State Department offers $10 million for tips on foreign hackers
State Department seeks to rein in the growing risk of ransomware attacks

On Thursday, the US government announced up to $10 million in rewards for tips leading authorities to malicious hackers working at the behest of foreign governments to target US infrastructure.
The US State Department said “certain malicious cyber operations targeting US critical infrastructure may violate the CFAA (Computer Fraud and Abuse Act)” and it “set up a Dark Web (Tor-based) tips-reporting channel to protect the safety and security of potential sources.”
According to The Associated Press and Reuters, a White House task force will coordinate efforts to fight the rising scourge of ransomware.
A new federal government website, stopransomware.gov, offers the public resources for countering the threat and building more resilience into networks.
The Treasury Department also announced its Financial Crimes Enforcement Network would work with banks and tech companies on anti-money-laundering (AML) efforts involving cryptocurrency. They will also focus on more rapid ransomware payment tracing.
Investigators hope to seize more extortion payments in ransomware cases, like the Department of Justice did in May when it recovered about $2.3 million of the ransom paid in the Colonial Pipeline hacking case.
The new rewards for tips in ransomware cases will come from the State Department, which will put a tip-reporting mechanism on the dark web to protect sources who might identify cyber attackers and their locations. The reward payments may include cryptocurrency.
Get the ITPro daily newsletter
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
RELATED RESOURCE
TA551/Shathak threat research
A detailed report on the cyber crime group and its attacks
Administration officials wouldn’t comment on whether the government had a hand in Tuesday’s online disappearance of REvil. This Russian-linked gang just launched a massive ransomware attack against Florida-based software provider Kaseya, which reportedly affected 1,500 businesses.
According to The Associated Press, The White House updated lawmakers Wednesday on the administration’s response to the recent rash of high-profile ransomware attacks, a threat it has deemed a national security priority.
Sen. Angus King, an independent from Maine, said he was impressed with the “thoroughness with which they are confronting this issue,” particularly with outreach to the private sector.
-
Cleo attack victim list grows as Hertz confirms customer data stolen
News Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
By Ross Kelly
-
Lateral moves in tech: Why leaders should support employee mobility
In-depth Encouraging staff to switch roles can have long-term benefits for skills in the tech sector
By Keri Allan
-
Cleo attack victim list grows as Hertz confirms customer data stolen – and security experts say it won't be the last
News Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
By Ross Kelly
-
‘Phishing kits are a force multiplier': Cheap cyber crime kits can be bought on the dark web for less than $25 – and experts warn it’s lowering the barrier of entry for amateur hackers
News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
By Emma Woollacott
-
Healthcare systems are rife with exploits — and ransomware gangs have noticed
News Nearly nine-in-ten healthcare organizations have medical devices that are vulnerable to exploits, and ransomware groups are taking notice.
By Nicole Kobie
-
Alleged LockBit developer extradited to the US
News A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
By Emma Woollacott
-
February was the worst month on record for ransomware attacks – and one threat group had a field day
News February 2025 was the worst month on record for the number of ransomware attacks, according to new research from Bitdefender.
By Emma Woollacott
-
CISA issues warning over Medusa ransomware after 300 victims from critical sectors impacted
News The Medusa ransomware as a Service operation compromised twice as many organizations at the start of 2025 compared to 2024
By Solomon Klappholz
-
Warning issued over prolific 'Ghost' ransomware group
News The Ghost ransomware group is known to act fast and exploit vulnerabilities in public-facing appliances
By Solomon Klappholz
-
The Zservers takedown is another big win for law enforcement
News LockBit has been dealt another blow by law enforcement after Dutch police took 127 of its servers offline
By Solomon Klappholz