New Unit in the U.S. Department of Justice to Pursue Cyber Threats from Nation-State and State-Backed Hackers

The U.S. Department of Justice (DOJ) has established a new unit within its National Security Division to pursue cyber threats from nation-state and state-backed hackers. This unit is aimed at formalizing a crucial aspect of the national security apparatus into the DOJ’s hierarchy. The DOJ’s national security team will be able to increase the scale and speed of disruption campaigns and prosecutions of nation-state threat actors, state-sponsored cybercriminals, associated money launderers, and other cyber-enabled threats to national security.

The DOJ’s Pursuit Against Cyber Actors

The DOJ has been actively pursuing state-backed cyber actors, especially those in China or North Korea. The concerns over industrial espionage have been a longstanding problem for top government and corporate executives, particularly as Chinese companies look to develop equivalent technology, allegedly based on U.S. innovation or research. The Secretary of the Navy confirmed in the previous month that the Navy had been “impacted” by a China-backed hacking group that was seeking intelligence and data.

Despite the U.S. officials’ increasing attention towards Chinese cyber efforts, the announcement made no mention of it. This is in contrast to the U.S.’ top cybersecurity official, CISA Director Jen Easterly, who described Chinese cyber efforts as an “epoch-defining threat.”

Russian Malware and Ransomware Groups as a Threat

The announcement did underscore the threat posed by Russian malware and ransomware groups, which researchers and practitioners describe as potent but less coordinated and less strategic than incursions from China. While Chinese hacking groups gather intelligence and data, Russian and North Korean groups often extort their victims for profit, generating revenue for themselves or their governments. However, building cases against these groups can take years, and not always result in an arrest, given the far-flung nature of the hacking groups.

NatSec Cyber as an Incubator

The DOJ’s new unit, NatSec Cyber, will serve as an incubator, capable of investing in time-intensive and complex investigative work for early-stage cases, according to Assistant Attorney General Matt Olsen. This will allow the DOJ’s national security team to increase the scale and speed of disruption campaigns and prosecutions of nation-state threat actors, state-sponsored cybercriminals, associated money launderers, and other cyber-enabled threats to national security.

In summary, the DOJ has established a new unit, NatSec Cyber, within its National Security Division to pursue cyber threats from nation-state and state-backed hackers. The DOJ has been actively pursuing state-backed cyber actors, especially those in China or North Korea. The announcement did not mention Chinese cyber efforts, but it underscored the threat posed by Russian malware and ransomware groups. The DOJ’s new unit, NatSec Cyber, will serve as an incubator for early-stage cases, allowing the DOJ’s national security team to increase the scale and speed of disruption campaigns and prosecutions.