White House Greenlights Private Cyber Firms for Offensive Strikes on Criminal Networks

The Trump administration has authorized vetted private cybersecurity companies to conduct offensive operations against transnational cybercrime organizations under a presidential memorandum released late Wednesday. The directive enables these firms to partner with the Department of Justice and the Department of Homeland Security on targeted cyber operations against criminal groups running transnational fraud and predatory schemes targeting American citizens. All operations must receive written pre-approval from DOJ and DHS officials, and officials have pledged to block any action resulting in loss of life or operations that escalate to the level of armed attack under international law. To safeguard your own accounts against the same threat actors, run an email breach checker to confirm your credentials haven't already appeared in leaked databases exploited by these networks.

The memorandum builds on a March executive order directing federal agencies to adopt a more aggressive posture against cybercrime, which siphoned an estimated $20.8 billion from American consumers last year through ransomware, scams, and cyberattacks. National Cyber Director Sean Cairncross previously hinted at private-sector offensive cyber operations in March, and the latest document formalizes that policy direction. "By partnering with vetted United States companies subject to the direction and oversight of the Federal Government, we will enhance our ability to counter [Transnational Criminal Organizations] threats," the memorandum states, framing the initiative as a way to harness private-sector innovation that has historically been underutilized.

The policy document leaves unresolved several complex scenarios involving cybercrime syndicates with ties to nation-state actors. State Department officials have previously cited evidence linking Southeast Asian scam compounds—often operated by Chinese-organized gangs—to broader Chinese government initiatives, and recent DOJ indictments have named Cambodian and Myanmar government and military officials in connection with those operations. Because state-sponsored threat actors frequently overlap with financially motivated criminal infrastructure, any offensive response carries significant escalation risk. Security researchers and defenders can monitor exposure to these groups using a DNS leak test to ensure their network traffic isn't being routed through compromised infrastructure tied to known APT nodes.

The memorandum signals a notable expansion of the federal government's cyber toolkit by formalizing structured collaboration with private offensive operators, a role historically dominated by agencies like the NSA and Cyber Command. The fact sheet released alongside the document stresses that participating companies will operate under continuous federal supervision rather than independent action. For individual users and small businesses seeking to reduce their attack surface, running a privacy checkup can surface the kind of exposed credentials and metadata that criminal networks routinely aggregate before launching targeted campaigns.