United States

This page covers cyber threats to the United States. It brings together US government advisories and statements (CISA, the FBI, the NSA, the Treasury, the White House), the FBI Internet Crime Complaint Center annual report, and Brandefense research. Brandefense has a US company, and the US is the largest ransomware market in our own data.

Threat groups that official sources link to the United States

Each group below has a profile in our threat group library. Attribution is stated as given by the named body.

Volt Typhoon: CISA, the NSA, the FBI and partners said on 7 February 2024 (AA24-038A) that PRC state-sponsored actors are seeking to pre-position themselves on IT networks for disruptive or destructive cyberattacks against US critical infrastructure. The US agencies confirmed that Volt Typhoon had compromised the IT environments of several critical infrastructure organizations, mainly in communications, energy, transportation systems, and water and wastewater, in the continental and non-continental US and its territories, including Guam.

Salt Typhoon: on 25 October 2024 the FBI and CISA said the US government was investigating unauthorized access to commercial telecom infrastructure by actors affiliated with the PRC. On 13 November 2024 they said these actors had compromised networks at multiple telecommunications companies. See the incident page below for more.

APT29: a CISA advisory (AA21-116A, last revised 26 April 2021) says the FBI and DHS/CISA assess that Russian SVR cyber actors, also known as APT 29, will continue to seek intelligence from US and foreign entities through cyber exploitation. On 15 April 2021 the US government formally named the SVR, also known as APT 29, Cozy Bear and The Dukes, as the perpetrator of the SolarWinds compromise.

APT28: a joint advisory from the UK NCSC, the NSA, CISA and the FBI (18 April 2023) says APT28 used infrastructure in 2021 to reach Cisco routers, including a small number in Europe, US government institutions and about 250 Ukrainian victims. The advisory assesses APT28 to be a unit of the Russian GRU.

Lazarus Group: an advisory from the FBI, CISA and the US Treasury (AA21-048A, last revised 15 April 2021) says Lazarus Group, which these agencies attribute to North Korean state-sponsored actors, is targeting individuals and companies, including cryptocurrency exchanges and financial service companies. It lists the United States among the countries targeted with AppleJeus malware since 2020.

Andariel: a joint advisory of 25 July 2024 (AA24-207A) describes Andariel as a North Korean state-sponsored cyber group. It says Andariel actors fund their espionage activity through ransomware operations against US healthcare entities.

LockBit: CISA advisory AA23-165A (14 June 2023) says the FBI counted about 1,700 LockBit attacks in the US since 2020, with about USD 91 million in ransoms paid. It also says that in 2022, 16% of state, local, tribal and territorial government ransomware incidents reported to the MS-ISAC were LockBit attacks.

Cl0p: the FBI and CISA advisory AA23-158A (7 June 2023) on Cl0p and the MOVEit vulnerability says that TA505, the group tied to Cl0p, is estimated to have compromised more than 3,000 US-based organizations and 8,000 organizations worldwide.

TA505: the same advisory (AA23-158A, 7 June 2023) says TA505 is estimated to have compromised more than 3,000 US-based organizations, and that in 2019 TA505 used Cl0p ransomware as the final payload of a phishing campaign.

Incidents on record

The incidents listed below are the major ones with national impact in the United States: Colonial Pipeline (May 2021), the SolarWinds Orion supply chain compromise (December 2020), Change Healthcare (February 2024), Salt Typhoon in telecommunications (2024) and the Treasury Department breach (December 2024). In the Colonial Pipeline case, the Department of Energy page says the company shut its pipeline system on 7 May 2021 after a ransomware attack, and the FBI confirmed DarkSide ransomware on 10 May.

For SolarWinds, the US Cyber Unified Coordination Group said about 18,000 customers were affected and that fewer than ten US government agencies had follow-on compromise. For Change Healthcare, the CEO told a House subcommittee that a criminal calling itself ALPHV or BlackCat deployed ransomware on 21 February 2024, and on 22 April 2024 the company said affected files could cover a substantial proportion of people in America. Smaller incidents are not listed. For other US cases, victims are described by sector.

How attackers target the United States: Brandefense research

This section only summarizes what our own research posts say about the US.

Ransomware. Our quarterly reports put the US at the top. The Q1 2024 report says the US accounts for more than half of ransomware attacks, at 55.1%. The Q2 2024 report gives 56.9%, and the Q3 2024 report gives 54.2%. The Q1 2026 report says nearly half of all ransomware victims are in the United States. Our report on US healthcare ransomware calls the sector one of the most critical targets for ransomware groups. Our Medusa analysis says the group buys initial access only in six countries, and the United States is one of them.

State-linked activity. Our post on living off the land describes Volt Typhoon as a PRC state-sponsored group active since mid-2021 that targeted critical infrastructure in Guam and elsewhere in the United States. Our APT41 profile lists the United States among its target regions, and our APT28 profile says the group has consistently targeted NATO, the EU, the United States and international organizations. On Iran, our APT33 post says the group has targeted aviation, energy and other sectors, mainly in the United States, Saudi Arabia and South Korea, and our APT35 post lists the United States, Israel and the Gulf States as countries of focus. On North Korea, our Silent Chollima post says the group breached defense and technology contractors in the United States and South Korea.

Supply chain. Our supply chain case study says the SolarWinds backdoor reached as many as 18,000 organizations, including US agencies such as the Department of Homeland Security and the Treasury. Our MOVEit news post says the breach likely began over the Memorial Day weekend in the United States, when monitoring is often at its lowest.

How Brandefense helps

Brandefense has a US company, Brandefense Inc.. In plain words, Cyber Threat Intelligence is how a security team learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins are for sale, and Phishing Monitoring is how it finds fake sites that copy its brand.

Law and national strategy

The White House released President Trump’s Cyber Strategy for America on 6 March 2026. It sets out the administration’s priorities in six policy pillars. The Office of the National Cyber Director was created by the National Defense Authorization Act for Fiscal Year 2021, and the National Cyber Director is the President’s principal adviser on cybersecurity policy and strategy.

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) requires CISA to write rules under which covered entities report covered cyber incidents and ransomware payments to CISA. CISA published its proposed rule in the Federal Register on 4 April 2024. CISA says it continues to work on the final rule, and that mandatory reporting under CIRCIA will not be required until the final rule takes effect.

How incident response is organized

CISA describes itself as the National Coordinator for Critical Infrastructure Security and Resilience, and says it leads the national effort to understand, manage and reduce risk to cyber and physical infrastructure. It lists 16 critical infrastructure sectors. The FBI runs the Internet Crime Complaint Center (IC3), the central hub for reporting cyber-enabled crime. In the Colonial Pipeline case, the Department of Energy page says its Energy Response Organization was activated to coordinate with industry, other agencies and states.

Sectors and rating

The FBI IC3 2025 annual report says losses reported to IC3 in 2025 passed USD 20 billion, and that IC3 now averages almost 3,000 complaints a day. It says ransomware is among the highest reported cyber threats to critical infrastructure organizations, that IC3 received more than 3,600 ransomware complaints in 2025, and that the top ten ransomware variants most affected critical manufacturing, healthcare and public health, and government facilities.

The official sources opened give reported complaints and losses, not a full count of attacks. Figures will come from Brandefense Atlas.