The FBI is working with the private sector and international partners to combat hacking attempts by Iran-linked cyber criminals who are attacking US digital infrastructure.
Jason Bilnoski, deputy assistant director of the FBI's cyber operations branch, spoke on recent hacks affecting water systems throughout the US during the Billington Cyber Security Summit in Washington on Tuesday.
"We don't work in silos any more," said Mr Bilnoski. He said that intelligence and leads on hackers were routinely shared between the FBI, international allies and the US private sector.
"It used to be one-way, unilateral sharing, but now the private sector is a stakeholder and the sharing is prolific."
The FBI official also said that the use of AI by nefarious cyber actors to maximise the efficiency of attacks is becoming a major problem around the world. "It's happening now, it's going to continue, it's going to increase," he said.
He added that under President Donald Trump's administration, the policy is not to simply stop and prevent cyber attacks, but to instil fear in those who contemplate such moves.
"We want to go after these adversaries with our partners and allies," he said, referring to Mr Trump's executive order that enables private-sector computer security companies to fight back against hackers.
David Liebenberg, leader of state-sponsored research threats at Cisco Talso, a division of Cisco, said AI was lowering the cost-of-entry barrier for would-be cyber criminals.
"It has a big psychological impact," he said, pointing out that the proliferation of sometimes less sophisticated attacks can still cause problems, even if there are no major consequences and the attacks are quickly halted.
While Iranian threats have taken centre stage for US cyber security in recent months amid the war between the two countries, Russia is also a major actor in the field.
Ukraine's deputy director of cyber security, Ivan Kalabashkin, said that Mr Trump's focus on stopping cyber criminals and hackers resonates with Ukraine as it faces "thousands" of cyber attacks in its continuing war with Russia.
"President Trump's administration has put it clearly and obviously in its cyber strategy: they want to detect, confront and defeat cyber adversaries," he said. He added that Ukraine has found it important to understand the mentality behind the attacks. "People tend to panic when they're faced with something they don't understand."
Ultimately, people, businesses and organisations could make a few simple changes to their cyber routines to ensure criminals cannot access sensitive information, or at least have a more difficult time doing so.
Mr Bilnoski stressed the need for multi-factor authorisation, being extremely careful with suspicious emails and making sure that certain devices remain offline, particularly those linked to critical infrastructure. "Those things help today, and they'll help tomorrow as cyber attacks continue," he said.
Iran cyber strikes against the US
Since the US and Israel attacked Iran at the end of February, technology analysts have said that Iran-backed cyber attacks against the US have spiked.
In March, Handala, which cybersecurity experts have linked to Iran, followed through on a threat to attack the FBI by hacking director Kash Patel's personal email and cloud services. It was later determined that Handala was behind a cyber attack against the Michigan medical technology company Stryker, which has more than 50,000 employees around the world.
One of Handala's more concerning hacks took place in June, when the group took credit for breaching the systems of California Water Service. The hackers published five gigabytes' worth of data from the breach as proof, but in an interesting twist, the group highlighted its restraint.
“Local sources in the US announced that as a result of this cyber intrusion, the water supply of around 20,000 customers in California was cut off,” Handala posted in a message on Telegram. It said that although it did breach Cal Water's systems, it did not cut off the water supply.
It added that the disruption occurred due to a “lack of technical knowledge among the cybersecurity experts” at the company. “Handala did not carry out any destructive operation in this incident, despite having the capability to do so,” it said.
