The Justice Department on Tuesday said it has seized infrastructure tied to what officials called one of the world’s most prolific criminal marketplaces, used to commit cyber scams and other crimes.

The seized cloud computing account hosted backend infrastructure used by subsidiaries of the Huione Group, a Cambodia-based corporate conglomerate.

At the same time, the Treasury Department announced fresh sanctions and more against Huione and affiliated companies. The administration actions Tuesday add to disruption efforts from last fall against pieces of the same network.

The Trump administration has placed an emphasis on combating transnational cybercrime and other kinds of scams and fraud.

The seized cloud computing account was used to operate Huione Guarantee, also known as Haowang Guarantee, according to Tuesday’s DOJ announcement.

“The Huione Group used this cloud computing account as part of a technological backbone that allowed billions in fraud proceeds to be transferred, moved, and concealed — much of it stolen through Southeast Asian scam centers,” said Tysen Duva, assistant attorney general of the Justice Department’s Criminal Division. “Seizures of these marketplaces is critical in the fight against fraud that affects so many Americans, and to stop avenues for criminal proceeds to be laundered.”

U.S. officials allege that Huione Guarantee operated Telegram channels with discussions about illicit goods and services, including the sale of stolen credit card and sensitive personal information, malware-enabled thefts, human trafficking schemes and the laundering of money from romance and investment scams. Huione Guarantee also allegedly offered escrow services for criminals such as money launderers for cryptocurrency.

Treasury took two steps Tuesday to build on its move in October to sever Huione Group from the U.S. financial system. One was to tack H-Pay Service onto its rule for Huione Group as a successor entity. And it slapped nine people and 26 entities linked to Prince Group with sanctions.

“Huione Group served as a critical node for laundering proceeds of cyber heists and virtual currency investment scams and was used by the Prince Group to transfer and consolidate scam-derived assets,” Treasury’s announcement states.

Also last October, the Justice Department said it seized bitcoin valued at $15 billion from the chairman of the Prince Group, Chen Zhi, and indicted him over alleged cryptocurrency crimes and other schemes. 

An alleged key figure in Chen’s criminal network has been arrested in Cambodia and extradited to China.

The post Justice Department seizes infrastructure used by cyber scam and criminal marketplace appeared first on CyberScoop.

The Trump administration issued a revised executive order Tuesday focused on artificial intelligence, offering a significantly pared-back vision for the federal government’s role vetting AI systems compared with a draft version that was spiked weeks ago.

The order keeps in place the administration’s largely voluntary framework for companies to engage with the federal government around testing new models before release, but appears to considerably weaken or loosen provisions that had been opposed by industry.

Under the order, AI companies would voluntarily provide the federal government access to frontier models before release, but now it will be for “up to” 30 days instead of the 90-day timeline included in previous drafts.

It also explicitly states that nothing in the program will be construed as mandatory or part of a federal licensing or permitting regime, and gives AI companies significant influence to help define what models would and would not be covered under for testing.

It also states that all federal testing and access to the models would be subject to “confidentiality, cybersecurity, insider-risk, and intellectual-property protection, use, and nondisclosure requirements.”

Section one of the order highlights the central friction that has plagued the Trump administration’s AI policy since assuming power: While the White House increasingly sees national security implications in the rapid release of frontier models from the private sector, it has also been one of the loudest critics of regulating the technology for fear it could harm American businesses.

“The United States continues to lead the world in Artificial Intelligence (AI) because of the enormous talent and innovation of our AI industry, and because we refuse to stifle this innovation with overly burdensome regulation,” the order reads.

That argument was bolstered in recent days as industry members and top advisers to Trump, like tech investor and AI czar David Sacks, lobbied against previous draft language, arguing it would put too much of a regulatory burden on U.S. businesses.

On X, Sacks called the revised EO, including changes reducing the government’s access from 90 days to up to 30 days “a game changer” because it would allow frontier labs to comply without delaying new model releases. He also said the discussions he’s had with the White House indicate that not all new model releases would be subject to even that level of scrutiny.

The White House characterization that the order is not a program for conducting oversight of all new AI models “is completely consistent with the discussions that I have participated in, where it was agreed that the EO is intended to apply only to models that represent a meaningful step-change in cyber capabilities (eg Mythos), not to incremental version numbers of existing models,” Sacks wrote.

The order also puts the Department of Treasury at the head of a new interagency cybersecurity clearinghouse on AI, where the private sector, critical infrastructure operators and federal agencies voluntarily collaborate to coordinate and deconflict scanning for software vulnerabilities, discovery and validation and remediation activities, like patching.

Treasury, the Cybersecurity and Infrastructure Security Agency, the NSA, the Office of the National Cyber Director and other agencies would also be responsible for developing classified benchmarks that would be used to identify or flag the kind of advanced cyber and hacking capabilities that agencies are interested in testing.  

Questions linger over implementation, politicization

Consisting of less than 1200 words, the directive is vague in many areas about exactly how implementation will work.

“On frontier capability access, vulnerability discovery for critical infrastructure, and sharing with trusted partners, many questions remain,” wrote American Enterprise Institute fellow Ryan Fedasiuk.

Senator Mark Warner, D-Va., said the order would help the White House “begin to grapple” with the threats that new frontier models and their hacking capabilities pose to critical infrastructure and praised certain provisions, like putting the NSA in charge of classified testing of new models. But he was also sharply critical of the administration’s about face on the need for federal scrutiny of emerging AI technologies.

“Once again, the Trump administration has belatedly discovered the need to redo something it hastily dismantled in its first year,” Warner said in a statement. “While this course correction – a rehash of proposals contained in the last administration’s 2023 executive order, bipartisan congressional legislation, and each of the last three years of intel authorization bills the Senate Intel Committee has passed – can begin to grapple with widespread impacts that new frontier models will have on our critical infrastructure, it can’t undo the years wasted on dismantling some of the most vital pillars of our nation’s cybersecurity response, including key information sharing initiatives and the federal agency established to protect the security of U.S. critical infrastructure.”

Warner also said he will be “watchful” for indications the administration may politicize any testing regime, for instance, such as using the partnerships “to pressure U.S. firms into making changes to their products or Terms of Service to suit partisan or legally questionable objectives of the president and his allies.”

The administration’s lighter touch approach around voluntary testing yielded approval from some experts who have traditionally been more in favor of regulation, but who also expressed similar worries about the downsides of putting the federal government in charge of vetting AI models.

Samir Jain of the Center for Democracy and Technology, said that while AI models pose real cybersecurity threats to critical services, the order “attempts to avoid the deeply concerning implications of a mandatory licensing regime for release of new models.”

“Testing and benchmarking programs are important to promote cybersecurity and address other risks,” Jain said in a statement. “However, the EO should not become a mechanism for the Administration to punish companies for political or other arbitrary reasons, and so we will be closely monitoring the details of its implementation as they emerge.”

You can read the full order on the White House’s website.

The post Trump administration releases scaled-back AI executive order appeared first on CyberScoop.

President Donald Trump said he would postpone the release of an executive order that would set up a 90-day testing and vetting regime for frontier AI models, hours before the White House was set to publicly announce the signing. 

Speaking to reporters in the Oval Office Thursday, Trump said he opted to delay the order “because I didn’t like certain aspects of it” and expressed concerns that it could harm U.S. AI industry competition with countries like China. 

According to multiple sources, a draft version of the order circulating in the last 24 hours would have set up a voluntary testing regime between the U.S. federal government and frontier AI companies that would allow the government to study new models for 90 days before they’re publicly released. In addition to the government, the draft order would also facilitate access to the models for cybersecurity testers in critical infrastructure sectors, like finance and healthcare.

The draft order empowered the National Security Agency to conduct classified evaluations of frontier AI models, while the Department of the Treasury would have set up a new information sharing agreement between AI companies and cybersecurity defenders in critical infrastructure.

Other agencies, like the Office of the National Cyber Director, the Cybersecurity and Infrastructure Security Agency and the National Institute for Standards and Technology, would also be involved in defining which models are covered under the vetting regime.

In some sense, the order would formalize an already cooperative relationship between AI companies and governments like the U.S. and UK, where tech-focused agencies and regulators have already been provided access to previous models ahead of their release for testing and evaluation. 

A former federal official who has seen the latest draft circulated before Thursday’s announcement told CyberScoop that based on their conversations with the administration, the order was intended to facilitate more robust testing from government agencies compared to evaluations conducted for previous models. They said that is in part a reflection of the federal government’s maturing understanding of AI technology over the past five years.

“In the past there has been containerized optionality for the intelligence community and others to take a look at things, but it was really a lot of hand holding [from AI companies] and self-explanation of what they expect this thing to do,” said the official, granted anonymity to discuss sensitive conversations with the administration. “And now the government is coming forward and saying now we feel we’re prepared enough for you to just give us your tool…and we’ll go from there.”

But it also represents a stark pivot by the Trump administration, which came into office openly dismissive of AI safety policies and arguing that they would inhibit U.S. industry. Trump’s latest comments in delaying the order echo those same attitudes. 

The former official said that while the Trump White House doesn’t view its mission as telling AI companies “don’t develop AI that can do X, which was perceived to be the previous administration’s role,” they also acknowledged the administration’s early rhetoric on AI regulation has painted them into a corner. 

“I think the biggest challenge the administration has is that their tone was ‘no institution of guardrails’ and they don’t have a better word for making sure that the capabilities of emergent frontier models don’t disrupt security than to say ‘let’s test it and institute guardrails,’” the official said.  

While debate about how best to regulate AI-related harms continues, most agree there are genuine national security concerns around the technology.

Ram Shankar Siva Kumar, founder of Microsoft’s AI red team, told CyberScoop that in 2019, his staff consisted of himself and a few other security and machine learning specialists. Now a much larger staff of technologists are supported by specialists in psychology, linguistics, bioweapons and other fields.

“Because of frontier harms, what we have done has really morphed,” Siva Kumar said.

The United States, along with Israel, Russia, Ukraine and others have already deployed AI in targeted military operations or integrated the technology into their larger command and control structure. AI is being used to supercharge drone warfare, global hacking campaigns, and sophisticated surveillance and targeting of military personnel and civilians, imbuing the engineering choices of frontier AI companies with life and death consequences.

Some congressional members who previously opposed allowing AI to make autonomous kill decisions on the battlefield have been reconsidering their position.

Rep. Don Beyer, D-Va., who co-chaired the Congressional AI Caucus and was appointed to a bipartisan AI task force in 2024. said that while he thinks “we need to guard against dehumanizing” those decisions, he also worries that adversarial countries will use the same technology against the United States.

“It’s like if we say that Americans have to have a human in the loop and the Chinese don’t have to have a human in a loop, the non-human one will beat the human one every time,” Beyer said at an AI conference in Washington D.C. earlier this month.  

Meanwhile, experts have been increasingly concerned about the technology’s impact on cybersecurity, as current models are remarkably good at finding software bugs and vulnerabilities, while newer models like Anthropic’s Mythos and OpenAI’s Daybreak are capable of chaining together multiple exploits to conduct more sophisticated attacks.

While state-sponsored hackers are experimenting with the technology and using it to gain targeted efficiencies in their hacking operations, cybersecurity experts in the private sector and law enforcement agencies say the technology has mostly benefitted cybercriminals and scammers.

The post Trump postpones executive order focused on AI security  appeared first on CyberScoop.

Federal Chief Information Officer Greg Barbaccia said Tuesday the government is approaching Anthropic’s Mythos model with measured expectations, acknowledging both its potential to strengthen federal cyber defenses and the significant uncertainties that remain about how it would perform in real-world conditions.

Barbaccia said his direct exposure to Mythos has been limited to evaluations and benchmarking tests, and that no federal agencies have deployed it yet. While he says the Office of the National Cyber Director is coordinating the government’s approach, his broader assessment of where AI-assisted cybersecurity is heading was direct.

“We’re going to get to a world soon where AI defense will be able to catch up,” Barbaccia told CyberScoop on Tuesday at the Workday Federal Forum, produced by Scoop News Group. “We must get to a point where the bots are finding the bots.”

Earlier this month, Barbaccia sent an email to cabinet agencies to inform them that the Office of Management and Budget has started laying the groundwork for a controlled rollout of the model to federal agencies.

His framing reflects a view that the same capabilities making Mythos a potential offensive threat are precisely what make it valuable as a defensive tool. Anthropic has said the model identified thousands of previously unknown, high-severity vulnerabilities across major operating systems and web browsers during testing, many of them decades old. The question for federal security teams is not whether those capabilities are real, but whether they translate from controlled laboratory settings to the complex, defended networks that government agencies actually run.

Barbaccia was candid about that gap. 

“I think it’ll uplevel people and make a novice cybersecurity offensive operator more efficient,” he told CyberScoop. “But the jury is still out on how effective it’ll be against real-world conditions, meaning a network that’s guarded by human defenders that has alerting and things like that. The evaluations I’ve seen have been laboratory learnings.”

That distinction matters for federal security teams weighing how to think about the model. Finding a vulnerability and successfully exploiting it in a defended environment are different problems. Barbaccia pointed to the CVE catalog, the government’s running list of known software flaws, as one area where the model’s speed could have practical value. A human analyst working through that catalog would take considerable time. A model like Mythos could move through it far faster. But speed alone does not determine whether a vulnerability poses an actual threat.

“There’s a difference between something that is exploitable in a 4-nanosecond window during a BIOS boot versus what’s the reality of that being exploited in the real world,” he said. “We have to understand, just like you could secure your entire threat surface, where are the crown jewels? And how do you protect something, and make sure the protection you’re deploying is worthwhile what you’re protecting.”

That kind of thinking is familiar to federal network defenders, who operate under resource constraints and must triage which vulnerabilities to address first. What Mythos potentially changes is the speed at which that triage can happen, and the depth at which vulnerabilities can be identified before an adversary finds them.

Barbaccia said the CIO Council, which coordinates technology policy across civilian agencies, is still in the early stages of understanding what the model could mean for enterprise security environments. “Everybody’s just curious to learn a lot more,” he said.

Agencies have tried on their own to obtain access to Anthropic’s model. The Department of the Treasury has asked for access, according to reports. CISA, the agency responsible for securing, monitoring, and defending civilian agency networks, has not been granted access.

The post Federal CIO cautious on Anthropic’s Mythos despite planned rollout appeared first on CyberScoop.

Lawmakers at a hearing Tuesday explored ways to beef up punishments for ransomware attacks against hospitals, possibly by labeling them as more severe crimes.

One proposal floated at the House Homeland Security Committee hearing, to treat ransomware attacks as terrorism, is an idea Congress has flirted with before. Another would be to press prosecutors to pursue homicide charges in attacks on hospitals where death resulted — something German authorities also once pondered.

A former top FBI cyber official, Cynthia Kaiser, put forward both ideas at the hearing, a joint meeting of the subcommittees on Border Security and Enforcement and Cybersecurity and Infrastructure Protection on cybercrime, drawing questions and interest from members.

“I believe there are no penalties too severe for individuals that would target our health care system,” said Mississippi Rep. Michael Guest, chair of the border subcommittee, whose home state of Mississippi’s health care clinics closed following a February ransomware attack.

The suggestions stem from a growing focus by ransomware attackers on the health care sector, with incidents doubling from 238 in 2024 to 460 in 2025 according to FBI statistics, making it the top targeted sector.

Kaiser, now senior vice of the Halcyon ransomware research center, said terrorism designations from the State, Treasury and Justice departments could lead to further sanctions, restricted travel and other punishments. Justice Department guidance on homicide charges could clarify its authorities, she said.

“It sounds like the language is there, it just has not been applied in these circumstances,” said Rep. Lou Correa of California, the top Democrat on Guest’s subpanel.

The notion of more closely entwining cyberattacks and terrorism is something both Congress and the executive branch have examined recently.

The fiscal 2025 Senate intelligence authorization bill would have directly linked ransomware to terrorism, although the final version of the bill that became law was less explicit than the original Senate language. The Treasury Department last month asked for public feedback on changing a terrorism risk insurance program to address cyber-related losses.

A University of Minnesota study from 2023 estimated that hospital ransomware attacks were responsible for dozens of deaths of Medicare patients. German authorities in 2020 opened a negligent homicide investigation following a death in the aftermath of a ransomware attack, but ultimately decided against charges.

The Trump administration’s national cyber strategy advocates for taking a more offensive approach to hackers. It released an executive order on cybercrime and fraud the same day it published the strategy. Kaiser said the proposals are in line with those approaches.

Hackers know their attacks could end lives, she said. “They have simply decided these deaths are someone else’s problem,” Kaiser said.

The post Lawmakers ponder terrorism designations, homicide charges over hospital ransomware attacks appeared first on CyberScoop.

The Treasury Department is soliciting public feedback on whether it should change a terrorism risk insurance program to address cyber-related losses.

In a Federal Register notice set for publication Wednesday, Treasury seeks comment from the public for a mandatory report it must deliver to Congress this summer on the effectiveness of the terrorism risk insurance program (TRIP) created by the 2002 Terrorism Risk Insurance Act. That law arose from the Sept. 11 terror attacks and provided a federal backstop to make terrorism risk insurance more available and affordable.

Some experts have suggested that the cyber insurance industry should also get a federal backstop as the industry struggles to develop fully. With the law set to expire at the end of 2027, tying it to the reauthorization of the terrorism risk insurance law could be one way to get Congress to create such a cyber backstop.

Among the topics Treasury hopes commenters will address before it sends the report to Congress in June is the interaction between the terrorism risk insurance law and program, and cybersecurity. The agency will accept comments until May 8.

That includes: “Any potential changes to TRIA or TRIP that would encourage the take up of insurance for cyber-related losses arising from acts of terrorism as defined under TRIA, including, but not limited to the potential modification of the lines of insurance covered by TRIP and revisions to any of the current sharing mechanisms for cyber-related losses, such as, for example, the individual insurer deductible or the federal share percentage.”

In 2021, Treasury issued a rule making it clear that TRIP could cover cyber losses when written in a TRIP-eligible line of insurance. However, a Government Accountability Office report last year outlined some of the limitations there.

“Because TRIA was designed specifically as a federal backstop for losses from acts of terrorism, only losses from cyberattacks certified by Treasury as acts of terrorism would have TRIA coverage,” it states. “As a result, even large cyberattacks that result in catastrophic losses would not be covered under TRIA if they were not certified as acts of terrorism.”

Treasury said in its Federal Register notice that it wants feedback on cyber-related terrorism losses within TRIP and losses outside of it.

Cyberattacks would need to meet definitions under the terrorism risk insurance law to be certified. They need to be violent or otherwise dangerous to life, property or infrastructure, and designed to influence the U.S. population or government. Damage to U.S. organizations outside the United States still might not qualify.

Medical device maker Stryker recently suffered a wiper attack, with the pro-Palestinian, Iranian government-linked group Handala taking credit. It said the attack was in retaliation for U.S. and Israel military strikes against Iran, specifically a U.S. missile strike on a school that killed 175 people, according to Iran’s government.

The post Treasury asks whether terrorism risk insurance program should bolster cyber coverage appeared first on CyberScoop.