Ahead of the Threat Podcast: Season 2, Episode 8—Frank Cilluffo

Ahead of the Threat: The FBI Cyber Podcast

The episode features a deep dive into the dual fronts of cyber enforcement and strategic policy with FBI officials and academic leaders. Host

Key takeaways

• IC3 reported over $21 billion in losses and more than 1 million complaints in its recent report, a 26% increase from 2024.
• Operation Level Up has successfully prevented over $630 million in losses by proactively warning victims of Southeast Asia scam centers.

Main topics

• FBI Operation Riptide
• Cyber-enabled fraud statistics

Notable quotes

No safe harbor.

Conclusion

The episode underscores that effective cybersecurity requires a synchr

Transcript preview

Speaker 2 (0:10) Welcome to another episode of Ahead of the Threat. I'm Brett Leatherman, Assistant Director of the FBI's Cyber Division. Later, I sit down with Frank Salufo, Director of the McCrary Institute for Cyber and Critical Infrastructure Security at Auburn University and host of the Cyber Focus podcast. Frank has spent his career on a question I keep coming back to, which is, How do you make cyber aggression cost enough to change an adversary's behavior? And how do you keep the systems Americans depend on running while you do that? But before that, the news. And this time, I've brought in a key partner from inside the FBI. The FBI is running a coordinated push against cybercrime and cyber-enabled fraud that drains the money from American families across the country, and we've directed significant resources towards that effort. So I've asked my partner in crime to sit down with me, and that is Heath Yonke, assistant director of the FBI's criminal division. Before his role as assistant director in the criminal division, he was SAC in the Phoenix division of the FBI. And prior to that, he was a section chief of the Cyber Criminal Operations Section out of Cyber Division, the team at headquarters that goes after cyber crime every day. He's worked these cases from the inside, and he brought that same cyber mission and perspective with him into the criminal division, where his portfolio goes from violent crime to public corruption to cyber-enabled fraud, among other things. So, Heath, welcome to the show. Speaker 1 (1:37) Hey, thanks, Brett. It's an honor to be here. I've watched the podcast since the very first episode back when I was in the Cyber Division with you all. And to finally get to be on here, this is great. So thanks for having me. Speaker 2 (1:49) Well, it's Speaker 1 (1:49) a Speaker 2 (1:49) good opportunity for you and I to talk through Operation Riptide, which is a campaign that we launched on June 9th. It runs the gamut from Cyber Division at headquarters, Criminal Division at headquarters to all 56 field offices and even globally leveraging our cyber legal attaches from around the world to work with international partners to impose cost on both cyber criminals and cyber-enabled fraudsters. So both our teams are working this. It really puts into action the priorities that the president set out in the executive order on cyber crime and fraud and in President Trump's cyber strategy for America. So from your perspective, as we started to talk about this, why now, in addition to the President's strategy, in addition to the EO that we talked about, why was now the right time to engage in Operation Riptide and to pull our resources together to combat this pervasive threat? Speaker 1 (2:43) Yeah, as I look across this, I think we need to frame it, first of all, when we're talking about fraud, cyber-enabled fraud, and the cybercriminal actors. And the one thing we use constantly is the IC. three reports. So we encourage all victims to go to IC3 and report their crimes to the FBI or being a victim of a crime. And when we look at the 2025 report that was put out in March, we saw that over $21 billion in loss had been reported to the FBI, and that was more than 1 million complaints. So we saw a 26 % increase. from 2024, both in those reporting and the amount of the loss. So one, we see that drastic increase. Two, the other part when we look at that is we can break that down into cyber-enabled fraud. And of the 21 billion, 17.7 billion was cyber-enabled fraud. So what we are seeing is the criminal actors, the ability for them to scale and to move quickly. has increased dramatically, which is leading to more Americans being fleeced every day of their life savings. And the ability for us now to come together as the whole of government under this executive order to do something more to target the actual criminal enterprises that are behind this. So it's the first time through this executive order of everyone brings their tools and their different techniques and their expertise. put together one joint mission with the U.S. government and working with private sector to target them. So that is the numbers in itself. Brett, you and I, we use data every day. We've got to make what our priorities are and then how we're going to use budgets and our resources to address them. Using this data from IC3 just shows this continues to escalate. And what we know behind every one of those million complaints, there's a real victim. This is our grandparents. This is a teenager that is being, you know, financially motivated sextortion going on. That every one of those million complaints is someone going through a very horrible situation in their life. So that's why this is so important for us to stop the fleecing of Americans and stop these transnational criminal organizations that are doing this. Speaker 2 (4:58) And we know it's gotten easier and easier with the prevalence of emerging technology for actors to be able to target individual Americans to fleece them of their life savings, but also to leverage ransomware and other cybercrime tools to extort companies out of significant money. And so one kind of theme that holds Operation Riptide together, it's kind of the slogan for Riptide, is no safe harbor. And we call it no safe harbor because It's important to demonstrate the work we do with our international partners overseas to really increase the ability to find the actors and hold them accountable wherever they sit. And so what does that mean for you when we talk about no safe harbor? Speaker 1 (5:40) You know, this is an international problem. That's why we work not only with our Five Eyes partners, but across the globe. We have law enforcement attachés working. I think it's in over 180 countries and developing those relationships within the country so that we can share intelligence and better target these networks. So for us, it is putting that constant pressure of wherever these organizations are, that one, we're holding them accountable, but two, making sure they know that they are being watched no matter where. they wanna conduct these frauds in the world. So while most of these frauds may be done by transnational organized crime groups overseas, they know there's no safe harbor for them there too. We will come and work with our partners to hold them accountable. Speaker 2 (6:23) and we'll talk about this a little bit later but no safe harbor applies to them as individuals their criminal organizations but also their money their infrastructure the tools that they use to target americans and so uh no safe harbor applies to anything we can reach within that criminal ecosystem that allows us to have an impact on the threat during these two months that we're operating in this sustain campaign, we're really targeting all of that. And so the second story today is one of yours out of criminal division and it's operation level up. The idea is easy to say, but kind of hard to do, right? It's rather than meeting a victim after the money is gone or after a fraud has occurred, we endeavor to find the people while the fraud is still happening or before it happens and get to them first. It's on the prevention side of what we do. Tell our listeners what Level Up is and where it stands right now. Speaker 1 (7:14) Yeah, so we're really predominantly talking about the Southeast Asia scam centers that are doing romance and crypto investment frauds. That's the highest amount of fraud we see ongoing right now. So we've got three pillars we look across of a prevent, disrupt, and dismantle. And that is where the whole government is focused right now. Under the prevent pillar, operation level up is the most impactful that we've seen. So basically it is as we are seeing an ongoing, crime happening with a victim, we go out and warn them and say, hey, this is happening. Please stop sending, wiring this money, going out and investing in Bitcoin, ATMs or kiosks and sending because we believe you are a target of a fraud. So we've gone out and this has started in 2024, but really during Riptide, we're putting even special emphasis on it. over this next 60 days, but we've been out to over 99,900 victims and have warned them. And what we found is 77 % of them were completely unaware that they were being targeted. And we've saved over 630 million. So by going out and doing this prevention, we've stopped them from sending over 630 million. The other devastating stat that I think about with Operation Love Love that we sometimes forget of. This has caused people to lose their entire life savings. They target our senior citizens for a number of reasons. It's a trusting community. They've had a life savings. They know it's there, often isolated. So they go after our senior citizens. And this has driven people to the point where they've wanted to take their own lives because they've lost everything and don't know what to do. by our agents and partners going out and doing these warnings. We've referred 97 victims to a critical suicide intervention services because we've found them in such desperation. So again, that shows the impact of what is going on. The other thing that we do with Level Up, not only warning, but we work with our private sector partners to take down the fraudulent investment platform domains. And just in the last month, when we did our recent sprint, on our strike force that targets the scam centers. We took down 584 fraudulent domains that were being used to target American victims. So again, we see that force multiplier of we're making this investment to go warn, to stop the fraud from going, but also taking down that infrastructure that is being used to facilitate it. And I think between cyber crime and cyber-enabled fraud, that's what we've seen, right? These groups will use the same type of infrastructure. whether it's a ransomware group or just a cyber-enabled fraud group, there's still pieces of the infrastructure or the key services they use that when the criminal division and the cyber division team up and we take those down, we're impacting a bunch of cyber cases and a bunch of criminal cases. And that's why our two divisions working in concert together, I think we've probably never had a closer relationship in how we're targeting this now, which means we're making a better impact every day for the American people. Speaker 2 (10:26) That's right. And three quarters, almost three quarters of a billion dollars prevented in going to these fraudsters. But more importantly. lives that haven't been devastated like we continue to see over and over because of the prevention of that money going over to these scammers. Incredibly important. And then looking at the mental after the mental health of victims as part of our victim pledge and promise, which is recognizing they are victims of criminal activity and trying to find them the help that they need as victims. And that that that's pervasive throughout how the. the FBI, whether it's the cyber division, criminal division, counterintelligence, or counterterrorism approach victims of crime. Talk a little bit about the field office, how the field offices lead this. You were in Phoenix as the special agent in charge for a little while, that Phoenix is part of the operation. We also have partnerships with Secret Service and others to help scale this effort out. It's only, it's less than two years old. So how has that progressed as an operation overall as time has gone on? Speaker 1 (11:26) Yes, we have a core group that's part of Operation Level Up that is working with different techniques to identify who the victims are. And then we actually have volunteers from every field office that sign up for a set period that every time essentially a lead comes in and it says, the group says, we think this person's being scammed. Can we go get a hold of them right away? People sign up and want to do this because we talk about a victim-centered approach and saving people in the FBI. So we've got people in every field office. When those leads come in, they make a phone call or go knock on a door to stop the fraud from occurring. And just recently, we've got all kinds of great stories of how this impacted. But one of the people we talked was getting ready to wire a million dollars when we made that phone call and stopped it. And we've got countless examples of those. of thank you to the FBI for letting me know this. I was just getting ready to do this, or I was getting ready to sell my house and wire these proceeds. So I just can't say enough. good work of what the field offices are doing and our partners. You, the Secret Service, has been with us from the beginning on this too, along with several private sector companies. But the work and dedication of going out to do this is just something we're proud of back here at headquarters. Speaker 2 (12:45) We talk about the IC3 reporting having gone up by 20 % or so in looking at that 20 billion number. That is significant, right? But that's probably well underreported. And so the number, that is people voluntarily going to IC3 and making a report, again, probably underreported, which means the number is probably significantly higher and significantly more lives are being devastated as a result of this. And that's why I think the administration has made such a priority here on targeting the scam centers that are behind this. And we've increased some partnerships in some unique countries as well that maybe we haven't been quite as latched up with before on this stuff. So as we kind of move forward here, how do you anticipate the law enforcement attaches playing into this whole model of prevention and working with and holding scam centers and individuals accountable outside the U.S.? Speaker 1 (13:43) I mean, that's a key component because the scam centers are overseas. So the criminal organizations are putting them in places where they know it may be harder for us to reach to. So just to give you an example, we've developed a relationship with the Royal Thai Police in Thailand who has been actively working on helping assist and to dismantle the compounds that are over there and to stop it. This is even more trickier because these criminal organizations are employing human trafficking victims that are the ones actually conducting So they're responding to a job notice where they think they are and they end up being a labor traffic victim, which just shows the complexity of this. Those that are actually on the keyboards talking to the Americans to fleece them are victims themselves in a forced labor situation. So everything that we do. here in the U.S. has to have that international component. And I only see that advancing because we're talking scam centers, but we still have the romance scams, the business email compromises, the tech support scams. All the things we've heard about for years aren't going down either. And even business email compromises, we thought that would probably go away. We would get those emails with misspellings. Now with AI and with voice cloning and all those things, It can actually sound like a phone call from the CEO saying to transfer this or it actually, the email is perfect. So AI is allowing them to scale more quickly and to do these frauds at a greater scale and just it looks like it's legitimate. So we're talking scam centers, but it's all throughout the world and the West African, Nigerian scams, all those things that we've talked about for years and years aren't decreasing either. Speaker 2 (15:25) Yep. I think that's a great point. We're going to all continue to face a scaled threat environment. So we've got to scale through those partnerships, international. domestic private sector to take the fight to the bad guys as much as we can. The Royal Thai Police, you mentioned them, during Operation Riptide, we were able to get a significant extradition from Thailand in the cyber crime program of an individual who allegedly conducted cyber attacks against the United States. So really, this has been a great operation so far. We're halfway through and we're looking forward to hopefully more extraditions and more accountability to actors here in the near future. But that takes me to our third story, because you talked a little bit about the infrastructure and targeting the ecosystem itself as well. And this is a good example. On the first day Riptide was announced, we also announced the takedown of FirstVPN. It was an FBI-supported international takedown of FirstVPN, which