//
OFFLINE — VIEWING CACHED CONTENT
← Back to Archive

IC BRIEF

Current as of 0716 EDT (UTC-04), Thursday 23 April 2026

Contents

12 stories from 23 sources across 19 organizations

BOTTOM LINE UP FRONT

We assess the Iran war is forcing structural stress across the US intelligence enterprise on three dimensions: an analytic-versus-policy split, a leadership vacancy at Cybersecurity and Infrastructure Security Agency (CISA) during active Iranian cyber activity, and a widening Iranian intelligence tempo outside Iran. A fresh Defense Intelligence Agency (DIA) assessment told Congress that Iran retains its 'key military capabilities'. Senate Armed Services Committee (SASC)/House Armed Services Committee (HASC) pressure on CENTCOM and Office of the Secretary of Defense (OSD) messaging is likely within the next 21 days. That judgment rests on the al-Asad and Red Sea precedents; we hold it with moderate confidence. The Intercept's Defense Casualty Analysis System (DCAS)-tally discrepancy will probably drive a parallel IG or committee inquiry in the same window.

Iranian services are operating across three theaters at once. Tehran is likely to produce additional Mossad-espionage executions within the next 21 days, and UK proscription of the Harakat Ashab al-Yamin al-Islamia shell behind London arson arrests is unlikely within the next 90 days. Our confidence in both is moderate. JUMPSEC's MuddyWater-to-CastleRAT link is the first documented Iran Ministry of Intelligence and Security (MOIS) pivot to Russian commercial malware-as-a-service (MaaS) tooling, a tradecraft shift that degrades existing Iran-attribution rules.

Allied-sharing friction is the third axis: full US-ROK satellite-intelligence restoration is unlikely within 30 days after Unification Minister Chung's 'political trick' response. We hold that call with low confidence given limited visibility into Washington's private positioning.

IC Oversight & Authorities

Plankey withdraws nomination to lead CISA, leaving cyberdefense agency headless amid Iran war

Sean Plankey withdrew his nomination to lead CISA on April 22 after thirteen months unconfirmed, writing to the White House that "it has become clear the Senate will not confirm me." Two senators had held the nomination: Sen. Rick Scott (R-Fla.) over Coast Guard cutter contracts Plankey oversaw in an advisory role, and Sen. Ron Wyden (D-Ore.) over CISA's refusal to release a report on telecommunications-sector security vulnerabilities. Plankey left his Coast Guard advisory role last month in an unsuccessful attempt to dislodge the Scott hold. CISA now runs under acting director Nick Andersen, who took over in February after Madhu Gottumukkala departed amid leadership incidents, and has lost roughly a third of its workforce since January 2025.

Analyst Note: Plankey's withdrawal puts CISA under acting-only leadership during the active Iran-war cyber posture, with Salt Typhoon persisting against US telecoms, MuddyWater expanding through commercial MaaS, and the agency operationally asymmetric to allied services (British UK National Cyber Security Centre (NCSC), Canadian Communications Security Establishment (Canada) (CSE), Australian ASD) that route wartime threat coordination through confirmed political principals. The cause is dual-extrinsic: Scott's hold traces to Coast Guard cutter procurement and Wyden's to CISA's withholding of a telecom-vulnerabilities report, neither a judgment on Plankey's cyber fitness. Plankey's Coast Guard departure last month did not move Scott, signaling the hold is strategic leverage rather than a vettable objection, and any like-credentialed replacement inherits the same holds. A Senate-confirmed director is very likely still absent within 30 days. The 13-month stall, a third of the workforce gone since January 2025, and two acting directors inside twelve months together describe an agency whose inputs to NSC cyber deliberations travel through an acting director without independent stature. The alternative reading that Andersen's steady tenure makes this a lower-order problem is weakened by the workforce loss he inherited.

Sources:

Intercept: Pentagon drops 15 wounded troops from Iran-war casualty tally without explanation

The Pentagon reduced its Defense Casualty Analysis System (DCAS) wounded-in-action count for the Iran war from 428 to 413 on Tuesday without public explanation, The Intercept reported. Two Pentagon spokespersons told the outlet they could not field questions on the 15 casualties, citing an absent duty officer. The Intercept, citing two former DCAS analysts and an unnamed US government official, reports that DCAS is missing hundreds of known casualties, including more than 200 sailors treated for smoke inhalation after a March 12 fire on USS Gerald R. Ford and Maj. Sorffly Davius, a NY Army National Guard signals officer who died of illness in Kuwait on March 6. The unnamed official described the pattern as the definition of a cover-up.

Analyst Note: DCAS is a structured system of record whose analyst-level edits leave audit trails, which makes a 15-count backward revision a discrete data-integrity event rather than a rounding artifact. Two former analysts named and on the record, reported by The Intercept, whose reporter carries documented fluency in DoD casualty-accounting systems from prior Yemen coverage, sharpen the evidentiary picture well past what a single unnamed source could establish. The revision may instead reflect reclassification of injuries from wounded-in-action to non-hostile categories, a consequential administrative move that the dataset alone does not rule out. The institutional dissonance with Adm. Brad Cooper's public 13-fatality count leaves which DoD element holds authoritative Iran-war accounting formally unresolved. SASC and HASC readiness subcommittees hold DCAS reporting authority, and whether a formal IG referral or a subcommittee inquiry into Iran-war accounting opens within the next 90 days is roughly even odds.

Sources:

EFF sues DHS and ICE over administrative subpoenas used to unmask online critics and protest attendees

The Electronic Frontier Foundation sued Department of Homeland Security (DHS) and ICE in the US District Court for the District of Columbia on April 22 demanding records on the agencies' use of administrative subpoenas to unmask or locate people who documented ICE activity, criticized the government, or attended protests, EFF said in a press release. EFF said DHS and ICE have issued administrative subpoenas (which do not require judicial approval) to Amazon, Apple, Discord, Google, Meta, Microsoft, Reddit, SNAP, TikTok, and X for basic subscriber information. EFF said DHS withdrew subpoenas in several prior legal challenges by ACLU affiliates in Northern California and Pennsylvania rather than defend them in court. The Freedom of Information Act (FOIA) complaint seeks the legal basis, Inspector General and oversight records, issuance procedures, issuance counts, and DOJ communications.

Analyst Note: EFF's FOIA complaint is the first vehicle to force disclosure of the specific legal theory DHS and ICE are using to justify 19 U.S.C. customs-statute administrative subpoenas against speech-adjacent targets. The agencies have declined to defend that theory in court, withdrawing when challenged by ACLU affiliates in Northern California and Pennsylvania rather than seeking judicial endorsement, a pattern corroborated by prior ACLU litigation. That issue-collect-withdraw cycle reveals the program's design: it is built to exploit non-challenged subpoenas, not to construct durable legal doctrine. A favorable ruling within the next 120 days is roughly an even chance, even with the 10-day expedited-processing clock already violated. DHS may instead press that the underlying OGC memoranda are predecisional law-enforcement documents exempt from disclosure, extending litigation well beyond 90 days without reaching the substantive authority question. Any disclosure that does follow would expose the memoranda shaping the broader federal-statutes-as-surveillance-authority pattern across DHS.

Sources:

Journalist Catherine Herridge cites whistleblower alleging CIA under Haspel suppressed 2020 CCP election interference findings

Investigative reporter Catherine Herridge posted on X Tuesday that, per a whistleblower complaint, CIA under then-Director Gina Haspel would not document the Chinese influence operations, in a formal way, out of concern that President Trump would use the intelligence to his advantage, WorldTribune reported. The WorldTribune writeup cites no additional corroboration, does not name the whistleblower, and does not identify which committee or inspector general received the complaint.

Analyst Note: The chain runs through a single X post by a reporter whose prior IC whistleblower sourcing, Hunter Biden, Seth Rich, DOJ anti-Trump surveillance cases, has repeatedly generated formal oversight action, giving this more analytic weight than a typical anonymous leak even though WorldTribune adds no independent verification. The claim's testable payload is procedural, did CIA decline to document, did a whistleblower file, not substantive, since Herridge has not published the underlying intelligence and the complaint's filing venue is unidentified. That procedural allegation's arrival alongside DOJ criminal referrals against former IC IG Atkinson and former whistleblower Ciaramella suggests a coordinated declassification-and-referral sequence rather than an organic leak, threading into the prosecutorial 2020 Office of the Director of National Intelligence (ODNI)-CIA tension case Gabbard has been constructing for months.

Sources:

Watch Items - Formal SASC or HASC response to the DIA Iran-retained-capability assessment — letter, hearing schedule, or floor statement - DCAS Iran-war wounded-count stabilizes or receives a public Pentagon reconciliation statement - Any CISA nominee short-list leak or announcement before the next congressional recess. - Follow-on Herridge disclosure naming the whistleblower, committee, or documented CCP operation.

IC Technology & Cyber

OpenAI briefs US federal agencies and Five Eyes partners on GPT-5.4-Cyber model under Trusted Access program

OpenAI demoed its GPT-5.4-Cyber model to approximately 50 cyber-defense practitioners across the federal government at an event in Washington, D.C. on April 22, Axios first reported. OpenAI is beginning briefings with Five Eyes members this week (Australia, Canada, New Zealand, UK) to vet them for access to a more permissive version of the model under a Trusted Access program, Axios said. A broadly accessible version with guardrails will be available to general users, while an advanced version is restricted to vetted security vendors, organizations, researchers, and allied governments. Benzinga reported the advanced version is pitched as a rival to Anthropic's Claude Mythos Preview, which focuses on identifying and remediating software vulnerabilities.

Analyst Note: The Trusted Access tiering, corroborated by Axios and Benzinga, marks the first public instance of a commercial AI vendor constructing a formal Five Eyes access lane around its own product rather than entering through government procurement. The equities once managed through inter-service SIGINT-to-SIGINT sharing, offensive-cyber toolchains and vulnerability-identification pipelines, are migrating to commercial platforms where access is mediated by a vendor's vetting criteria, not IC channels. The framing may be primarily a marketing wrapper on a routine government-customer pipeline, with Axios's sourcing OpenAI-facing and the Five Eyes briefing not necessarily representing a formal intelligence-community arrangement. OpenAI racing Anthropic through the same IC sales channel is unlikely to force ODNI and CISA to publish acquisition guidance within the next 90 days on which commercial AI-cyber platforms may be deployed against which intelligence problems. Purchasing authority is currently distributed across components, and the vendor-vetting shortcut is consequential enough to warrant regulatory attention the institutional machinery isn't positioned to deliver on that timeline.

Sources:

Watch Items - ODNI, CISA, or DoD CIO publishes formal acquisition guidance covering commercial AI-cyber platforms with offensive capabilities - Whether any Five Eyes partner publicly declines the OpenAI Trusted Access vetting path on sovereignty or legal-review grounds

Adversary Intelligence

LayerZero attributes $290M KelpDAO exploit to DPRK Lazarus Group; attackers begin multichain laundering via Thorchain and Umbra

Blockchain-infrastructure firm LayerZero attributed with moderate-to-high confidence the April 18 $290 million exploit of KelpDAO to Democratic People's Republic of Korea (DPRK)'s Lazarus Group, UPI and CoinDesk reported on April 22. CoinDesk tracked roughly $1.5 million bridged from Ethereum to Bitcoin via Thorchain and an additional $78,000 routed through privacy protocol Umbra, consistent with prior Lazarus laundering patterns. The KelpDAO hit follows a Drift Protocol exploit; combined two-week Lazarus takings exceed $500 million, per multiple blockchain analytics firms. Certik separately documented a new Lazarus macOS campaign dubbed Mach-O Man that uses a social-engineering technique called ClickFix to target fintech and crypto-firm executives.

Analyst Note: The $500 million combined two-week take from Drift and KelpDAO, paired with confirmed Thorchain bridging within 72 hours of exfiltration, establishes an operational tempo defenders cannot match at scale. Certik's parallel documentation of the Mach-O Man macOS social-engineering campaign, distinct from the exploit chain but feeding the same laundering infrastructure, marks this as the signature twin-track intake of the DPRK Reconnaissance General Bureau (RGB) Bureau 121 cryptocurrency-generation program rather than opportunistic criminal activity, a reading corroborated across multiple blockchain analytics firms. On-chain tracking has since surfaced the Thorchain and Umbra bridging steps absent from the first-day picture. US Treasury Office of Foreign Assets Control (OFAC) designation of the specific wallet clusters is likely within 30 days given Treasury's post-attribution sanctions pattern, with each additional pre-designation day converting more exfiltrated ETH into eventually-sanctioned liquidity that DeFi operators refuse to touch. LayerZero's attribution confidence is not neutral; the firm has a commercial-recovery incentive to accelerate a DPRK finding, and the attribution warrants sharpening by independent blockchain analytics before treating it as settled.

Sources:

Prior Reporting - [LayerZero blames Kelps setup for $290 million exploit, attributes it to North Koreas Lazarus](https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus) (2026-04-20) - [LayerZero Pins $292M KelpDAO Bridge Hack on North Koreas Lazarus Group](https://decrypt.co/364872/layerzero-pins-292m-kelpdao-bridge-hack-on-north-koreas-lazarus-group) (2026-04-20)

Metropolitan Police probe whether Harakat Ashab al-Yamin al-Islamia arson wave is IRGC criminal-proxy operation; 25 total arrests

The UK Metropolitan Police is investigating whether a wave of arson attacks on Jewish sites and Persian-language media in London, claimed by Harakat Ashab al-Yamin al-Islamia, is an Islamic Revolutionary Guard Corps (IRGC) criminal-proxy operation, Jerusalem Post, NPR, and CNN reported this week. UK counter-terrorism officers made two further arrests on April 22-23, bringing the total to 25 across six attacks, Jerusalem Post said. Deputy Assistant Commissioner Vicki Evans: 'One of our key lines of inquiry is whether criminal proxies are being used to commit any of these arsons.' Harakat Ashab al-Yamin al-Islamia had not previously been in Western threat databases; Israeli officials describe it as a suspected Iranian-proxy flag of convenience.

Analyst Note: The Met's working hypothesis, IRGC sub-contracting to UK petty criminals under a flag-of-convenience brand, corroborated across Jerusalem Post, NPR, and CNN, fits the pattern UK authorities documented from 2024 onward in assassination and intimidation plots against dissidents on British soil. The 25-arrest caseload across six attacks in roughly two weeks is unusually dense for a single counter-terrorism command, and arrest pace will probably slow as investigators shift from rapid plot-disruption to charging decisions carrying higher evidence thresholds. A formal UK proscription of Harakat Ashab al-Yamin al-Islamia or a related shell is unlikely within six months, even as the arrest cluster hands the Home Office a legal framework reusable against future IRGC proxy brands. Harakat Ashab al-Yamin may instead be a genuinely independent jihadist micro-cell posturing as Iranian-directed to amplify deterrence and press coverage, a possibility the Met has publicly flagged and one the absence of confirmed handler visibility would support.

Sources:

JUMPSEC ties MuddyWater to TAG-150 CastleRAT platform and previously undocumented ChainShell Node.js agent

A JUMPSEC report links Iran's MOIS-affiliated MuddyWater (Mango Sandstorm) to at least two builds of the Russian-developed TAG-150 CastleRAT commercial malware-as-a-service platform, Cyber Security News reported on April 22. JUMPSEC established the link via an exposed command-and-control server carrying Farsi code comments, Israeli target IP lists, and a PowerShell script named reset.ps1 that deploys ChainShell, a previously undocumented Node.js agent that dynamically resolves command and control (C2) addresses via the Ethereum blockchain for takedown resilience. JUMPSEC linked the operator via a shared Amy Cherne code-signing certificate used for both MuddyWater StageComp tooling and CastleRAT installers, and through shared campaign identifier Smokest. No prior public report has tied MuddyWater to a Russian commercial MaaS ecosystem.

Analyst Note: MuddyWater's confirmed procurement of TAG-150 CastleRAT, anchored by a shared Amy Cherne code-signing certificate linking StageComp tooling to CastleRAT installers and the shared Smokest campaign identifier, per JUMPSEC's technical analysis of an exposed C2 server, breaks the long-standing analytic assumption that clean custom-tool attribution will continue to isolate MOIS-affiliated operations from peer and criminal-ecosystem services. Every defender running Iran-centric detection rules should now add TAG-150 signatures and cross-reference existing criminal-ecosystem intelligence. The certificate link could instead reflect a Russian criminal operator running tooling under contract for MOIS, which shifts the posture from expect TAG-150 in state-espionage incidents to expect multi-tenant tooling with MOIS as one tenant. ChainShell's Ethereum blockchain C2 resolution is the takedown-resilience capability incident responders inside Israeli critical infrastructure will likely encounter in the next 30 days.

Sources:

Iran hangs alleged MEK member Soltanali Shirzadi Fakhr for cooperating with Israeli intelligence

Iran executed Soltanali Shirzadi Fakhr on April 23, saying he had been a long-time member of the Mojahedin-e Khalq (MEK) and was found guilty of cooperating with Israeli intelligence, regime outlet Mizan reported via Reuters and Jerusalem Post. Iranian dissidents bemoaned European silence after the latest hanging, per earlier Jerusalem Post reporting. Mizan did not describe the alleged operational role or provide evidentiary material beyond the regime-court finding.

Analyst Note: The MEK-Mossad framing, per single regime-outlet Mizan relayed through Reuters, recycles Cold War dual-loyalty tropes the ayatollahs' base reliably accepts, serving a domestic narrative that internal penetration explains wartime setbacks rather than military failure. Fakhr may have had no operational Israeli-intelligence contact and been selected on MEK-association grounds with the Mossad attribution added for narrative utility; Iranian judicial records rarely survive independent review. Further executions of alleged Mossad assets are likely in the coming 2–3 weeks as Tehran extends politically useful framing.

Sources:

Watch Items - Iran conducts at least one additional execution on alleged Mossad-collaboration grounds - UK Home Office proscribes Harakat Ashab al-Yamin al-Islamia or a closely linked shell under the Terrorism Act 2000 - OFAC designates wallets connected to the KelpDAO exfiltration path

Allied Intelligence

Frances ANTS secure-documents agency confirms 19 million ID-portal records exposed; ANSSI leading forensic response

France's National Agency for Secure Documents (ANTS) confirmed on April 22 that hackers accessed backend systems of its online portal ants.gouv.fr and extracted personal data on up to 19 million individuals, including full names, birthplaces and dates, email and phone contacts, residential addresses, and identity-verification data, Help Net Security and TechCrunch reported. The Ministry of the Interior, Agence nationale de la sécurité des systèmes dinformation (French cybersecurity agency) (ANSSI) (National Cybersecurity Agency), and Commission nationale de linformatique et des libertés (French data-protection authority) (CNIL) (the General Data Protection Regulation (GDPR) data-protection authority) have all been activated. A threat-actor collective under the aliases breach3d and ExtaseHunters claimed the compromise. ANTS issues French identity cards, passports, and vehicle registrations.

Analyst Note: The exposure is substantively different from a citizen-data breach: at this scale, a name-birthdate-address-identity-verification dataset enables identity-assumption attacks against French nationals traveling abroad, a direct counterintelligence exposure for services running standoff collection against expatriate communities. The breach3d and ExtaseHunters profile is consistent with criminal rather than state-linked activity, corroborated across multiple outlets, and criminal resellers publish faster than state actors hoard. Portions of the ANTS dataset are likely to surface on a paste or criminal-forum channel within 28 days, at which point passport-revocation and document-reissuance decisions France would normally resist become unavoidable. A state actor may instead be laundering the exfiltration through a criminal-persona layer, a pattern associated with Russian-speaking operations, in which case the data may never surface publicly and the forensic picture will remain ambiguous.

Sources:

Two IAF F-15 technicians at Tel Nof Airbase charged with passing engine diagrams and senior-officer targeting data to Iran during Operation Roaring Lion

Two Israeli Air Force technicians at Tel Nof Airbase are being charged with espionage for Iran over the transfer of F-15 engine diagrams and photographs (including the face of a flight instructor, a military-censorship breach) during Operation Roaring Lion, Jerusalem Post/Kan, Israeli public broadcaster (KAN) reported on April 22. Prosecutors are weighing upgrading the charges against one of the technicians to treason. Handlers also tasked the pair with gathering intelligence on former Israel Defense Forces (IDF) Chief of Staff Lt.-Gen. (ret.) Herzi Halevi and National Security Minister Itamar Ben-Gvir. Eight additional soldiers at Tel Nof are suspected of knowing about the activity without reporting it.

Analyst Note: Converging Israeli reporting makes this the first publicly charged Operation Roaring Lion case to reach Iranian-handler senior-officer targeting tasking, a step beyond the citizen-recruitment pattern of earlier Shin Bet disclosures. The F-15 engine diagram transfer carries export-control consequences that extend well beyond domestic prosecution: the material implicates U.S. Foreign Disclosure obligations and will likely trigger a bilateral Major Defense Equipment (MDE)-program review. The Military Advocate General (Israel) (MAG)'s move toward treason charges against one defendant signals confidence in Iranian-handler contact evidence beyond document transmission alone. The eight additional Tel Nof soldiers flagged for non-reporting are the analytically important datapoint. Criminal indictment of that cohort within the next 90 days is unlikely; non-reporting groups typically resolve through administrative or disciplinary action, and cooperation in questioning undercuts the knowing-concealment threshold. The Halevi and Ben-Gvir targeting tasking fits a counterintelligence pattern in which Iranian services deliberately steer recruits toward politically inflammatory figures to provoke an over-reaction, so the senior-official tasking may be signaling rather than operational collection.

Sources:

Unification Minister Chung rejects US and opposition criticism over Kusong naming as political trick

South Korean Unification Minister Chung Dong-young publicly rejected criticism of his parliamentary identification of Kusong as a North Korean uranium enrichment site, calling the allegation that he leaked US-shared classified intelligence a political trick, Korea Times reported on April 23. Chung said his remarks drew from publicly available expert reports and press coverage rather than classified material. US officials and ROK opposition lawmakers had argued his March parliamentary statement confirmed intelligence Washington had shared in confidence. Seoul and Washington had previously only officially acknowledged Yongbyon and Kangson as North Korean enrichment facilities. Chung said he is confident the controversy will not harm South Korea-US relations.

Analyst Note: Chung's political-trick framing converts a bilateral intelligence-sharing rupture into a domestic partisan defense, the worst available posture for a minister accused of officially confirming a previously-unacknowledged DPRK enrichment site on the basis of US-shared intelligence. Washington's concern will not be resolved by a plausible-deniability claim that Kusong was already in open-source reporting; the damage runs on what ROK identified officially, not what anyone could have inferred privately. Per single-source Korea Times coverage, Chung's public refusal to concede ground forecloses the quiet-walkback path Washington would normally prefer, marking a deterioration from the April 20 cycle, which reported only a partial restriction of satellite-intelligence sharing. That restriction will probably persist through the next US-ROK defense ministerial in Q2, and the minister's public posture makes accelerated restoration unlikely within the next 30 days. The framing may instead reflect internal ROK legal advice that any concession would prejudice a parliamentary inquiry into classified-handling violations, litigation posture rather than policy signal. Either way, allied governments that trade intelligence discipline for domestic political capital absorb the reciprocity costs later and quietly.

Sources:

Watch Items - Portions of the ANTS dataset appear on a criminal forum or paste site - Additional Tel Nof personnel beyond the two charged and eight flagged non-reporters are indicted - Any Seoul-Washington bilateral statement on the Kusong disclosure or a timed restoration of specific intelligence-sharing channels

COLLECTION GAPS

UNCLASSIFIED // OPEN SOURCE