← Back to Archive

IC BRIEF

Current as of 0725 EDT (UTC-04), Saturday 30 May 2026

Contents

• Allied Intelligence (5)
• Adversary Intelligence (4)
• Counterintelligence & Tradecraft (1)

10 stories from 36 sources across 33 organizations

---

Allied Intelligence

New Zealand Budget Spares Defense and Intelligence Agencies From Austerity Cuts

Finance Minister Nicola Willis announced on May 28 that defense and intelligence agencies are exempt from the 2% operating cuts applied to most agencies, with the NZDF budget rising from $5.064 billion to $5.491 billion in 2026/27 1. Combined intelligence appropriations increase 20 percent to $486.4 million, with $71.4 million allocated to the Government Communications Security Bureau and $84.3 million to the NZ Security Intelligence Service over four years 1. Key NZDF investments cover Anzac frigate life extensions, Pacific and Southern Ocean surveillance drones, and $120 million over four years to bring military pay closer to market rates 12. Budget 2026 funds the second year of the government's four-year, $12 billion Defence Capability Plan targeting 2 percent of GDP by 2032/33, and Willis told Parliament that New Zealand faces "the most adverse and contested geostrategic environment in the past 80 years" 1.

Analyst Note: The undisclosed GCSB single-year appropriation jump of $57 million mirrors the 2023 surge later attributed to a classified all-of-government data center, indicating an active infrastructure or collection program Wellington has declined to publicize. Anzac frigate life-extension funding buys operational continuity through mid-decade but defers the capital decision that will define the Royal New Zealand Navy's combat posture into the 2040s. Personnel shortfalls of approximately 1,000 remain the binding constraint: the $30 million annual pay increment falls well short of what service advocates estimate is needed to stabilize retention, and platform investments risk outpacing the workforce required to operate them. Pacific and Southern Ocean drone procurements extend New Zealand's maritime surveillance reach into collection gaps Five Eyes partners have long sought to fill.

Sources:

1: Budget 2026: Boost to defence spending as surge to 2% of GDP continues - NZ Herald

2: New Zealand budget spares defense, intelligence agencies from cuts - Defense News

Budget at a Glance: Securing New Zealand's Future - New Zealand Treasury

Budget 2026 boosts Pacific aid and defence spending amid security concerns - RNZ

Shin Bet Dismantles Jerusalem Terror Cell Directed by French PFLP Operative From Overseas

The Shin Bet and Israel Police announced Tuesday the November-December 2025 arrests of five East Jerusalem residents recruited into a PFLP cell by Salah Hamouri, a French-Palestinian lawyer deported to France after Israel revoked his residency in 2022 123. Hamouri allegedly met recruits at multiple European locations in 2024 and 2025, supplying encrypted phones to coordinate planned attacks in the Jerusalem area 123. Two suspects, brothers Yazid and Said Dadu, have been indicted on charges of active PFLP membership, conspiracy to commit a terrorist act, and prohibited property transactions for terrorist purposes 13.

Analyst Note: French authorities are unlikely to open a formal criminal investigation into Hamouri within 180 days of the Shin Bet announcement. Moderate confidence rests on France's consistent treatment of Hamouri as a political figure since his 2022 deportation and on the absence of any French prosecutorial mechanism currently targeting him. The disclosed pattern demonstrates that a diaspora-based handler can sustain operational cell activity inside Israel by using legitimate activist credentials to cover recruitment travel, encrypted communication, and attack planning. The Dadu indictments constitute a durable evidentiary record that allied services and prosecutors can draw on if French political conditions shift.

Sources:

1: Israel dismantles terror cell led by French PFLP operative - JNS

2: Shin Bet, police bust east Jerusalem terror cell headed by PFLP terrorist in France - The Jerusalem Post

3: Israel says French-Palestinian lawyer operated East Jerusalem terror network from overseas - The Times of Israel

Ukrainian SBU and Military Intelligence Thwart Russian-Directed Terror Attack in Odesa

The SBU, HUR, and Ukrainian Navy detained four suspects near the Odesa port after they delivered a fiber-optic-guided strike drone packed with explosives, concealed in counterfeit tobacco smuggled from Russian-occupied Abkhazia 123. The SBU identified the organizer as an Odesa businessman currently abroad who agreed to cooperate with the FSB in exchange for continued smuggling access in the Caucasus; HUR reported the operation had been running for more than a year 12. He enlisted three Odesa residents and a local border guard officer to facilitate delivery; the cargo transited neutral waters near Snake Island, transferring from a main vessel to small boats for the Odesa coastline approach 13. Searches in Odesa and Chernivtsi regions yielded 1,800 boxes of counterfeit tobacco, modified automatic firearms, and the drone; all four detainees face charges under Article 332 Part 2, with additional weapons counts under consideration 12.

Analyst Note: The FSB's use of a pre-existing Black Sea tobacco smuggling route to conceal a fiber-optic-guided strike drone demonstrates deliberate tradecraft adaptation: commercial contraband cover defeats maritime interdiction, and the recruited border guard officer eliminated the final access barrier to Odesa's coastline. Prosecution within Ukraine's wartime legal system is likely to produce guilty verdicts against at least two of the four detainees within 18 months, given flagrante delicto detention and documented multi-agency chain of custody. Low analytic confidence reflects sourcing limited to official Ukrainian security service statements with no independent corroboration of operational specifics. The organizer's Abkhazia commercial platform remains intact; in-absentia proceedings resolve the individual threat but leave the underlying smuggling channel available for reactivation.

Sources:

1: SBU prevents terror attack in Odesa, detains men transporting explosive-laden drone - Ukrinform

2: SBU, HUR and Navy Foil FSB-Linked Plot to Smuggle Armed Drone Into Odesa via Sea Route - Kyiv Post

3: SBU claims to have thwarted a terrorist attack in Odesa – smugglers were transporting an explosive-laden drone from Abkhazia - Ukrainian News Agency (UNN)

The SSU detained Russian agents who were transporting a drone loaded with explosives to Odesa - Censor.NET (relaying SSU official statement)

Security Service of Ukraine foiled FSB terror attack attempt with FPV drone in Odesa - Live Universal Awareness Map

Israel AG Indicts Netanyahu Former Advisor for Leaking Classified Military Intelligence to German Media

Attorney General Gali Baharav-Miara announced Thursday the indictment of former Netanyahu adviser Yonatan Urich on charges including transmitting secret information with intent to harm state security, possession of classified material, and evidence destruction 1. The charges stem from a classified IDF document Bild published in September 2024, which prosecutors allege was used to shape Israeli public opinion during the hostage negotiations at a moment of intense pressure on Netanyahu over his Philadelphi Corridor stance 1. Former War Cabinet Minister Gadi Eisenkot has stated the leak burned a critical Gaza intelligence source tracking hostage conditions and that Netanyahu knew the source's identity before the disclosure 2. Urich's attorneys called the decision "detached from the evidence," citing a district court president who found "not a shred of evidence" linking him to the leak 12.

Sources:

1: Attorney-General to indict Benjamin Netanyahu adviser Yonatan Urich in classified-documents affair - The Jerusalem Post

2: Attorney General Files Serious Indictment Against Netanyahu Former Advisor Yonatan Urich - JFeed

Senior Netanyahu aide Urich to be charged with security offenses over Bild leak - The Times of Israel

IDF Intelligence Assessment Reveals How Sinwar Solo Gamble Derailed IRGC Regional War Plan

IDF officials told The Week India that IRGC Quds Force planning attributed to Qassem Soleimani called for simultaneous attacks on Israel by Hamas, Hezbollah, and Iranian-backed networks across multiple fronts; Sinwar launched October 7 unilaterally before the axis was ready 1. A senior IDF security official was quoted saying "nobody really got the memo that they were supposed to go together with him" 1. The IDF said it holds material evidence of multi-year coordination among the groups, including documents, internal conversations, and logistics records shared between Hamas, Hezbollah, and Iranian operatives 1. Files recovered from the tunnel where Muhammad Sinwar was killed separately document IRGC backing for Hamas during the Gaza war, the Times of Israel reported 2.

Sources:

1: Nobody got the memo: IDF claims Yahya Sinwar solo gamble derailed Iran regional war plan - The Week India

2: IDF says files from tunnel where Muhammad Sinwar killed show IRGC backing for Hamas amid Gaza war - The Times of Israel

Adversary Intelligence

Gambit Links Iran MOIS Black Shadow Group to Destructive Campaign Against US Transit Systems

Gambit Security's May 26 report, drawing on corroborating analysis from ClearSky Cyber Security and researcher Simon Kenin, tied the "Ababil of Minab" persona to Black Shadow, a group the Israel National Cyber Directorate attributed to Iran's MOIS, via shared C2 infrastructure and a customized Go tunneler 1. At LA Metro, attackers using an authenticated vCenter session deleted virtual machines and disk partitions on March 16; the authority confirmed the breach on April 2 and reported hundreds of servers required forensic review 12. At the South Florida Regional Transportation Authority, proxied RDP sessions enabled SQL database deletion and file overwrite using a secure deletion utility 1. Gambit also identified undisclosed victims in Israeli media, higher education, and Turkish insurance, where data exfiltration occurred without destructive follow-on 1.

Analyst Note: US government formal attribution of the LA Metro and South Florida RTA attacks to an Iranian state actor within 180 days is genuinely uncertain. The evidentiary chain runs through an Israeli private firm, not a confirmed US intelligence hold, and the government's record on timely public naming of MOIS cyber actors is uneven. The deliberate targeting of virtualization and backup layers, not operational data alone, reflects a recovery-denial intent that marks a departure from data-theft-first MOIS tradecraft. The Ababil of Minab persona follows standard MOIS practice, lowering diplomatic cost while complicating public attribution. Moderate confidence rests on corroboration from ClearSky Cyber Security and researcher Simon Kenin, offset by the absence of confirmed US-held primary sourcing.

Sources:

1: Gambit links Iran-linked Black Shadow group to destructive cyber campaign targeting US, Middle East organizations - Industrial Cyber

2: LA Metro Cyberattack Linked to Iranian State-Sponsored Hackers - SecurityWeek

Attacking the recovery layer: an Iran-MOIS case study - Gambit Security

European Intelligence Officials Warn Russian Spies Aggressively Targeting Western Technology

GCHQ Director Anne Keast-Butler, speaking at Bletchley Park on May 27, stated Russia is "relentlessly targeting" UK and European allies through hybrid operations spanning technology smuggling, sabotage, and assassination attempts 1. Swedish, Finnish, and Estonian intelligence chiefs told AP that Moscow is deploying front companies and cyber intrusions to acquire sanctioned machine tools, dual-use electronics, and research in space and quantum technology, with Sweden's Gripen fighter jet specifically cited among the named targets 23. Swedish Security Service deputy Christoffer Wedelin described a Russia-linked cyberattack on a Swedish power plant last year as a shift from reconnaissance to active destruction, noting Russian operators are now accepting greater attribution risk 2. Swedish police arrested two people in May on suspicion of sanctions violations tied to machine tool shipments routed through a Turkish intermediary 2.

Analyst Note: Russia's willingness to destroy rather than merely observe infrastructure marks a strategic inflection: European services now assess Moscow has crossed from reconnaissance to active sabotage, accepting attribution as an acceptable cost. Swedish prosecutors will likely bring formal charges against at least one of the two May arrestees within six months. Moderate confidence reflects Sweden's established sanctions enforcement track record and the documented customs evidence trail, though the case's full evidentiary scope falls outside open-source visibility. The convergence of machine tool procurement networks, targeted defense industry espionage, and destructive cyber operations indicates Moscow is managing a wartime supply crisis as a whole-of-intelligence-community problem.

Sources:

1: GCHQ Annual Lecture 2026 - as delivered

2: Russian spies aggressively seeking Western technology as sanctions bite: Officials - ABC News

3: Russian spies are aggressively seeking Western technology as sanctions bite, officials say - The Washington Post

Delhi Police Bust ISI-Directed Terror Module With Dawood Ibrahim Links Planning Capital Attacks

Delhi Police Special Cell on Saturday arrested nine individuals linked to what investigators describe as an ISI-directed network coordinated with the Dawood Ibrahim syndicate, seizing firearms, hand grenades, and explosive materials during the operation 123. Sources cited by ANI and The Statesman said the accused were tasked with striking critical installations, security personnel, and prominent religious sites in Delhi; IANS, citing officials, reported the target set also included nuclear installations, airports, and railway stations 123. The nine include individuals of Nepali origin and some foreign nationals, with India TV News reporting arrestees from Delhi, Mumbai, and Punjab 14. Delhi was placed on high alert following the arrests, and investigators have opened a probe into the module's funding channels, recruitment patterns, and handler networks 124.

Analyst Note: The module's target set, spanning nuclear installations, airports, railway stations, and religious sites, confirms ISI intent to pursue mass-casualty or infrastructure-disruption effects inside India, consistent with the deniability-through-homegrown-networks doctrine that Intelligence Bureau officials say accelerated after Operation Sindoor. India's counterterror charging record, applied consistently in comparable Special Cell busts, makes formal charges against at least five of the nine arrested likely within 90 days. Low confidence reflects the evidentiary gap: all sourcing flows through government statements alone, leaving handler identities, funding architecture, and the module's true operational maturity uncharacterized.

Sources:

1: Dawood-ISI nexus exposed; 9 arrested for allegedly plotting attacks on critical installations - ANI

2: Delhi on high alert after terror module linked to Dawood, ISI busted - IANS

3: Delhi Police foil alleged terror plot linked to Dawood network and ISI, 9 arrested; arms and grenades seized - The Statesman

4: Nine arrested as Delhi Police crack alleged ISI-underworld network; major cities were on radar - India TV News

Delhi Police Special Cell Busts Dawood Ibrahim & ISI-Linked Terror Module; 9 Arrested, Arms Seized, Plot To Target Key Installations & Religious Sites In National Capital - Free Press Journal

Pakistan-Linked SideCopy APT Targets Afghan Finance Ministry With Persistent XenoRAT Implant

Seqrite Labs reported Friday a spear phishing campaign attributed with medium-to-high confidence to SideCopy, a Pakistan-linked APT under the Transparent Tribe/APT36 umbrella, targeting Afghanistan's Ministry of Finance and all 34 provincial revenue directorates 123. The lure was a Pashto-language LNK file framed as a seminar employee list, which dropped a decoy provincial staff directory listing Finance Directors, Revenue Chiefs, and direct mobile numbers in Dari and Pashto 13. A five-stage fileless chain staged through a compromised Afghan education domain, patched AmsiScanBuffer() to disable AMSI, and delivered XenoRAT 1.8.7 in memory with Registry persistence established under the typosquatting value "Edgre" 13. The implant beacons over AES-encrypted TCP to a Frankfurt bulletproof C2 server Seqrite previously tied to earlier SideCopy infrastructure clusters 13.

Analyst Note: SideCopy's systematic mapping of all 34 Afghan provincial revenue directorates signals intelligence collection against Taliban fiscal administration at operational depth. The lure's granularity, naming individual Finance Directors and Revenue Chiefs by mobile number, presupposes prior access or a well-placed human source within the target bureaucracy. Pakistan's strategic interest in monitoring Taliban revenue flows gives this targeting persistent logic that will outlast any single intrusion cycle. At least one additional publicly reported SideCopy intrusion targeting Afghan government networks is likely within 90 days. Confidence in this assessment is low; single-vendor reporting from Seqrite yields no independent attribution corroboration, and most Afghan government intrusions go unreported regardless of detection.

Sources:

1: Operation XENOFISCAL: SideCopy deploying persistent XenoRAT targeting the MoF, Afghanistan - Seqrite

2: SideCopy Deploys Persistent XenoRAT Against Afghanistan Finance Ministry - GBHackers

3: SideCopy APT Deploys XenoRAT to Target Afghanistan Finance Ministry - CyberPress

SideCopy APT Hackers Mimic as Government Personnel to Deploy Open-Source XenoRAT Tool - CyberSecurityNews

Counterintelligence & Tradecraft

Georgia Arrests NGO Head on Espionage Charges for Working With Two Foreign Intelligence Services

Georgia's State Security Service arrested Gulbaat Rtskhiladze, founder of the Eurasia Institute, on May 30 under Article 314 (espionage, carrying 8-12 years), alleging he transmitted intelligence to two unnamed foreign states simultaneously over several years for financial compensation 123. First Deputy Head Lasha Maghradze stated at the briefing that Rtskhiladze maintained covert contacts with foreign intelligence representatives inside and outside Georgia and built information platforms and organized events at foreign intelligence direction 1. Civil Georgia characterized the Eurasia Institute as Kremlin-affiliated and reported it has been funded since 2020 by Pravfond, a Kremlin-backed foundation; the SSSG initially withheld the suspect's name and has not officially identified either country 1.

Sources:

1: Georgia Arrests Kremlin-Linked NGO Head on Allegations of Spying for Two Foreign Countries - Civil Georgia

2: Georgia Arrests NGO Head on Espionage Charges - Caspian Post

3: Georgia detains NGO head on espionage charges - News.az