{{Short description|American law enforcement official}} {{Use mdy dates|date=November 2025}} {{Infobox officeholder | name = Brett Leatherman | image = Assistant Director Brett E. Leatherman.jpg | office = Assistant Director of the Federal Bureau of Investigation Cyber Division | term_start = June 2025 | predecessor = Bryan Vorndran }}
'''Brett Leatherman''' is an American law enforcement official who serves as Assistant Director of the Federal Bureau of Investigation (FBI)'s Cyber Division, a position he has held since June 2025.<ref name="Nextgov">{{cite news |last=DiMolfetta |first=David |title=FBI’s Brett Leatherman to take lead of bureau’s cyber division |url=https://www.nextgov.com/people/2025/06/fbis-brett-leatherman-take-lead-bureaus-cyber-division/405926/ |work=Nextgov/FCW |date=June 9, 2025 |access-date=November 9, 2025}}</ref><ref name="HSToday">{{cite news |title=Brett Leatherman Named Assistant Director of FBI’s Cyber Division |url=https://www.hstoday.us/subject-matter-areas/cybersecurity/brett-leatherman-named-assistant-director-of-fbis-cyber-division/ |work=Homeland Security Today |date=June 9, 2025 |access-date=November 9, 2025}}</ref><ref name="MeriTalk">{{cite news |title=FBI Taps Leatherman to Lead Cyber Division |url=https://meritalk.com/articles/fbi-taps-leatherman-to-lead-cyber-division/ |work=MeriTalk |date=June 9, 2025 |access-date=November 9, 2025}}</ref> A career FBI special agent with more than two decades of service, he previously served as Deputy Assistant Director for Cyber Operations and director of the FBI-led National Cyber Investigative Joint Task Force.<ref name="CyberScoop-AD">{{cite news |last=Johnson |first=Derek B. |title=FBI veteran Brett Leatherman to lead Cyber division |url=https://cyberscoop.com/fbi-cyber-division-brett-leatherman-assistant-director/ |work=CyberScoop |date=June 9, 2025 |access-date=November 9, 2025}}</ref> As Assistant Director, he leads the FBI's domestic cyber investigations and the bureau's response to state-sponsored intrusions attributed to China, Russia, Iran, and North Korea, as well as ransomware and other cybercrime threats.<ref name="CyberScoop-AD" /> He is also an adjunct professor at Georgetown University's Walsh School of Foreign Service.<ref name="HSToday" />
== Early life and education == Leatherman holds a Bachelor of Science in Business Administration and Computer Information Systems from Cornerstone University and a Master of Professional Studies in Cybersecurity Risk Management from Georgetown University.<ref name="HSToday" />
== Career == Leatherman began his FBI career in 2003 and has held assignments spanning counterterrorism, counterintelligence, criminal investigations, and cyber operations over more than two decades of service.<ref name="CyberScoop-AD" /><ref name="HSToday" />
In the FBI's Dallas Division, he served as Senior Supervisory Resident Agent of the Frisco Resident Agency, managing criminal investigations in North Texas, and later as Assistant Special Agent in Charge for National Security, where he oversaw counterterrorism, counterintelligence, weapons of mass destruction, and cyber programs across the division.<ref name="HSToday" /><ref name="CLM-Bio">{{cite web |title=Brett Leatherman |url=https://www.theclm.org/persondetails?id=81606 |website=The CLM |access-date=May 13, 2026}}</ref>
At FBI Cyber Division headquarters, Leatherman served as a Supervisory Special Agent in a cyber national security unit and then as Assistant Section Chief of the Cyber Operational Engagement Section, where he oversaw more than 50 personnel working to share cyber threat intelligence and mitigate threats to U.S. critical infrastructure.<ref name="HSToday" /><ref name="CLM-Bio" /> He was subsequently promoted to Section Chief for cyber national security operations, then to Deputy Assistant Director for Cyber Operations and director of the National Cyber Investigative Joint Task Force (NCIJTF).<ref name="CyberScoop-AD" /><ref name="CLM-Bio" />
Leatherman became Assistant Director of the FBI's Cyber Division in June 2025, succeeding Bryan Vorndran, after being selected for the role by FBI Director Kash Patel.<ref name="Nextgov" /><ref name="HSToday" /><ref name="MeriTalk" /><ref name="CyberScoop-AD" />
== Roles and responsibilities == As Assistant Director of the FBI's Cyber Division, Leatherman leads the bureau's domestic cyber investigations and oversees the FBI-led NCIJTF, which coordinates U.S. government cyber threat response across the intelligence community and federal law enforcement. He is responsible for FBI Cyber's work against state-sponsored intrusions attributed to China, Russia, Iran, and North Korea, as well as criminal ransomware and cybercrime groups, and oversees the bureau's engagement with private sector and international partners on cyber operations.<ref name="WaPo-SaltTyphoon" /><ref name="CyberScoop-AD" />
== Operations and initiatives == In February 2024, he gave a press conference announcing an international operation that disrupted the LockBit ransomware enterprise while serving as Deputy Assistant Director.<ref>{{cite web |title=FBI Cyber Deputy Assistant Director Brett Leatherman’s Remarks at Press Conference Announcing the Disruption of the LockBit Ransomware Group |url=https://www.fbi.gov/news/speeches-and-testimony/fbi-cyber-deputy-assistant-director-brett-leathermans-remarks-at-press-conference-announcing-the-disruption-of-the-lockbit-ransomware-group |website=fbi.gov |date=February 20, 2024 |access-date=November 9, 2025}}</ref>
In 2025, Leatherman led the FBI's public response to the "Salt Typhoon" campaign, a China-linked cyber-espionage operation targeting global telecommunications providers. The FBI and partner agencies issued a joint advisory in August 2025 disclosing that the campaign had affected entities in more than 80 countries, and Leatherman stated in interviews that the activity had been "largely contained" within U.S. telecommunications networks following extensive notification and remediation work.<ref name="WaPo-SaltTyphoon">{{cite news |title=FBI warns Chinese hacking campaign has expanded, reaching 80 countries |url=https://www.washingtonpost.com/technology/2025/08/27/fbi-advisory-china-hacking-expansion/ |work=The Washington Post |date=August 27, 2025 |access-date=May 13, 2026}}</ref><ref name="WSJ-SaltTyphoon">{{cite news |title=Chinese Spies Hit More Than 80 Countries in 'Salt Typhoon' Breach, FBI Reveals |url=https://www.wsj.com/politics/national-security/chinese-spies-hit-more-than-80-countries-in-salt-typhoon-breach-fbi-reveals-59b2108f |work=The Wall Street Journal |date=August 27, 2025 |access-date=May 13, 2026}}</ref><ref name="CyberScoop-SaltTyphoon">{{cite web |title=Top FBI cyber official: Salt Typhoon 'largely contained' in telecom networks |url=https://cyberscoop.com/top-fbi-cyber-official-salt-typhoon-largely-contained-in-telecom-networks/ |website=CyberScoop |date=July 2, 2025 |access-date=May 13, 2026}}</ref>
Leatherman has also discussed law-enforcement efforts against the cybercrime group known as Scattered Spider, including investigative progress and charging strategies in interviews during the RSA Conference in 2024.<ref name="Reuters-ScatteredSpider">{{cite news |last=Siddiqui |first=Zeba |title=FBI working towards nabbing Scattered Spider hackers, official says |url=https://www.reuters.com/world/us/fbi-working-towards-nabbing-scattered-spider-hackers-official-says-2024-05-10/ |work=Reuters |date=May 10, 2024 |access-date=November 9, 2025}}</ref>
In September 2025, the U.S. Department of Justice announced charges against Thalha Jubair, a U.K. national alleged to be a member of the Scattered Spider cybercrime group, in connection with attacks on critical infrastructure and other targets. Leatherman said the charges demonstrated that "no cybercriminal is beyond our reach."<ref name="DOJ-Jubair">{{cite press release |title=United Kingdom National Charged in Connection with Multiple Cyber Attacks Including Critical Infrastructure |url=https://www.justice.gov/opa/pr/united-kingdom-national-charged-connection-multiple-cyber-attacks-including-critical |publisher=U.S. Department of Justice |date=September 18, 2025 |access-date=May 13, 2026}}</ref>
In October 2025, Ukrainian national Oleksii Lytvynenko was extradited from Ireland to the United States on charges related to the Conti ransomware operation, in an action Leatherman described as demonstrating the strength of the FBI's international partnerships.<ref name="DOJ-Conti">{{cite press release |title=Ukrainian National Extradited from Ireland in Connection with Conti Ransomware |url=https://www.justice.gov/opa/pr/ukrainian-national-extradited-ireland-connection-conti-ransomware |publisher=U.S. Department of Justice |date=October 30, 2025 |access-date=May 13, 2026}}</ref>
In December 2025, the Justice Department announced indictments in the Central District of California charging Ukrainian national Victoria Dubranova for her roles in two Russian state-sponsored hacking groups: CyberArmyofRussia_Reborn (CARR), which the FBI assessed was directed and funded by Russia's GRU, and NoName057(16), a project administered in part by a Russian government information technology organization. The U.S. Department of State concurrently offered rewards of up to $2 million for information on CARR members and up to $10 million for NoName members. Leatherman said the FBI would use "all available tools to expose their activity and hold them accountable."<ref name="DOJ-CARR">{{cite press release |title=Justice Department Announces Actions to Combat Two Russian State-Sponsored Cyber Criminal Hacking Groups |url=https://www.justice.gov/opa/pr/justice-department-announces-actions-combat-two-russian-state-sponsored-cyber-criminal |publisher=U.S. Department of Justice |date=December 9, 2025 |access-date=May 13, 2026}}</ref>
In March 2026, the United States led a 14-country takedown of LeakBase, one of the world's largest online forums for buying and selling stolen data and cybercrime tools, in a coordinated effort hosted by Europol in The Hague. The FBI's Salt Lake City Field Office led the U.S. investigation, with prosecution by the Justice Department's Computer Crime and Intellectual Property Section and the U.S. Attorney's Office for the District of Utah. Leatherman said the operation removed "an easy point of access to stolen information on American businesses and individuals."<ref name="DOJ-LeakBase">{{cite press release |title=United States Leads Dismantlement of One of the World's Largest Hacker Forums |url=https://www.justice.gov/opa/pr/united-states-leads-dismantlement-one-worlds-largest-hacker-forums |publisher=U.S. Department of Justice |date=March 4, 2026 |access-date=May 13, 2026}}</ref>
In March 2026, speaking at the McCrary Cyber Summit, Leatherman described FBI Cyber's role in implementing the Trump administration's National Cyber Strategy, with emphasis on deterrence through law enforcement and intelligence authorities and the protection of critical infrastructure. He cited the FBI's use of offensive action to remove adversary capability and the importance of engagement with the FBI's 56 field offices to defend critical infrastructure through initiatives including Operation Winter Shield.<ref>{{cite news |last=Hansen |first=Weslan |title=Agencies Translate Cyber Strategy Pillars Into Operations |url=https://meritalk.com/articles/agencies-translate-cyber-strategy-pillars-into-operations/ |work=MeriTalk |date=March 17, 2026 |access-date=April 24, 2026}}</ref>
On April 15, 2026, two U.S. nationals, Kejia Wang and Zhenxing Wang, were sentenced in the District of Massachusetts for facilitating a Democratic People's Republic of Korea (DPRK) information technology worker scheme that used the stolen identities of more than 80 U.S. persons to obtain remote jobs at more than 100 U.S. companies, generating over $5 million in revenue for the North Korean government. Leatherman said U.S. nationals who facilitate such schemes "will face FBI investigation and potential prison time."<ref name="DOJ-DPRK">{{cite press release |title=Two U.S. Nationals Sentenced for Facilitating Fraudulent Remote Information Technology Worker Scheme that Generated $5M in Revenue for the Democratic People's Republic of Korea |url=https://www.justice.gov/opa/pr/two-us-nationals-sentenced-facilitating-fraudulent-remote-information-technology-worker |publisher=U.S. Department of Justice |date=April 15, 2026 |access-date=May 13, 2026}}</ref>
On April 20, 2026, Angelo Martino, a Florida-based ransomware negotiator employed by a U.S. cyber incident response firm, pleaded guilty in the Southern District of Florida to conspiring with the ALPHV/BlackCat ransomware group. Martino had provided BlackCat operators with the confidential negotiating positions and insurance policy limits of his employer's clients, and later conspired with two others to deploy ransomware against additional U.S. victims. Leatherman said the plea showed that "for all the international aspects of cybercrime, the threat is also here in the United States."<ref name="DOJ-Martino">{{cite press release |title=Florida Man Working as a Ransomware Negotiator Pleads Guilty to Conspiracy to Deploy Ransomware and Extort U.S. Victims |url=https://www.justice.gov/opa/pr/florida-man-working-ransomware-negotiator-pleads-guilty-conspiracy-deploy-ransomware-and |publisher=U.S. Department of Justice |date=April 20, 2026 |access-date=May 13, 2026}}</ref>
On April 27, 2026, Chinese national Xu Zewei was extradited from Italy to the United States to face a nine-count indictment in the Southern District of Texas charging him in connection with state-sponsored hacking directed by China's Ministry of State Security. According to the indictment, Xu and his co-conspirators targeted U.S. universities and researchers conducting COVID-19 vaccine and treatment research in 2020, and later participated in the HAFNIUM intrusion campaign, which exploited Microsoft Exchange Server vulnerabilities and compromised more than 12,700 U.S. organizations. Leatherman said the extradition demonstrated that the FBI's reach "extends well beyond U.S. borders" and credited Italy's Polizia Postale for the partnership that led to Xu's arrest in Milan, adding that other Chinese government contractors used to obscure the country's role in cyber operations face the same risk.<ref name="DOJ-Xu">{{cite press release |title=Prolific Chinese State-Sponsored Contract Hacker Extradited from Italy |url=https://www.justice.gov/opa/pr/prolific-chinese-state-sponsored-contract-hacker-extradited-italy |publisher=U.S. Department of Justice |date=April 27, 2026 |access-date=May 13, 2026}}</ref>
On April 7, 2026, the Department of Justice and the FBI announced Operation Masquerade, a court-authorized technical operation that disrupted a Domain Name System hijacking network operated by APT28 (also known as GRU Unit 26165), a unit of Russia's military intelligence service. GRU actors had exploited known vulnerabilities to compromise thousands of TP-Link routers used in small and home offices, redirecting traffic through GRU-controlled servers to harvest credentials and intelligence from targets in government, military, and critical infrastructure sectors. The FBI's court-authorized operation reset DNS settings on the compromised routers in the United States to sever the GRU's access. Leatherman described the operation as part of a series of disruptions targeting Russian government hackers dating to 2018, including VPNFilter, Cyclops Blink, and Operation Dying Ember.<ref name="CyberScoop-Masquerade">{{cite news |last=Starks |first=Tim |title=Inside the FBI's router takedown that cut off APT28's 'tremendous access' |url=https://cyberscoop.com/fbi-operation-masquerade-russian-gru-router-takedown-brett-leatherman/ |work=CyberScoop |date=April 9, 2026 |access-date=April 24, 2026}}</ref><ref name="DOJ-Masquerade">{{cite press release |title=Justice Department Conducts Court-Authorized Disruption of DNS Hijacking Network Controlled by a Russian Military Intelligence Unit |url=https://www.justice.gov/opa/pr/justice-department-conducts-court-authorized-disruption-dns-hijacking-network-controlled |publisher=U.S. Department of Justice |date=April 7, 2026 |access-date=May 13, 2026}}</ref>
== Public engagement == Leatherman has appeared in interviews and at public forums discussing cyber threats and law enforcement responses, including the ''Lawfare'' Podcast<ref>{{cite web |title=The Lawfare Podcast: How the FBI is Combating Cyberattacks, with Brett Leatherman |url=https://www.lawfaremedia.org/podcasts-multimedia/the-lawfare-podcast-how-the-fbi-is-combating-cyberattacks-with-brett-leatherman |website=Lawfare Media |date=March 28, 2024 |access-date=November 9, 2025}}</ref> and conferences such as the Aspen Cyber Summit,<ref>{{cite web |title=Aspen Cyber Summit — 2025 Speakers: Brett Leatherman |url=https://www.aspencybersummit.org/2025-speakers/brett-leatherman |website=Aspen Cyber Summit |access-date=November 9, 2025}}</ref> Boston College Conference on Cybersecurity,<ref>{{cite web |title=Boston Conference on Cyber Security — Speaker Bios |url=https://www.bc.edu/bc-web/schools/law/sites/boston-conference-on-cyber-security.html#speaker_bios |website=Boston College Law School |access-date=November 9, 2025}}</ref> Fordham University's International Conference on Cyber Security,<ref>{{cite web |title=International Conference on Cyber Security — Speakers & Panelists |url=https://www.fordham.edu/gabelli-school-of-business/faculty/research-centers/center-for-professional-accounting-practices/news-and-events/future-events/the-international-conference-on-cyber-security/speakers--panelists/ |website=Fordham University |access-date=November 9, 2025}}</ref> and RSA Conference.<ref>{{cite web |title=RSA Conference — Expert profile: Brett Leatherman |url=https://www.rsaconference.com/experts/brett-leatherman |website=RSA Conference |access-date=November 9, 2025}}</ref> He has also discussed artificial intelligence and cybercrime in media interviews.<ref>{{cite news |title=AI has leveled the field between cybercriminals and nation-state hackers, FBI official says |url=https://www.nextgov.com/cybersecurity/2025/10/ai-has-leveled-field-between-cybercriminals-and-nation-state-hackers-fbi-official-says/409202/ |work=Nextgov/FCW |date=October 30, 2025 |access-date=November 9, 2025}}</ref> Leatherman is an adjunct professor at Georgetown University's Walsh School of Foreign Service, where he teaches cyber operations.<ref name="HSToday" /> In January 2026, Leatherman became host of the FBI's ''Ahead of the Threat'' podcast at the start of its second season. The show features conversations with private sector executives, security researchers, and government officials on cyber threats and cybersecurity best practices.<ref>{{cite web |title=Ahead of the Threat Podcast: Season 2, Episode 0 — Brett Leatherman |url=https://www.fbi.gov/video-repository/ahead-of-the-threat-podcast-s2-ep0.mp4/view |website=Federal Bureau of Investigation |date=January 28, 2026 |access-date=April 24, 2026}}</ref>
== Media appearances == Leatherman was featured in the fourth episode of the eighth season of the Paramount+ docuseries ''FBI True'', "Held Captive in the Synagogue," which premiered on March 31, 2026, and recounted the January 2022 Colleyville synagogue hostage crisis, in which Leatherman led the FBI's counterterrorism response.<ref name="FBITrue-Episode">{{cite episode |title=Held Captive in the Synagogue |series=FBI True |network=Paramount+ |season=8 |number=4 |air-date=March 31, 2026}}</ref><ref>{{cite press release |title=Paramount+ Releases Official Trailer for Season Eight of FBI True |publisher=Paramount+ |date=March 12, 2026 |url=https://www.paramountpressexpress.com/paramount-plus/releases/?view=112542-paramount-releases-official-trailer-for-season-eight-of-fbi-true |access-date=April 24, 2026}}</ref><ref>{{cite web |title=FBI True: Season 8 |url=https://www.rottentomatoes.com/tv/fbi_true/s08 |website=Rotten Tomatoes |access-date=April 24, 2026}}</ref>
== See also == * Cybercrime
== References == {{Reflist}}
{{Authority control}} {{DEFAULTSORT:Leatherman, Brett}} Category:Living people Category:American law enforcement officials Category:Federal Bureau of Investigation agents Category:Year of birth missing (living people) Category:Place of birth missing (living people)