Lifetime Citizen Portal Access — AI Briefings, Alerts & Unlimited Follows
FBI launches Operation Winter Shield to push 10 practical cyber defenses
Loading...
Summary
Brett Leatherman, assistant director of the FBI Cyber Division, announced Operation Winter Shield, a two-month campaign that will highlight 10 immediate actions organizations can take to strengthen cyber defenses and connect them to real FBI cases. Resources are at fbi.gov/wintershield.
Brett Leatherman, assistant director of the Federal Bureau of Investigation Cyber Division, announced the launch of Operation Winter Shield, a two-month public campaign aimed at helping organizations defend against nation-state and criminal cyberactivity. "Winter Shield begins now," Leatherman said, directing listeners to fbi.gov/wintershield for guidance.
Leatherman said the initiative distills lessons from real FBI investigations, victims, and adversary behavior into 10 "high impact actions" organizations can adopt immediately to reduce risk. "These recommendations were developed with our domestic and international partners and reflect defensive gaps the FBI sees in nearly every breach we work," he said.
The announcement listed recurring attacker behaviors the FBI sees in investigations, including exploitation of known vulnerabilities, stolen credentials, end-of-life systems and risks introduced by third-party access. Leatherman also warned that incident response plans that "look great on paper" often "break down in practice," and said the campaign will connect each recommended defense to real cases to illustrate how threats operate.
The FBI plans weekly highlights during the two-month campaign, focusing on protections such as adopting phish-resistant authentication and managing third-party risk. Leatherman emphasized the effort is meant to "start a conversation and build measurable progress across industry, government, and critical infrastructure," not to demand perfection.
He cited recent sustained campaigns as examples of the threat environment, naming SolarWinds and operations identified as Volt Typhoon and Salt Typhoon. Leatherman contrasted those nation-state operations with criminal actors who steal funds and hold data for ransom, saying the aim is to "deny adversaries the digital real estate they need to operate and raise the cost of every attack."
The FBI made campaign materials available at fbi.gov/wintershield. The announcement was informational and did not announce any regulatory action or new legal authorities; it is a law-enforcement agency outreach and guidance effort targeted at businesses, hospitals, school districts and local governments.
