authorizing any FBI personnel to leak investigation details—contradicted by later revelations. While no direct data theft or financial loss occurred, the breach compromised the FBI’s operational integrity, eroded public trust, and triggered legal repercussions for Comey, including charges of false statements and obstruction. The case also highlighted political interference allegations, with Comey’s legal team arguing the prosecution was motivated by former President Trump’s personal vendetta. The reputational damage extended to the FBI’s credibility in handling politically sensitive investigations, reinforcing perceptions of institutional vulnerability to internal leaks and external manipulation.

684
high -57
FBI3562235102125
Unauthorized Disclosure Insider Threat Alleged Perjury
Human (Insider Trust) Lack of Oversight
Political Influence Media Narrative Control Disputed: Personal Vendetta (per Comey's defense)
Classified FBI Investigation Details (alleged) Internal FBI Communications (memos) FBI Credibility Undermined Internal Trust Erosion High (FBI & DOJ) Politicization of Law Enforcement Perjury Charges (Comey) Obstruction of Congress (Comey)
FBI 'Arctic Haze' Investigation (closed 2024) DOJ Inspector General Probe (2017–2019) Law Enforcement Notified: Internal (DOJ/FBI) Media Leak Investigation Internal Policy Reviews Policy Violations Identified (Comey) No Classified Info Leaked (per IG Report) Public Court Filings (Comey's Defense) Media Statements (Disputed)
Classified Investigation Details (alleged) Internal FBI Memos (Trump conversations) Sensitivity Of Data: High (Classified/Confidential) Media Leaks (New York Times, Wall Street Journal) Text (Memos) Investigation Notes
18 U.S. Code § 1001 (False Statements) FBI Media Contact Policies Indictment (Comey, 2024) Motion to Dismiss (Filed 2024-09-09) Senate Intelligence Committee (2017, 2020) DOJ Inspector General (2019)
Need for stricter insider threat monitoring in sensitive investigations Risks of politicized prosecutions undermining public trust Importance of precise testimony under oath to avoid perjury allegations Challenges in balancing transparency with operational security in high-profile cases
Enhance FBI media contact policies and enforcement Implement real-time monitoring for unauthorized disclosures in politically sensitive cases Conduct regular audits of insider access to classified investigation details Establish clearer guidelines for congressional testimony by law enforcement officials Depoliticize DOJ prosecutions involving former officials
["Ongoing (Comey's case); Closed (Arctic Haze, IG Probe)"]
Senate Intelligence Committee (2017, 2020 testimony) DOJ Office of Professional Responsibility FBI Office of Integrity and Compliance
Entry Point: Authorized Insider Access (Comey as FBI Director) Reconnaissance Period: 2016–2017 (Clinton investigation timeline) FBI Investigation Details (Clinton email server) Comey-Trump Memos
Lack of oversight for FBI director's media interactions Ambiguity in authorization processes for anonymous sources Politicization of law enforcement investigations Inadequate documentation of verbal authorizations FBI policy updates on media contacts (post-2017) DOJ Inspector General recommendations (2019) Enhanced training on congressional testimony for officials Stricter controls on dissemination of investigation memos
JANUARY 2017
797
Data Leak
01 Jan 2017 • Federal Bureau of Investigation (FBI)
FBI Website Data Breach by CyberZeist

Data on Pastebin was exposed by the infamous black hat hacker CyberZeist, who gained access to the FBI website FBI.gov. Account information, including names, SHA1 encrypted passwords, SHA1 salts, and emails, are contained in leaked documents. While professionals at the FBI worked to resolve the issue, the expert provided more details about the attack. The website administrators appear to have made some unfortunate mistakes. For instance, they left backup files on the same server, which allowed hackers to access them even if they chose not to publish them right away.

736
high -61
FED328131123
Data Breach
Exploiting backup files on the same server
Improper backup file storage
Names SHA1 encrypted passwords SHA1 salts Emails
Personal Information Credentials Sensitivity Of Data: High Data Encryption: SHA1
Improper storage of backup files on the same server can lead to data breaches.
Ensure backup files are stored securely and separate from primary servers.
Root Causes: Improper backup file storage Corrective Actions: Secure backup file storage practices

Frequently Asked Questions

According to Rankiteo, the current A.I.-based Cyber Score for Federal Bureau of Investigation (FBI) is 617, which corresponds to a Poor rating.

According to Rankiteo, the A.I. Rankiteo Cyber Score for December 2025 was 635.

According to Rankiteo, the A.I. Rankiteo Cyber Score for November 2025 was 633.

According to Rankiteo, the A.I. Rankiteo Cyber Score for October 2025 was 630.

According to Rankiteo, the A.I. Rankiteo Cyber Score for September 2025 was 627.

According to Rankiteo, the A.I. Rankiteo Cyber Score for August 2025 was 679.

According to Rankiteo, the A.I. Rankiteo Cyber Score for July 2025 was 678.

According to Rankiteo, the A.I. Rankiteo Cyber Score for June 2025 was 675.

According to Rankiteo, the A.I. Rankiteo Cyber Score for May 2025 was 673.

According to Rankiteo, the A.I. Rankiteo Cyber Score for April 2025 was 670.

According to Rankiteo, the A.I. Rankiteo Cyber Score for March 2025 was 668.

According to Rankiteo, the A.I. Rankiteo Cyber Score for February 2025 was 666.

Over the past 12 months, the average per-incident point impact on Federal Bureau of Investigation (FBI)’s A.I Rankiteo Cyber Score has been -37.0 points.

You can access Federal Bureau of Investigation (FBI)’s cyber incident details on Rankiteo by visiting the following link: https://www.rankiteo.com/company/fbi.

You can find the summary of the A.I Rankiteo Risk Scoring methodology on Rankiteo by visiting the following link: Rankiteo Algorithm.

You can view Federal Bureau of Investigation (FBI)’s profile page on Rankiteo by visiting the following link: https://www.rankiteo.com/company/fbi.

With scores of 18.5/20 from OpenAI ChatGPT, 20/20 from Mistral AI, and 17/20 from Claude AI, the A.I. Rankiteo Risk Scoring methodology is validated as a market leader.