Career
Leatherman began his FBI career in 2003 and has held assignments spanning counterterrorism, counterintelligence, criminal investigations, and cyber operations over more than two decades of service.
In the FBI's Dallas Division, he served as Senior Supervisory Resident Agent of the Frisco Resident Agency, managing criminal investigations in North Texas, and later as Assistant Special Agent in Charge for National Security, where he oversaw counterterrorism, counterintelligence, weapons of mass destruction, and cyber programs across the division.
At FBI Cyber Division headquarters, Leatherman served as a Supervisory Special Agent in a cyber national security unit and then as Assistant Section Chief of the Cyber Operational Engagement Section, where he oversaw more than 50 personnel working to share cyber threat intelligence and mitigate threats to U.S. critical infrastructure. He was subsequently promoted to Section Chief for cyber national security operations, then to Deputy Assistant Director for Cyber Operations and director of the National Cyber Investigative Joint Task Force (NCIJTF).
Leatherman became Assistant Director of the FBI's Cyber Division in June 2025, succeeding Bryan Vorndran, after being selected for the role by FBI Director Kash Patel.
Operations and initiatives
In February 2024, he gave a press conference announcing an international operation that disrupted the LockBit ransomware enterprise while serving as Deputy Assistant Director.
In 2025, Leatherman led the FBI's public response to the "Salt Typhoon" campaign, a China-linked cyber-espionage operation targeting global telecommunications providers. The FBI and partner agencies issued a joint advisory in August 2025 disclosing that the campaign had affected entities in more than 80 countries, and Leatherman stated in interviews that the activity had been "largely contained" within U.S. telecommunications networks following extensive notification and remediation work.
Leatherman has also discussed law-enforcement efforts against the cybercrime group known as Scattered Spider, including investigative progress and charging strategies in interviews during the RSA Conference in 2024.
In September 2025, the U.S. Department of Justice announced charges against Thalha Jubair, a U.K. national alleged to be a member of the Scattered Spider cybercrime group, in connection with attacks on critical infrastructure and other targets. Leatherman said the charges demonstrated that "no cybercriminal is beyond our reach."
In October 2025, Ukrainian national Oleksii Lytvynenko was extradited from Ireland to the United States on charges related to the Conti ransomware operation, in an action Leatherman described as demonstrating the strength of the FBI's international partnerships.
In December 2025, the Justice Department announced indictments in the Central District of California charging Ukrainian national Victoria Dubranova for her roles in two Russian state-sponsored hacking groups: CyberArmyofRussia_Reborn (CARR), which the FBI assessed was directed and funded by Russia's GRU, and NoName057(16), a project administered in part by a Russian government information technology organization. The U.S. Department of State concurrently offered rewards of up to $2 million for information on CARR members and up to $10 million for NoName members. Leatherman said the FBI would use "all available tools to expose their activity and hold them accountable."
In March 2026, the United States led a 14-country takedown of LeakBase, one of the world's largest online forums for buying and selling stolen data and cybercrime tools, in a coordinated effort hosted by Europol in The Hague. The FBI's Salt Lake City Field Office led the U.S. investigation, with prosecution by the Justice Department's Computer Crime and Intellectual Property Section and the U.S. Attorney's Office for the District of Utah. Leatherman said the operation removed "an easy point of access to stolen information on American businesses and individuals."
In March 2026, speaking at the McCrary Cyber Summit, Leatherman described FBI Cyber's role in implementing the Trump administration's National Cyber Strategy, with emphasis on deterrence through law enforcement and intelligence authorities and the protection of critical infrastructure. He cited the FBI's use of offensive action to remove adversary capability and the importance of engagement with the FBI's 56 field offices to defend critical infrastructure through initiatives including Operation Winter Shield.
On April 15, 2026, two U.S. nationals, Kejia Wang and Zhenxing Wang, were sentenced in the District of Massachusetts for facilitating a Democratic People's Republic of Korea (DPRK) information technology worker scheme that used the stolen identities of more than 80 U.S. persons to obtain remote jobs at more than 100 U.S. companies, generating over $5 million in revenue for the North Korean government. Leatherman said U.S. nationals who facilitate such schemes "will face FBI investigation and potential prison time."
On April 20, 2026, Angelo Martino, a Florida-based ransomware negotiator employed by a U.S. cyber incident response firm, pleaded guilty in the Southern District of Florida to conspiring with the ALPHV/BlackCat ransomware group. Martino had provided BlackCat operators with the confidential negotiating positions and insurance policy limits of his employer's clients, and later conspired with two others to deploy ransomware against additional U.S. victims. Leatherman said the plea showed that "for all the international aspects of cybercrime, the threat is also here in the United States."
On April 27, 2026, Chinese national Xu Zewei was extradited from Italy to the United States to face a nine-count indictment in the Southern District of Texas charging him in connection with state-sponsored hacking directed by China's Ministry of State Security. According to the indictment, Xu and his co-conspirators targeted U.S. universities and researchers conducting COVID-19 vaccine and treatment research in 2020, and later participated in the HAFNIUM intrusion campaign, which exploited Microsoft Exchange Server vulnerabilities and compromised more than 12,700 U.S. organizations. Leatherman said the extradition demonstrated that the FBI's reach "extends well beyond U.S. borders" and credited Italy's Polizia Postale for the partnership that led to Xu's arrest in Milan, adding that other Chinese government contractors used to obscure the country's role in cyber operations face the same risk.
On April 7, 2026, the Department of Justice and the FBI announced Operation Masquerade, a court-authorized technical operation that disrupted a Domain Name System hijacking network operated by APT28 (also known as GRU Unit 26165), a unit of Russia's military intelligence service. GRU actors had exploited known vulnerabilities to compromise thousands of TP-Link routers used in small and home offices, redirecting traffic through GRU-controlled servers to harvest credentials and intelligence from targets in government, military, and critical infrastructure sectors. The FBI's court-authorized operation reset DNS settings on the compromised routers in the United States to sever the GRU's access. Leatherman described the operation as part of a series of disruptions targeting Russian government hackers dating to 2018, including VPNFilter, Cyclops Blink, and Operation Dying Ember.
