Misconfiguration May Have Gotten FBI Network Hacked

According to reports, the FBI is investigating a case of malicious cyber activity on their network

"This is an isolated incident that has been contained. As this is an ongoing investigation the FBI does not have further comment to provide at this time."

CNN first reported on Friday of a cyber incident that involved a malicious actor hacking into a computer system used to investigate child sexual exploitation at the FBI's New York Field Office.

The FBI has not released further details regarding the recent cyber activity as the investigation is ongoing.

Attack might be related to email server hack

The FBI email servers were also hacked in November 2021 to distribute tens of thousands of spam emails, which impersonated FBI warnings. Emails reached at least 100,000 inboxes, although this is a very conservative estimate in comparison to the size of the attack. The FBI acknowledged this incident, explaining that a software misconfiguration temporarily allowed the threat actors to leverage the FBI's IT infrastructure to send fake emails.

​"The FBI is aware of a software misconfiguration that temporarily allowed an actor to leverage the Law Enforcement Enterprise Portal (LEEP) to send fake emails. LEEP is FBI IT infrastructure used to communicate with our state and local law enforcement partners," the FBI said at the time.

"While the illegitimate email originated from an FBI operated server, that server was dedicated to pushing notifications for LEEP and was not part of the FBI's corporate email service. No actor was able to access or compromise any data or PII on FBI's network."

Stay safe from these types of opportunistic attacks

This kind of vulnerability highlights the importance of maintaining a properly trained staff and setting up appropriate controls when it comes to software. A simple human error can carry catastrophic repercussions.

Let us train your staff and find the gaps in your security. Feel free to reach out to us here at MetaResolve at any time.