//
OFFLINE — VIEWING CACHED CONTENT
← Back to Archive

IC BRIEF

Current as of 0703 EDT (UTC-04), Friday 17 April 2026

Contents

14 stories from 22 sources across 20 organizations

BOTTOM LINE UP FRONT

We judge it likely that domestic Intelligence Community (IC) oversight will be materially weakened over the next 6-12 months across budget, judicial, and principal channels, with moderate confidence. Whether the convergence reflects deliberate coordination or independent initiatives cannot yet be established from available sourcing.

The Fiscal Year 2027 (FY27) request cuts Cabinet IGs an average 12% and Department of Justice (DOJ) and Interior 28%, stripping audit capacity over FISA and surveillance programs. DOJ's appeal of the Foreign Intelligence Surveillance Court (FISC) filter-deficiency ruling moves the 702 fight into a judicial track Congress cannot easily override, three legislative days before 702 sunset. Gabbard's February private warning against a clean 702 extension went unheeded, with Ratcliffe holding the reauthorization portfolio and the statutory Director of National Intelligence (DNI) absent from the lobbying push.

The detection gap US and Israeli low-observable platforms exploited during Epic Fury and Rising Lion will likely narrow over the next 12-18 months. This is driven by Defense Intelligence Agency (DIA)'s assessment that Beijing is weighing X-band radar supply to Iran and the Workers Party of Korea (WPK) Political Bureau's April codification of Iran as core nuclear-missile partner. Confidence is moderate given Hegseth's contrary readout of a private Xi-Trump assurance.

IC Oversight & Authorities

National Cyber Director Cairncross Signals More Cyber Executive Orders, Hints Trump Beijing Visit Will Raise Chinese Prepositioning

National Cyber Director Sean Cairncross told a Semafor event more executive orders are coming to implement the March 2026 national cybersecurity strategy, with the first cyber-enabled fraud Executive Order (EO) released alongside the strategy and the first Take It Down Act conviction in the past week. Asked whether Chinese prepositioning on critical infrastructure would come up during Trump's Beijing visit next month, Cairncross said the safety and security of the American people will be first and foremost. He also acknowledged White House interagency meetings with model companies over Anthropic's Claude Mythos cyber risks and benefits, signaling AI-cyber policy is moving into formal review.

Analyst Note: Cairncross's deliberate coupling of pending cyber EOs with the May Beijing trip, per a single Semafor public appearance, hedged and without specifics, frames the visit as coercive-diplomacy leverage rather than economic engagement, with the explicit invocation of Chinese prepositioning on critical infrastructure signaling the White House intends to raise Volt Typhoon-style operations directly with Xi rather than route them through working channels. The parallel acknowledgment of interagency review of Claude Mythos cyber risks means the administration is very likely to pair adversary-consequences EOs with a model-governance component within the next four weeks, collapsing the boundary between offensive cyber policy and frontier AI regulation into a single package. This sharpens what prior Glasswing-era reporting left deliberately ambiguous about offensive cyber tools as diplomatic leverage, moving from AI-centric framing to explicit Beijing-trip linkage. A pre-trip EO signing in the coming weeks is likely timed to give Trump a live-fire deliverable for Xi. The rhetoric may be absorptive rather than operational, pre-positioning the U.S. to deflect Chinese counter-accusations during the visit while leaving actual escalatory consequences on a longer timeline than Cairncross's remarks imply.

Sources:

Prior Reporting - [Expect more cybersecurity executive orders soon, national cyber director says](https://www.nextgov.com/cybersecurity/2026/04/expect-more-cybersecurity-executive-orders-soon-national-cyber-director-says/412861/) (2026-04-15) - [Iran is 'perpetual bad' cyber actor, US official says](https://www.thenationalnews.com/future/technology/2026/04/15/iran-hackers-us-kash-patel/) (2026-04-15)

DOJ to Appeal FISC Ruling That Flagged FBI/NSA Section 702 Filtering Tools

The Justice Department will appeal a Foreign Intelligence Surveillance Court ruling that identified deficiencies in the technical filters FBI, NSA, and other agencies use to sift raw data collected under Section 702, according to talking points obtained by Nextgov. DOJ faced an April 16 deadline either to appeal or to correct the issues; the FISC judge found the proposed filtering approach could fail to consistently safeguard Americans' communications after collection. The appeal lands five days before the statutory Section 702 sunset on April 21 and complicates a reauthorization fight already paused over warrant amendment disputes.

Analyst Note: The appeal shifts the 702 fight into a judicial track Congress cannot easily override, arriving three legislative days before sunset with Gabbard absent from the lobbying campaign and Boebert-Luna hardliners already blocking the House rule. Per a single Nextgov report citing internal DOJ talking points, with the underlying FISC opinion classified and independent corroboration unlikely before docketing, DOJ's decision to litigate rather than narrow the filter signals agencies regard the flagged capability as operationally indispensable. A DC Circuit stay preserves collection under a cloud of judicial criticism the FBI-minimization critique won't shake, while affirmance strips the contested query filters and forces tooling rebuilds under oversight pressure. A late clean-extension deal is likely within the next seven days but unlikely before April 18, with the probability of a lapse-and-backdate sequence rising as the litigation timeline compresses. The appeal may be a procedural placeholder to preserve remedies while agencies quietly implement the judge's required fix, making the operational disruption narrower than the statutory stakes imply.

Sources:

Trump FY27 Budget Targets Inspectors General With Average 12% Cut; Interior and Justice IGs Face 28% Reductions

Trump's FY27 budget request proposes cutting Cabinet department Inspectors General by an average 12% below fiscal 2024, with Interior and Justice IGs facing 28% reductions and projected 9% staff cuts across the oversight community. Partnership for Public Service analysis cited in the reporting puts FY24 Inspector General (IG) return at $18 for every dollar spent. Former Interior IG Mark Lee Greenblatt (fired by Trump) and Project On Government Oversight (POGO) called the cuts an accountability rollback, while Council of IGs chair Cheryl Mason has not publicly commented on specific funding.

Analyst Note: DOJ OIG's FISA reviews, Department of Homeland Security (DHS) OIG's surveillance oversight, and the cross-agency infrastructure the Intelligence Community Inspector General (ICIG) relies on for joint probes are among the explicit targets of the cuts, per a single Government Executive piece drawing on POGO analysis, with the sectoral read weighted toward Greenblatt, a Trump-fired former IG with obvious framing interests. The $18-to-$1 return figure will almost certainly be deployed in the appropriations fight, but with Vought at Office of Management and Budget (OMB) and the Continuing Resolution (CR) environment frozen, the cuts are very likely to be imposed through apportionment even if Congress restores headline numbers before year-end. The request may be negotiating leverage designed to force structural reorganization of investigative jurisdiction rather than a final posture, but IG workforce attrition will accelerate regardless. Staff reading the political signal will redeploy, degrading the investigative pipeline for years whether or not funding is later restored.

Sources:

DNI Gabbard Privately Warned Trump in February Against Clean FISA 702 Extension, Remains Absent From Lobbying Push

Politico first reported that DNI Tulsi Gabbard privately told Trump in February she would not support a clean Section 702 reauthorization without added privacy protections for Americans, according to two people familiar with the exchange. Trump instead endorsed a clean 18-month extension and publicly posted he would risk giving up his own rights and privileges to pass it. Gabbard has been conspicuously absent from the White House Capitol Hill lobbying campaign CIA Director John Ratcliffe has led this week, and sponsored Section 702 repeal legislation as a House Democrat before reversing her position after later statutory protections.

Analyst Note: The February private warning, per two unnamed sources via Politico, unchallenged by White House or Office of the Director of National Intelligence (ODNI), establishes that Gabbard was cut from the White House lobbying strategy at the outset, with Ratcliffe handed the 702 portfolio in a reversal of normal IC role allocation that almost certainly signals a durable re-ordering of who speaks for the community on Hill authorities through at least the next reauthorization cycle. Her public support for the authority alongside private insistence on privacy protections is a hedge that preserves standing if the clean extension collapses, and her absence from Ratcliffe's campaign is a visible break the workforce is reading. The absence may instead be coordinated rather than insubordinate, a division of labor letting Ratcliffe absorb political heat while Gabbard retains credibility with privacy-minded senators whose votes the White House ultimately needs. A new ODNI statement carrying minimization language is likely within two weeks and would confirm she is rebuilding authority on her own terms.

Sources:

Watch Items - DC Circuit docketing of the DOJ's appeal on the FISC 702 filtering ruling - Clean Section 702 extension: very likely within the next seven days, unlikely before Friday April 18 - Senate Intelligence Committee closed briefing on April 22 Intelligence Matters, and whether ICIG representation is present - Executive order signing tied to national cyber strategy: likely within four weeks ahead of Trump's Beijing trip

IC Technology & AI

Federal Agencies Reported 3,611 AI Use Cases in 2025, IC and Pentagon Exempted From Inventory

OMB's 2025 Federal Agency AI Use Case Inventory, updated April 14 and published April 16, counted 3,611 deployed use cases across the federal government, more than double the 1,757 in 2024. HHS (447), NASA (425), VA (367), Department of Energy (DOE) (340), and DOJ (314) led the list, with 445 cases classified high-impact. Microsoft Copilot dominated commercial tool use at 102 instances. Anthropic Claude appeared in 25 cases before Trump administration directives halted new federal contracts. Intelligence Community and Pentagon use cases are exempted from reporting, removing classified AI deployments from the public record at the point when agency adoption has doubled year-over-year.

Analyst Note: The doubling of civilian AI use cases alongside the IC and Pentagon carve-out, per a single Nextgov analysis of the April 14 OMB dataset, entrenches a structural transparency gap. Auditable deployments stop at HHS and DOE while ODNI, CIA, and DIA operate outside the reporting obligation at the same procurement moment when civilian adoption doubled year-over-year. The 105% civilian growth rate very likely understates the IC trajectory this fiscal year, since the same workforce pressure and procurement momentum apply to classified environments minus the inventory requirement, a delta that will shape how the next Government Accountability Office (GAO) review of IC AI governance is framed within the coming quarter. The exemption may instead conceal deliberately slower classified adoption, driven by accreditation lag and cross-domain solutions, meaning civilian deployment leads IC uptake for now rather than lagging it. The 25 Claude use cases dropped after the Anthropic contract freeze signal that vendor-access decisions reshape civilian adoption curves in weeks rather than quarters.

Sources:

Google in Talks on Gemini Deal for Pentagon Classified Environments, Proposes Guardrails Narrower Than OpenAI Contract

The Information first reported Google is negotiating a Pentagon deal to deploy Gemini AI inside classified environments for military operations, a markedly different posture from its 2018 Project Maven withdrawal. Google has proposed contractual restrictions barring domestic mass surveillance and autonomous weapons without human oversight, distinguishing it from OpenAI's February 2026 All Lawful Purposes deal. A single unnamed Pentagon official said the department will continue using advanced AI through industry partnerships but would not confirm the Google talks. Contract value and specific programs were not disclosed.

Analyst Note: Per a single Information report, an unnamed Pentagon official would neither confirm nor deny, a deployed Gemini in classified environments ends OpenAI's emerging cleared-AI monopoly, and Google's proposed restrictions against domestic mass surveillance and fully autonomous weapons will very likely become the guardrail template cleared vendors use to resist the broader all-lawful-purposes terms OpenAI accepted in February. The first head-to-head operational benchmark between frontier models on Intelligence, Surveillance, and Reconnaissance (ISR) and targeting use cases then follows, with results shaping which model family carries classified workloads through 2027. The talks may instead reflect post-Maven reputational repair with no firm deployment timeline rather than imminent fielding. A formal announcement or confirming leak is nonetheless likely within the next month, with terms heavily contested around the autonomy-restriction clauses.

Sources:

Watch Items - Leak or announcement confirming Google-Pentagon Gemini classified-space terms: likely within the next month - GAO or OMB clarification on IC and Pentagon AI-inventory exemption scope in the coming quarter - Anthropic Claude Mythos IC-access adjudication outcome

Allied Intelligence

Chatham House Finds 16 of 28 European States at High Risk to US Cloud Kill Switch, Including Germany, Poland, UK

Chatham House researcher Katja Bego called European defense reliance on US hyperscaler cloud services an existential national security risk in a new report that found 16 of 28 European countries studied are at high risk to a potential US kill switch, including Germany, Poland, and the United Kingdom, based on defense-ministry, national-media, and EU/UK procurement data showing Microsoft, Google, Amazon, and Oracle as the dominant defense-cloud providers. The Netherlands is building its own defense cloud with KPN and Thales, and Luxembourg-based Suse, Italy's Cubbit and Elemento, and Bulgaria's StorPool launched a sovereign disaster-recovery stack at the Berlin European Data Summit. The report warns even "sovereign" US-firm offerings fall under the CLOUD Act.

Analyst Note: Chatham House's public-procurement analysis, corroborated across Euronews and Manila Times, operationalizes what European defense ministries have avoided stating publicly: core military-cloud workloads sit on infrastructure US executive action could silence, and the CLOUD Act nullifies the sovereign-regional options US hyperscalers market as a workaround. The Dutch KPN-Thales defense cloud and the Suse-Cubbit-Elemento-StorPool disaster-recovery stack are the first live native alternatives, but both remain dependent on US-origin hardware and years from defense-grade availability, making contractual safeguards and data-portability clauses the likely near-term European hedge. The kill-switch framing may overstate the operative risk; most hyperscaler contracts already include sovereign-exit and key-custody clauses, and the real exposure is CLOUD Act data-request leverage rather than a literal shutdown. For US IC, allied services now hold an explicit counter-lever: if Washington can activate the kill-switch, partner agencies will harden faster and share less, in ways UKUSA liaison has not previously had to accommodate.

Sources:

FCDO Permanent Under-Secretary Olly Robbins Stepping Down After Mandelson Vetting Override Revealed; Starmer Says He Was Not Informed

Foreign Office permanent under-secretary Olly Robbins is stepping down over the Mandelson vetting override fallout, with Prime Minister Keir Starmer saying he was unaware until days before publication and Downing Street sources describing him as absolutely furious. Former Foreign Secretary David Lammy also says he learned of the override only the day before the reporting. Conservative leader Kemi Badenoch, Lib Dem leader Ed Davey, Reform UK, and the Greens called for Starmer's resignation; Mandelson was already removed from the US ambassadorship in September 2025 after his Jeffrey Epstein ties resurfaced. The scandal now extends from an intelligence-community override to an open political question about how the Foreign Office bypassed the security services and who authorized it.

Analyst Note: Robbins' departure and Lammy's day-before admission, corroborated across UK outlets alongside the April 16 Guardian/Bloomberg reporting, shift the accountability perimeter from a cleared-officer dispute to the Cabinet Office itself: security services were overruled by a career civil servant without the Foreign Secretary or Prime Minister's knowledge, leaving open who else has been cleared this way since 2024. For Five Eyes liaison services, this is the second major confidence hit on UK developed vetting in six months, and the next senior-liaison information-sharing review is likely to include a quiet recalibration of how UK-cleared officers are treated in sensitive product. Starmer's "absolutely furious" framing is political cover; what matters is whether the Cabinet Secretary commissions a vetting-override audit, which is very likely within two weeks given parliamentary pressure. Robbins' exit may instead be a pre-negotiated departure timed to the scandal rather than a forced resignation, in which case the accountability signal is cosmetic and the override mechanism survives intact under his successor.

Sources:

Atlantic Council Ties GRU and FSB to Below-Threshold Cyber Operations Against Sweden, Poland, Norway, Denmark

An Atlantic Council analysis by Anna Wieslander, Aaron Korewa, and Justin Sherman attributes Russia's below-threshold cyber campaign against NATO European members to the Main Intelligence Directorate (Russia) (GRU), described as the origin of most of Russia's most destructive cyber operations including the Ukrainian grid attacks, and increasingly to the Federal Security Service (Russia) (FSB), which a Polish government report now says is expanding into disruptive operations against critical infrastructure. Named 2025-2026 incidents include a thwarted Swedish heating-plant attack and a coordinated Polish operation on December 29-30 targeting wind and solar farms, combined heat and power plants, and industrial control systems. The authors frame the campaign as hybrid warfare designed to pressure NATO without triggering Article 5.

Analyst Note: The clearest allied-service public baseline yet, per a single Atlantic Council analysis whose FSB assessment rests on a cited Polish government report rather than independent collection, is that Russia's sub-threshold energy targeting has become a two-agency mission: GRU (destructive operations, Ukrainian grid heritage) plus FSB now scaling into disruptive critical-infrastructure strikes, a structural change the Article 5 threshold debate has not caught up to. Sweden's heating-plant thwart and Poland's December 29–30 unsuccessful-but-coordinated wind, solar, and CHP strike together set a tempo defenders can track but not deter. Absent named attribution with OFAC consequences, Moscow very likely keeps escalating through the summer demand peak. The FSB expansion claim may instead reflect Polish political interest ahead of 2026 elections, with FSB involvement opportunistic rather than strategic and GRU the lead service, but that distinction becomes moot if Washington closes the attribution gap. A joint Cybersecurity and Infrastructure Security Agency (CISA)-National Cyber Security Centre (NCSC) advisory naming the FSB subunit behind the Polish activity is likely within the next month and would be the clearest indicator the U.S. is moving from tracking to consequence-imposition.

Sources:

Watch Items - Cabinet Secretary commissioning a UK vetting-override audit: very likely within two weeks - Joint CISA-NCSC advisory naming the FSB subunit behind Polish energy-sector operations: likely within the next month - European sovereign defense-cloud funding announcements at next EU Council

Adversary Intelligence

UK Counter-Terror Police Arrest Three Over Iran International Wembley Arson Attempt as IRGC-Linked Group Claims Credit

Counter Terrorism Policing London arrested a 16-year-old and two men aged 19 and 21 after an ignited container was thrown at Iran International TV's Wembley offices. An ensuing vehicle pursuit ended in a Finchley crash that briefly forced an evacuation. Deputy Assistant Commissioner Vicki Evans said investigators face an "unprecedented level" of national-security cases with suspected foreign-state ties. Harakat Ashab Al Yamin Al Islamia, assessed as an Islamic Revolutionary Guard Corps (IRGC) proxy and tracked via Search for International Terrorist Entities (SITE) Intelligence, claimed responsibility alongside two earlier north-London incidents: arson against Jewish ambulance vehicles and a Finchley synagogue firebombing, though Met Police has not formally linked the three attacks.

Analyst Note: The 16-year-old suspect alongside two adults in their early twenties confirms what Security Service (UK) (MI5) and the Met have warned for eighteen months: IRGC disposable-recruit pipelines have migrated from diaspora networks into criminal-gang and juvenile talent pools, compressing the attribution timeline every future incident will carry. The Harakat Ashab Al Yamin Al Islamia claim, tracked by SITE Intelligence and assessed as an IRGC proxy, folds the Wembley attack into the Jewish-ambulance arson and Finchley synagogue firebombing as a single proxy campaign, a connection Met Police has not formally drawn. Evans's "unprecedented" national-security caseload framing is the operational backdrop to this week's Contest review chatter, and a UK-Iran expulsion or sanctions designation is very likely within the fortnight. The branding may instead be a false-flag calibrated to blur responsibility between IRGC proxies and far-right extremists, in which case the tradecraft signal is disinformation discipline, not operational scale-up.

Sources:

DIA Assesses China Weighing Supply of X-Band Radar to Iran; Hegseth Says Xi Gave Trump Private Assurance It Will Not Happen

CBS News, citing multiple US officials, reported DIA analysts assess China is weighing supply of X-band radar systems to Iran that would improve Tehran's detection and tracking of low-flying drones and cruise missiles, with air-defense system transfers also under consideration via third-country routing. Defense Secretary Pete Hegseth told UNIAN that Xi Jinping assured Trump the transfers will not happen, after Trump threatened a 50% tariff on any supplier state and sent a private letter to Xi. CBS reports it remains unclear whether Beijing ultimately moved forward. The assessment extends an earlier CNN April 11 report on MANPADs shipments routed through third countries and follows confirmed Iranian use of a Chinese TEE-01B satellite to monitor US bases.

Analyst Note: The DIA assessment that Beijing is weighing X-band radar supply to Iran puts CENTCOM on notice that the detection gap US and Israeli low-observable drones and cruise missiles exploited during Operations Epic Fury and Rising Lion is at risk of closing regardless of the Hormuz negotiation track. Per multiple unnamed US officials cited by CBS, collection method unconfirmed but plausibly SIGINT on procurement and shipping logistics, Hegseth's claim that Xi personally assured Trump the transfer will not happen is near-impossible to verify. China's confirmed routing of MANPADs through third countries makes a blanket non-transfer assurance unlikely to hold in full. The assessment may instead be a deliberate leak to sharpen the tariff threat, telegraphing US negotiating posture rather than a finalized intelligence conclusion on imminent delivery. Satellite-observable construction at Natanz, Fordow, and Bandar Abbas will provide the earliest falsifiable radar-dish delivery indicators within the next 30 days, before any formal announcement.

Sources:

WPK Secretariat Orders Bureau 10 to Purge Any Official With Reunification Ties, Reopens Kaesong and Kumgang Case Files

A Pyongyang source told Daily NK the Workers Party of Korea Secretariat ordered the Enemy-Confrontation Guidance Bureau (Bureau 10) to coordinate with State Information Bureau agents to identify and punish any cadre harboring sympathy for reunification, framing the two-state policy shift as an ideological decisive battle. Officials who previously worked on the Kaesong Industrial Complex, Mount Kumgang tourism, and other inter-Korean projects are being summoned for comprehensive reinvestigation, with mobile-phone inspections and house searches underway against Bureau 10 staff. The Ninth Party Congress restructuring of the security agencies is being operationalized as a counterintelligence purge targeting the regime's internal population rather than external threats.

Analyst Note: Running the operation through Bureau 10 and the newly reorganized State Information Bureau, not the Ministry of State Security, signals the party reclaiming internal counterintelligence from the security organs, and house-searches turning against Bureau 10's own staff almost certainly produce senior turnover there within weeks. Per a single Pyongyang-based Daily NK source with a track record of producing verifiable directives, the move is the ideological complement to post-Ninth Congress border fortification: eliminating officials who could anchor a reunification conversation domestically closes the constituency a future negotiator would need and locks the two-states framework structurally, not just rhetorically. The operationally consequential edge for Seoul and Washington is temporal; the pool of cadre carrying live inter-Korean contacts is shrinking in real time, and HUMINT windows tied to those networks likely close this quarter. The purge may primarily target the generational cohort shaped by Sunshine Policy engagement, preemptive regime-stability housekeeping rather than ideological hardening, which would make the two-state posture durable but the penetration window always narrower than it appears.

Sources:

WPK Political Bureau Orders DPRK Foreign Ministry to Entrench Nuclear Status, Treat Iran as Core Military Partner for Joint Nuclear-Missile Work

A Daily NK Pyongyang source says the WPK Political Bureau issued a classified April 2026 directive to senior foreign-ministry officials ordering permanent removal of denuclearization from Democratic Peoples Republic of Korea (DPRK) diplomatic vocabulary, baseline use of arms reduction framing, and no engagement with any state that refuses to treat Pyongyang as a nuclear power. The directive names Iran as a core partner for shared nuclear and missile technology and expanded multilateral arms-trading networks to erode sanctions, elevates Russia ties to a blood alliance, and tells officials to exploit Middle East and European conflicts to dilute US diplomatic attention. It restores the WPK International Secretary as supreme authority over all diplomatic affairs with the foreign ministry reduced to an implementing body.

Analyst Note: The formal codification matters less than the procedural change underneath it. Restoring the WPK International Secretary as supreme diplomatic authority pushes future DPRK-Iran coordination into party channels that fall largely outside traditional state-to-state SIGINT collection, raising the Five Eyes tracking cost at precisely the moment US-Iran talks remain fragile. Per a single Daily NK Pyongyang source carrying no document hash or corroborating imagery, the directive converts a decade of ad-hoc technical exchanges into a mandated foreign-ministry implementation line, meaning bureaucratic friction that previously constrained technology transfer now runs in reverse. A DPRK-Iran technical-personnel movement uptick is very likely within the next quarter, with flight manifests through Beijing and Central Asian procurement shell activity as the first observable indicators. Beijing's resistance to nuclear IP it regards as regionally destabilizing suggests the operational uplift will concentrate in missile components rather than warhead design, making the directive's maximalist partnership framing a ceiling the sanctions-erosion network will only partially reach.

Sources:

Hunt.io Maps 1,250+ C2 Servers Concentrated Across 165 Russian Hosting Providers, Led by TimeWeb, WebHost1, and REG.RU

Hunt.io telemetry published April 16 identified more than 1,250 active command-and-control servers across 165 Russian hosting providers between January and April 2026, with TimeWeb (311), WebHost1 (140), and REG.RU (138) carrying the bulk of the load and Yandex.Cloud hosting the widest malware-family diversity. Keitaro remains the dominant traffic-distribution framework (587 unique Command and Control (C2) IPs), with Cobalt Strike, Sliver, and Tactical RMM widely abused for post-exploitation and Hajime, Mozi, and Mirai sustaining active IoT botnet infrastructure. Named campaigns tied to the infrastructure include Latrodectus fake-CAPTCHA ClickFix delivery via TimeWeb, Lumma Stealer abusing Google Groups from REG.RU, and the SmartApeSG Remcos RAT operation on Hosting Technology LTD.

Analyst Note: Hunt.io's provider-level mapping, drawn from proprietary Host Radar scanning that has not been independently validated and may over-count shared-hosting artifacts as live C2s, shifts the threat-hunting problem from indicator-level triage, which Russian and Peoples Republic of China (PRC) operators now cycle faster than defenders can burn, to infrastructure chokepoints that sanctions and covert takedowns can actually reach. TimeWeb's 311 C2s represent an extraordinary single-provider exposure that very likely reflects either an FSB tolerance arrangement or straightforward capture as of early 2026, making it a priority candidate for Treasury or Cyber Command action within the next sanctions cycle. Keitaro's 587-IP dominance carries a more specific implication: the framework's repeated selection by Russian-nexus operators reflects its native integration with Cobalt Strike and Sliver workflows, so defenders can raise operator cost in the coming weeks by fingerprinting Keitaro upstream rather than chasing individual payloads. The concentration figures may instead track Hunt.io's own scanning access, with providers cooperating with Western telemetry appearing heavier than truly opaque ones, in which case the most operationally significant infrastructure remains below the current measurement horizon.

Sources:

Watch Items - Satellite-observable X-band radar construction activity at Natanz, Fordow, or Bandar Abbas - Met Police's formal linkage between the Wembley attack and earlier Jewish-ambulance and Finchley synagogue incidents - DPRK-Iran technical-personnel flight manifests through Beijing in the coming quarter - Treasury or Cyber Command action against TimeWeb or WebHost1 is likely within the next sanctions cycle

COLLECTION GAPS

UNCLASSIFIED // OPEN SOURCE