FBI Director Wray Discusses Takedown Operations, Nation-State Hackers, and Escalating Cyber Threats

The Click Here podcast secured a rare one-on-one interview with FBI Director Christopher Wray in Munich, discussing the escalating threats in cyberspace. The conversation delved into recent operations targeting nation-state hackers, particularly those originating from Russia and China. This interview sheds light on the FBI’s efforts to address cybersecurity challenges and combat cyber threats posed by state-sponsored actors.

During his visit to Germany for the Munich Cyber Security Conference and the Munich Security Conference, FBI Director Christopher Wray highlighted the increasing threat of nation-state hacking operations. He specifically mentioned the bold actions of a China-backed group, Volt Typhoon, that had planted malware in crucial U.S. networks, and Russian cyber operatives associated with the GRU using common routers for phishing attacks and espionage in 50 countries. Wray expressed concern about the unprecedented cadence and tempo of such operations, emphasizing the evolving challenges in the cybersecurity landscape.

Christopher Wray, FBI Director, acknowledged his multifaceted focus on various threats, including cyber threats. In discussing the takedown of a GRU operation targeting routers globally during the Munich Security Conference, Wray highlighted active investigations in collaboration with partners. Operation Dying Ember targeted a botnet affecting small office and home office routers, where GRU hackers exploited another botnet for unauthorized access. Wray mentioned a court-authorized technical operation that disrupted their access, preventing further compromise.

Christopher Wray emphasized the FBI’s concern about foreign intelligence services, like the GRU, attempting to access information through routers. He stressed the proactive approach of getting “left of boom” in the cyber context, meaning they aim to prevent potential malicious actions rather than waiting to discover the adversaries’ intentions. Wray highlighted the importance of addressing threats before the adversaries can execute their plans. He also drew parallels between Operation Dying Ember and Operation Cyclops Blink during the early months of the war in Ukraine. In both cases, the FBI intervened before potential attacks were launched, emphasizing the importance of detecting and preventing access by nation-states to avoid harm to national security, personal security, or other interests. This proactive approach aims to address cyber threats before they escalate.

FBI Director Christopher Wray highlighted the increasing scale and intensity of nation-states trying to preposition, preserve, and gain persistent access, such as observed in the cases of Volt Typhoon (Chinese) and Dying Ember (Russian GRU). Drawing parallels with counterterrorism efforts, Wray emphasized the focus on prevention and disruption, aiming to interdict threats before they escalate. He stressed the importance of intelligence sharing and partnership in addressing cyber threats, referring to cyber as the “ultimate team sport.” Wray also noted the underestimated risk of persistent access in broader society.

FBI Director Christopher Wray emphasized the importance of addressing cybersecurity at both advanced and basic levels, highlighting the need to collectively get the fundamentals right. He underscored that even simple weaknesses could be exploited, as demonstrated by recent incidents involving Chinese actors. Wray mentioned the FBI’s strategy of joint sequenced operations with partners, including technical operations to disrupt and dismantle criminal infrastructure used by hostile intelligence services. He expressed confidence in the strategy and indicated a commitment to more collaborative operations in the future.