Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Short answer: On March 29, 2022, FBI Cyber Division chief Bryan Vorndran told the House Judiciary Committee that Russia posed a serious threat to the United States and that Russian scanning of critical infrastructure had increased. He described this as an “absolute strategic warning” about Russian intent—not as confirmation of a specific successful attack. Later joint advisories and public statements involved additional U.S. and allied agencies and addressed espionage, influence operations and phishing campaigns.
What the FBI warned about on March 29, 2022
Cyber Division Assistant Director Bryan Vorndran gave the warning during testimony before the House Judiciary Committee. He called Russia a “formidable foe” and said the bureau had seen an increase in Russian scanning of U.S. critical infrastructure.
Vorndran’s central statement was:
“We have an absolute strategic warning that Russia plans to hit us. We will do our best among our interagency partners to provide more real-time updates as we already have for specific sectors.”
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.— Bryan Vorndran, assistant director of the FBI’s Cyber Division, March 29, 2022
#1 Best Overall
In this context, “strategic warning” described an assessment of hostile intent and preparation. The account did not identify a particular victim, disclose a completed breach or establish that a successful attack had resulted from the activity discussed at the hearing.
Did the FBI say Russia was about to attack the United States?
Not in the sense of announcing a named attack with a confirmed launch time or target. Vorndran said Russia planned to hit the United States and that the FBI had an “absolute strategic warning,” but the testimony as reported did not provide a specific operation or deadline.
Rank #2
The distinction matters:
- Intent: U.S. officials assessed that Russia was willing to conduct damaging activity against the United States.
- Preparation and reconnaissance: Increased scanning of critical-infrastructure networks was an indicator that could support later intrusion attempts.
- Confirmed impact: The hearing account did not report a particular successful compromise tied to that warning.
What Russian scanning of critical infrastructure means
Scanning is network reconnaissance. An operator probes internet-facing systems to learn which addresses respond, what services are exposed, and which software or configurations might be vulnerable. Scanning can be automated and can cover many organizations without producing an immediate outage or data theft.
For defenders, a rise in scanning is useful but incomplete evidence. It can precede exploitation, help an actor select targets or simply map the public-facing network. Security teams should therefore treat it as an early-warning signal rather than proof that an intruder is already inside.
Rank #3
Practical steps for organizations
- Inventory internet-facing systems and remove services that do not need to be public.
- Prioritize patches and mitigations for edge devices, remote-access products and other externally reachable software.
- Review firewall, VPN, identity and endpoint logs for unusual probes followed by authentication attempts or exploit activity.
- Ensure the organization has a process for receiving and acting on urgent government notifications.
- Coordinate with the relevant sector information-sharing group and preserve logs if suspicious activity escalates.
Which agencies were involved?
The March 29 account centers on FBI testimony and does not document a same-day joint statement by every agency later associated with Russia warnings. Vorndran emphasized working with interagency partners to provide real-time updates to specific sectors.
Subsequent official advisories used a broader configuration. Joint notices about Russian Foreign Intelligence Service (SVR) activity were issued by the FBI, the National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), the U.S. Cyber National Mission Force (CNMF) and the United Kingdom’s National Cyber Security Centre (NCSC). Those advisories addressed activity against defense, technology and finance targets.
| Assessment or warning | Threat type | Primary targets | Agency configuration | Evidence described |
|---|---|---|---|---|
| March 29, 2022 House Judiciary testimony | Strategic warning and reconnaissance | U.S. critical infrastructure | FBI testimony, with promised interagency coordination | Vorndran’s testimony and reported increase in scanning; no named successful attack |
| Later Russian SVR advisories | Espionage and cyber intrusion activity | Defense, technology and finance sectors | FBI, NSA, CISA, CNMF and U.K. NCSC | Joint technical and operational guidance on Russian activity |
| November 4, 2024 joint statement | Influence operations | U.S. voters, election confidence and public discourse | Office of the Director of National Intelligence (ODNI), FBI and CISA | Assessment that Russian-linked actors manufactured videos and fake articles to undermine confidence in U.S. elections and intensify divisions |
| June 26, 2026 FBI/CISA public service announcement | Phishing and account compromise | Commercial messaging-application accounts | FBI and CISA | Observed Russian Intelligence Services phishing activity; warning not to share verification codes or backup-recovery keys |
How the warning fits later Russia-related activity
2024: Influence operations were part of the threat picture
In a joint statement dated November 4, 2024, ODNI, the FBI and CISA said Russian-linked actors were producing videos and fabricated articles intended to erode confidence in U.S. elections and inflame domestic divisions. This was an influence operation, not the same activity as scanning critical-infrastructure networks in 2022.
Recommended Free Tools
2026: Phishing targeted commercial messaging accounts
A June 26, 2026 FBI/CISA public service announcement described Russian Intelligence Services phishing commercial messaging-application accounts. It warned users not to provide login verification codes or backup-recovery keys. This campaign involved account theft and social engineering, with targets and methods different from the 2022 critical-infrastructure warning.
Best Value
These later notices show that Russia-related activity can span several threat types. They should not be read as proof that a specific 2022 attack occurred or that every Russia-linked operation is carried out by the same unit.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to interpret the headline accurately
- “Joins other intelligence agencies” refers most clearly to the later pattern of coordinated advisories; the March 2022 testimony itself was presented by the FBI.
- “Warning about Russia” covers an assessment of intent and preparation, not a public incident report naming a compromised organization.
- “Plans to hit us” is Vorndran’s wording about strategic intent. It is not a prediction that an attack was certain, imminent on a specified date or already successful.
- “Scanning” means reconnaissance of exposed systems. It raises defensive urgency but does not by itself demonstrate unauthorized access.
- “Russian hackers” is too broad for precise reporting. The later notices identify Russian state-linked actors, including Russian Intelligence Services or the SVR, while the 2022 testimony described the national threat more generally.
What the public record establishes—and what it does not
The available account establishes that the FBI publicly assessed Russia as a formidable cyber adversary, reported increased scanning of critical infrastructure and planned to improve real-time information sharing with affected sectors. It also establishes that U.S. and allied agencies later issued coordinated warnings covering espionage, influence operations and phishing.
It does not establish a single continuous operation linking the 2022 scanning, the 2024 election influence activity and the 2026 messaging-account phishing. Each statement has its own date, agencies, targets and evidence, so they should be evaluated separately.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
