//
OFFLINE — VIEWING CACHED CONTENT
← Back to Archive

IC BRIEF

Current as of 0406 EDT (UTC-04), Wednesday 15 July 2026

Contents

10 stories from 35 sources across 30 organizations

KEY JUDGMENTS

Israeli intelligence faces concurrent exposure in Greece, Lebanon, and Iran. At least one additional espionage-related arrest beyond the Khalifeh detention and Ahmadinejad house-arrest reporting is likely within the next two months, as Lebanon's military judiciary advances prosecution and Mossad's targeting of four senior Iranian officials pressures Tehran's security apparatus. Moderate confidence reflects AFP corroboration on the arrest alongside thin, Israeli-aligned sourcing on recruitment claims. Confirmed Iranian action against a named official would validate penetration rather than a targeted information campaign.

The US intelligence community's analytical capacity on Russia, Ukraine, and Iran is degrading without corrective action. Bureau of Intelligence and Research (INR)'s July 2025 reduction in force eliminated the sole bilateral Russia analyst, sole Ukraine specialist, and most experienced Iran-Russia hand, while Section 702 surveillance authority remains expired and Clayton's Director of National Intelligence (DNI) confirmation is tied to unrelated legislative demands. Allied services are building capacity in the same window: the EU and UK sanctioned Federal Security Service (Russia) (FSB) 16th Center proxies after a decade of cyber operations, and Japan is pursuing its broadest postwar security-services overhaul.

IC Workforce & Organization

Former INR Official Details How State Department Dismissed Experienced Intelligence Analysts to Appease Trump Administration Demands

BLUF: INR's loss of sole-coverage analysts on Russia, Ukraine, and Iran during overlapping crises strips the State Department of independent analytical capacity on its most consequential policy portfolios.

Former State Department Bureau of Intelligence and Research (INR) Russia analyst David Abramson wrote in a July 13 SteadyState essay that the department dismissed six INR employees on July 11, 2025, including five senior analysts averaging 15 years of experience, as part of a broader reduction in force cutting 15 percent of domestic department positions 1. Abramson said the fired analysts included INR's sole specialist on US-Russia relations, an analyst with nearly 20 years covering Russia-Middle East ties including Iran, and an analyst newly assigned as INR's sole Ukraine specialist 1. He said he resigned from INR shortly afterward, citing the department's failure to defend analytical independence 1. SpyTalk reported on the essay, describing INR as an organization that "has often proved more prescient" than the CIA 2.

Analyst Note: INR's July 2025 reduction in force eliminated its only US-Russia bilateral analyst, its most experienced Russia-Middle East/Iran specialist, and the analyst newly named sole Ukraine lead, cutting single points of coverage the bureau cannot surge to replace amid simultaneous Russia, Iran, and Ukraine crises. Sourcing rests entirely on Abramson's first-person SteadyState account, with SpyTalk offering only secondary amplification and no independent corroboration. Damage extends beyond earlier office closures into loss of named country expertise, and Abramson's own resignation a year later shows the attrition continued past the original cuts rather than stabilizing, though the dismissals may equally reflect mechanical application of a government-wide 15 percent staffing target rather than a targeted effort to weaken INR's Russia and Ukraine analytic line.

Sources:

1: How the Secretary of State Degraded his Own Intelligence Agency - SteadyState (David Abramson)

2: Does US Intelligence Matter Anymore? - SpyTalk

Prior Reporting - [Two Intelligence Offices Eliminated at the State Department](https://www.hstoday.us/subject-matter-areas/intelligence/two-intelligence-offices-eliminated-at-the-state-department-substack-reports/) (2026-05-09) - [Two Intelligence Offices Eliminated at the State Department](https://sashaingber.substack.com/p/two-intelligence-offices-eliminated) (2026-05-09)

Jay Clayton Testifies Before Senate Intelligence Committee for DNI Confirmation as Democrats Tie Approval to Section 702 Renewal and Pulte Removal

BLUF: Republican leadership's decision to link Clayton's floor vote to Section 702 renewal has converted a routine same-party confirmation into a hostage in an intra-coalition legislative dispute with no clear resolution timeline.

Jay Clayton, US attorney for the Southern District of New York and Trump's nominee for Director of National Intelligence, testified Wednesday before the Senate Intelligence Committee, weeks after Trump delayed the hearing via social media 1. Committee Chairman Tom Cotton said Clayton had been instructed not to appear at the originally scheduled hearing before it was rescheduled with apparent White House approval 1. Democrats including Mark Warner and Richard Blumenthal have withheld or signaled opposition to Clayton's confirmation, while some, including Blumenthal, said they would not block an accelerated vote 1. Republicans including Mike Rounds have linked Clayton's confirmation to renewal of FISA Section 702, which expired in June after Democrats said they would withhold votes unless interim appointee Bill Pulte's post was withdrawn 1.

Analyst Note: Confirmation would restore permanent DNI leadership and remove interim appointee Bill Pulte, whose lack of intelligence background and prior use of a housing post to target perceived presidential adversaries has drawn bipartisan unease, a judgment resting with high confidence on the Senate Select Committee on Intelligence (SSCI) hearing notice, wire coverage of Wednesday's testimony, and both parties' stated positions. Republicans have made confirmation a precondition for renewing Section 702 surveillance authority, lapsed since June, tying Clayton's timeline to that stalled negotiation rather than committee consensus, even as Democrats including Blumenthal signal they won't obstruct an accelerated floor vote. Testimony under oath converts a scheduling dispute into a confirmation fight forcing senators to stake public positions on the 702 linkage; that linkage may equally reflect Republicans using the surveillance lapse as leverage to speed the vote rather than a genuine policy connection between the two measures.

Sources:

1: Senate to hold hearing for Trump's pick to head intelligence agencies after weekslong delay - Associated Press

Open Hearing: Nomination for the Honorable Walter "Jay" Clayton III to be Director of National Intelligence - Senate Select Committee on Intelligence

Prior Reporting - [Senate panel to hold hearing to confirm director of national intelligence](https://www.jns.org/news/u-s-news/senate-panel-to-hold-hearing-to-confirm-director-of-national-intelligence) (2026-07-10) - [Open Hearing: Nomination for the Honorable Walter "Jay" Clayton III to be Director of National Intelligence](https://www.intelligence.senate.gov/hearings) (2026-07-10) - [Senate panel schedules confirmation hearing for DNI nominee Jay Clayton](https://www.upi.com/Top_News/US/2026/07/10/jay-clayton-hearing/2781783703846/) (2026-07-10) - [Jay Claytons US intelligence director nomination hearing set for July 15](https://kelo.com/2026/07/07/jay-claytons-us-intelligence-director-nomination-hearing-set-for-july-15/) (2026-07-08) - [Jay Clayton's US intelligence director nomination hearing set for July 15](https://wtvbam.com/2026/07/07/jay-claytons-us-intelligence-director-nomination-hearing-set-for-july-15/) (2026-07-07) - [Senate Panel Schedules Jay Clayton Confirmation Hearing](https://politicalwire.com/2026/07/07/senate-panel-schedules-jay-clayton-confirmation-hearing/) (2026-07-07)

Counterintelligence

American Seismologist Youlin Chen Faces Espionage Trial in China After Nearly Two Years of Detention

BLUF: Beijing will likely convict Chen within 12 months, positioning the case as diplomatic leverage or deterrent signaling ahead of Xi's planned September visit to Washington.

American seismologist Youlin Chen, 54, faces trial in China on espionage charges after nearly two years in detention, his wife Yufang Rong and advocacy group Global Reach said, warning the offense carries a possible death sentence under Chinese law 123. Chinese state security agents detained Chen at Beijing Capital International Airport on November 5, 2024, as he prepared to board a flight to Boston, and charged him with espionage; Global Reach said Chinese authorities have questioned him more than 100 times about his past seismic research on North Korean nuclear tests 34. Secretary of State Marco Rubio designated Chen wrongfully detained in March, the only American in China to hold that status, and President Trump raised the case with Xi Jinping in Beijing in May, according to Rong and the State Department 13. Chinese foreign ministry spokesperson Lin Jian said Tuesday there is "no instance of wrongful detention" in China 4.

Analyst Note: Chinese authorities are likely to convict Youlin Chen at trial within the next 12 months, since Beijing rarely brings espionage cases to open proceedings without securing conviction and has already conducted over 100 interrogations building the record for prosecution. Moderate confidence reflects consistent family and advocacy-group reporting on the trial trajectory but no independent visibility into China's judicial deliberations or charging file. A conviction would extend Beijing's pattern of using detained American scientists and researchers as diplomatic leverage ahead of Xi's planned September visit to Washington, complicating Trump's push for a broader détente. Sentencing severity, ranging from prison to death, will signal whether Beijing intends the case as a bargaining chip or a deterrent message to researchers with prior national-security-adjacent work.

Sources:

1: American scientist who researched North Koreas nuclear tests faces espionage trial in China - Newsweek

2: Exclusive-China Detains US Seismologist Who Has Studied North Korean Nuclear Tests - Reuters

3: U.S. seismologist has been detained in China for nearly 2 years with no trial, his family says - Associated Press

4: China rejects report that U.S. scientist Youlin Chen is being wrongfully detained - CBS News

Lebanon Arrests High-Level Agent Close to Hezbollah for Allegedly Spying for Israel

BLUF: Confirmed Israeli human penetration at the command-security level forces Hezbollah into an internal vetting purge that will degrade operational trust and cohesion more than the original intelligence loss.

A Lebanese judicial official told AFP that security forces arrested a "high-level Israeli agent" last week at Beirut's Rafik Hariri International Airport as he prepared to board a flight to Iraq 123. Asharq Al-Awsat identified the detainee as a member of the Khalifeh family from southern Lebanon, reporting that Lebanon's military judiciary took over the case after the Internal Security Forces' Information Branch completed its preliminary investigation 4. The official said the suspect, close to Hezbollah commanders, traveled through Iraq, where his wife is from, then on to Turkiye to meet Mossad-linked officers and hand over targeting information gathered in Beirut 23. According to the official, that intelligence contributed to the killing of four top-tier Hezbollah security leaders, though he did not name them or specify dates; Asharq Al-Awsat's judicial source said those killed are believed to include Fuad Shukr and Ibrahim Aqil, both assassinated in 2024 4.

Analyst Note: The arrest confirms Israeli intelligence achieved sustained human penetration of Hezbollah's inner security circle, not merely technical collection, directly enabling the 2024 killings of Fuad Shukr and Ibrahim Aqil. Transfer of the case to Lebanon's military judiciary signals the state intends prosecution rather than quiet handling, a step that will surface additional tradecraft details, including the Iraq-Turkiye transit route used for Mossad contact. Hezbollah faces renewed pressure to tighten internal vetting of personnel with proximity to senior commanders, a process that historically triggers additional arrests or disappearances within the group's own ranks.

Sources:

1: Lebanon arrests high-level agent close to Hezbollah for allegedly spying for Israel - Times of Israel

2: Lebanon detains man close to Hezbollah for allegedly spying for Israel: judicial official - Arab News

3: Lebanese security detains alleged Israeli spy inside Hezbollah network - Israel National News (Arutz Sheva)

4: Lebanon Arrests 'Israeli Agent' Whose Intel Led to Assassination of Top Hezbollah Officials - Asharq Al-Awsat

IC Oversight & Policy

Rubio Turned On Disappearing Signal Messages Despite Court Declaration He Does Not Use Auto-Delete

BLUF: Rubio's post-declaration activation of auto-delete and the department's silent retreat from its sworn denial create compounding spoliation risk that Democracy Forward can now exploit with specificity.

A State Department adviser told a federal court on September 9 that Secretary of State Marco Rubio "does not use the auto-deletion functions in third party messaging applications when sending communications that may include federal records," in a declaration filed by Susan Weetman amid Freedom of Information Act litigation over Rubio's Signal records 1. About two months later, Rubio changed the settings on a Signal chat with other senior officials so messages would auto-delete after a set period, according to a person familiar with the exchange cited by The Atlantic 1. A State Department official contested that Rubio has made a practice of enabling disappearing messages but did not address the specific instance, and in an April 30 court filing tied to a separate settlement, the department did not repeat its earlier claim that Rubio does not use auto-deletion 1. Raw Story, citing The Atlantic's reporting, characterized the shift as Rubio's lawyers retreating from their original court representation 2. Litigation records also showed a three-person Signal chat among Rubio, Defense Secretary Pete Hegseth, and Joint Chiefs Chairman Gen. Dan Caine set to auto-delete after eight hours, and that Rubio's government phone had been equipped in July 2025 with LeapXpert software intended to preserve Signal messages regardless of auto-delete settings 1.

Analyst Note: Weetman's sworn September declaration that Rubio avoids auto-deletion sits uneasily against his subsequent activation of disappearing messages on a Signal chat with senior officials, reopening spoliation exposure in the Democracy Forward Freedom of Information Act (FOIA) litigation regardless of whether LeapXpert captured the deleted content. The department's April 30 filing quietly dropped the "does not use" language rather than correcting it, inviting judicial scrutiny of whether the original declaration was accurate when made, and the redacted eight-hour auto-delete chat among Rubio, Hegseth, and Caine gives litigants a concrete comparison point beyond Rubio's own account. The Atlantic is the sole primary source, with Raw Story amplifying rather than independently confirming, leaving the episode single-sourced. The shift may instead reflect routine security hygiene rather than evasion, consistent with eliminating records already archived elsewhere, and the case tests whether server-side capture tools satisfy preservation duties assigned to the eMessaging platform rather than Signal itself.

Sources:

1: Marco Rubio's Disappearing Signal Chat - The Atlantic

2: Rubio's lawyers retreat in court after denying his Signal war chats set to auto-delete - Raw Story

Trumps DNI Pick Clayton Signed NYT Subpoenas as Progressive Groups Demand Democrats Oppose Nomination

BLUF: Clayton's subpoenas are unlikely to be withdrawn within six weeks given White House direction, leaving press-freedom conduct rather than intelligence qualifications as the confirmation's central fault line.

Jay Clayton, the U.S. Attorney for the Southern District of New York and Trump's nominee for director of national intelligence, signed subpoenas issued Friday against New York Times reporters over their coverage of security flaws in the Qatari-donated Air Force One 12. HuffPost reported the subpoenas, though authorized by Clayton, were sought at the White House's demand 1. Progressive groups led by Demand Progress, including Indivisible and Reporters Without Borders, sent letters Monday urging Senate Democrats to oppose Clayton's confirmation ahead of a Wednesday Senate Intelligence Committee hearing 123. Sen. Ron Wyden of Oregon said federal agents hand-delivered some subpoenas to reporters' homes and called the tactic disqualifying for a DNI nominee 2, while Sens. Mark Warner of Virginia and Mark Kelly of Arizona said they had not decided their votes but would question Clayton at the hearing 12.

Analyst Note: Withdrawal or narrowing of the subpoenas within the next six weeks is unlikely, since the White House directed them and Clayton has given no indication of retreat. Progressive pressure will keep press-freedom conduct, not qualifications, at the center of Wednesday's hearing, forcing Warner and Kelly to stake public positions before a vote. Republican defection, not Democratic unity, remains the more plausible path to derailing confirmation, and none has surfaced. High confidence rests on consistent reporting across outlets on the subpoenas' White House origin and on the absence of any Justice Department signal of reconsideration.

Sources:

1: New York Times Subpoenas Could Complicate Jay Clayton's Confirmation - HuffPost

2: Trumps Intel Pick Played Key Role in NYT Subpoenas But Some Democrats Still On the Fence - The Intercept

3: After NYT Subpoenas, Senate Dems Urged to Oppose Clayton for Trump Spy Chief - Common Dreams

Trump's spy chief pick suddenly in trouble — over a leak that leaked: report - Raw Story

Prior Reporting - [Trump Cancels Jay Clayton DNI Hearing As Bill Pulte Stays In Acting Role](https://www.foreignpolicyjournal.com/2026/06/17/trump-cancels-jay-clayton-dni-hearing-as-bill-pulte-stays-in-acting-role/) (2026-06-17) - [Trump says Pulte to remain as acting DNI, Clayton hearing canceled](https://www.washingtonpost.com/politics/2026/06/17/trump-says-pulte-remain-acting-dni-cancels-clayton-hearing/) (2026-06-17) - [Senate delays Jay Clayton's nomination for intel director after Trump post](https://www.nbcnews.com/politics/donald-trump/trump-delays-jay-clayton-nomination-intel-director-fisa-save-america-rcna350470) (2026-06-17) - [Senate moving forward with Clayton DNI confirmation hearing despite Trump move to delay](https://www.cbsnews.com/news/jay-clayton-senate-confirmation-hearing-director-of-national-intelligence/) (2026-06-17) - [Trump names SDNY chief Jay Clayton as DNI nominee after Pulte backlash](https://jewishinsider.com/2026/06/jay-clayton-dni-appointment-announced/) (2026-06-11) - [Trump names Jay Clayton to serve as director of national intelligence](https://www.npr.org/2026/06/11/nx-s1-5855365/trump-director-of-national-intelligence-jay-clayton-bill-pulte-fisa-702) (2026-06-11)

Allied Intelligence

Mossad Posts Provocative Image Targeting Four Senior Iranian Officials as Potential Double Agents

BLUF: Mossad's provocative post functions as a trust-fracturing information operation against Iranian leadership, and formal Tehran confirmation of espionage action against Ahmadinejad remains unlikely through late August.

Mossad's Persian-language account on X posted an image on Wednesday depicting Parliament Speaker Mohammad Bagher Ghalibaf, President Masoud Pezeshkian, Foreign Minister Abbas Araghchi, and former President Mahmoud Ahmadinejad each marked with a Star of David on the hand and wearing an earpiece, captioned with the Farsi phrase "Which of them?" 123. The post followed a New York Times report, cited by JFeed, Israel National News, and Matzav, that former Mossad chief David Barnea met Ahmadinejad in Hungary in 2024 under cover of a climate conference to discuss him as a potential successor to Iran's leadership, and that an Israeli airstrike on Ahmadinejad's Tehran compound targeting his bodyguards and armored vehicle later prompted Mossad to extract him to a safe location inside Iran, from which he departed under unclear circumstances after growing disillusioned with the operation 123. JFeed reported the image appeared about 24 hours after US publications said the Islamic Revolutionary Guard Corps had placed Ahmadinejad under house arrest over alleged secret communications with Israeli intelligence 1. Iranian state media subsequently showed Ahmadinejad attending a memorial for Ali Khamenei at the Imam Khomeini shrine in Tehran 1.

Analyst Note: Formal Iranian confirmation of espionage-related action against Ahmadinejad, whether arrest, indictment, or continued detention, is unlikely by August 29, 2026, given Tehran's public display of normalcy at Khamenei's memorial services days after the house-arrest allegations surfaced. Confidence in this judgment is low, reflecting reliance on a single reporting thread drawn entirely from Israeli-aligned outlets amplifying a Mossad information operation rather than Iranian sourcing. The image itself functions as psychological pressure regardless of whether any named official is actually compromised, aiming to fracture trust among Iran's senior leadership at a moment of acute vulnerability following the war. Continued silence or denial from Tehran would reinforce Mossad's messaging strategy without validating the underlying espionage claims.

Sources:

1: The Tehran Spy Hunt: Israeli Mossad Tweets Cryptic Image Targeting Top Iranian Officials as Double Agents - JFeed

2: 'Which of Them?': Mossad trolls Iran leaders with cryptic post - Israel National News (Arutz Sheva)

3: "Which of Them?": Mossad Trolls Iran's Leadership, Hints Top Officials May Be Israeli Agents - Matzav.com

Japan Races to Build Counterintelligence Capabilities After Emerging as Hub for Russian Espionage Operations

BLUF: Tokyo's new intelligence coordination body addresses bureaucratic fragmentation but not the core vulnerability: absent an espionage statute, Russian procurement networks operate legally on Japanese soil.

The New York Times reported Sunday that Russian intelligence has turned Japan into a procurement hub for dual-use technology feeding Moscow's war in Ukraine, citing Ukrainian government estimates that Japanese-made components appear in 90% of Russian missiles and drones 12. The report identified Maksim Vladimirovich Filchenkov, a Russian operative who took up his post undercover at Aeroflot's Tokyo office in February 2024, as running the operation for the 20th Directorate, a secretive Russian military intelligence unit whose role has never before been publicly disclosed, which routes parts through intermediary firms in Vietnam, Uzbekistan and Sri Lanka 12. Ukraine provided Japan with lists of recovered missile and drone components manufactured by major Japanese firms including Nippon Electric Corp., Panasonic and Toshiba, all of which denied wrongdoing and said they comply with Japan's export sanctions 12. Japan has no law specifically criminalizing espionage, leaving many forms of spying legal under its postwar security framework 3. Chief government spokesman Minoru Kihara said Monday that Tokyo recognizes a "growing need" to counter foreign intelligence activity and must act "with even greater rigor," citing the National Intelligence Council Establishment Act passed by parliament in May, which creates a 700-strong National Intelligence Bureau to coordinate Japan's intelligence services, while declining to address the NYT report directly 1.

Analyst Note: Tokyo's response signals a structural pivot rather than an isolated countermeasure, with the Takaichi government pursuing what regional coverage frames as the broadest postwar overhaul of Japan's security services, moving beyond Kihara's rhetorical acknowledgment toward the parliament-approved coordinating body, though moderate confidence reflects converging secondary accounts around the NYT investigation without independent primary corroboration of the component figure or Filchenkov's named role. That body coordinates intelligence rather than prosecutes crimes, so the gap enabling Filchenkov's network and its Vietnam, Uzbekistan and Sri Lanka transshipment routes persists absent a dedicated espionage statute, leaving diversion of dual-use components into Russian missile and drone production a legal activity for operatives under commercial or diplomatic cover. Filchenkov's exposure after four years without direct Tokyo-Moscow flights more plausibly reflects a tip from a foreign intelligence service than detection through Japan's own counterintelligence capacity.

Sources:

1: Japan Admits Need to Counter Espionage After Russian 'Den of Spies' Report - The Moscow Times

2: Is Japan a 'spy paradise' fuelling Russia's war machine? - South China Morning Post

3: Den of spies: why has Japan been easy prey for Russian espionage, and what is Tokyo doing about it? - The Guardian

How Putin Turned Japan Into a Den of Spies - The New York Times

How Putin Turned Japan Into a Den of Spies - The New York Times

Prior Reporting - [Japan admits growing need to counter espionage after Russian den of spies report](https://www.theguardian.com/world/2026/jul/14/japan-espionage-russia-den-of-spies) (2026-07-14) - [Russian spies use Japan as base, report says](https://www.semafor.com/article/07/12/2026/russian-spies-use-japan-as-base) (2026-07-12) - [Japan says must better combat foreign spies on its soil](https://www.manilatimes.net/2026/07/13/world/japan-says-must-better-combat-foreign-spies-on-its-soil/2383144) (2026-07-13) - [How Putin Turned Japan Into a Den of Spies](https://www.nytimes.com/2026/07/12/world/asia/russia-spies-japan-war-drones-electronics.html) (2026-07-12)

IC Technology & Cyber

Intellexa Founder Tal Dillian Admits in Israeli Court Filing He Personally Sold Predator Spyware to Greek State Authorities

BLUF: Dilian's written admission that he sold Predator directly to Greek state authorities likely compels Athens to abandon its rogue-actor defense well before any Israeli hearing concludes.

Intellexa founder Tal Dilian, in an Israeli defamation lawsuit filed November 25, 2025 in the Rishon Lezion Magistrate's Court, stated for the first time in writing that he personally sold the Predator spyware to Greek state authorities, calling the sale legal while denying any role in its later illegal use 123. The suit targets journalist Thanasis Koukakis, a confirmed Predator victim, and seeks 300,000 shekels in defamation damages; it is pending in Israel, with a hearing expected within two months 13. Zacharias Kesses, the victims' attorney who disclosed the filing, said he will forward it to Supreme Court Prosecutor Evangelos Bakelas and seek certified copies through international judicial assistance 123. Kesses named five Intellexa executives who have not yet testified to Greek authorities: technical director Merom Harpaz, administrative manager Einat Semama, and technical staff Dimitris Xypteras, Ioannis Toumpis, and Ioannis Boliaris 13.

Analyst Note: Dilian's written admission removes Athens's last plausible defense that Predator's Greek deployment involved only rogue private actors, since the seller now places the transaction inside the state apparatus. The Israeli court likely will hold the scheduled hearing within the next two months, forcing Dilian to substantiate claims that Prosecutor Bakelas can no longer treat as untested accusations from a defendant. Low confidence reflects reliance on Kesses's account of an unreleased filing, with no independent access to the Israeli docket. Kesses's move to name five untested Intellexa executives raises the odds Greek authorities compel witness testimony regardless of the Israeli outcome.

Sources:

1: Bombshell in Predator Spyware Case: Tal Dillian Admits Selling System to Greek State Authorities - Greek City Times

2: Dilian's Court Filing Admits Selling Predator to Greece - TO VIMA

3: Predator: «Βόμβα» Ντίλιαν στα δικαστήρια του Ισραήλ: «Το πούλησα νόμιμα στις ελληνικές κρατικές αρχές» - Oikonomikos Tahydromos (ot.gr)

«Βόμβα» Κεσσέ: Ο Ντίλιαν παραδέχεται σε δικαστικό έγγραφο πως πούλησε το Predator σε κρατικές Αρχές - Dnews.gr

Prior Reporting - [Intellexa Founder: We Sell to Government Agencies](https://greekcitytimes.com/2026/06/02/intellexa-founder-tal-dilian-we-sell-to-government-agencies-only/) (2026-06-02) - [Tal Dillian: "We sold the Predator to the Greek government and they made it work"](https://en.rua.gr/2026/06/02/tal-dillian-we-sold-the-predator-to-the-greek-government-and-they-made-it-work) (2026-06-02) - [Convicted Spyware Dealer Links Greek Government to Surveillance Scandal](https://www.occrp.org/en/news/convicted-spyware-dealer-links-greek-government-to-surveillance-scandal) (2026-06-02) - [Intellexa Tal Dilian: Attacks against the Greek government](https://www.secnews.gr/en/699232/intellexa-tal-dilian-greek-government/) (2026-06-02) - [Tal Dilian to Mega: 'Predator Provided Exclusively to Govts, Security Authorities; They Define Targets'](https://www.tovima.com/politics/tal-dilian-to-mega-predator-provided-exclusively-to-govts-security-authorities-they-define-targets) (2026-03-24)

Adversary Intelligence

EU and UK Impose First Coordinated Cyber Sanctions on Russia FSB 16th Center After Decade of Espionage and Sabotage Across Nine European Nations

BLUF: Brussels and London deliberately targeted proxies rather than the FSB 16th Center itself, and formal designation of the unit within six months remains unlikely absent further infrastructure attacks.

On Monday, the Council of the European Union imposed asset freezes and travel bans on nine individuals and four entities tied to Russia's FSB 16th Center 1, while Britain sanctioned 24 individuals and entities in a parallel action, according to OCCRP and France24 12. Western officials named the 16th Center as orchestrator of hacking groups including Turla, with intrusions traced to government and infrastructure networks across nine states: France, Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania, and Finland, though the center itself was not sanctioned 1. British officials said the unit deployed destructive DynoWiper malware against roughly 30 Polish wind, solar, and heat-and-power facilities on December 29-30, degrading grid monitoring and control systems and threatening outages for roughly 500,000 people during winter while separately probing Poland's water treatment systems, though the attack ultimately failed to cut power 1. Newly sanctioned entities include Media Land LLC, ML.Cloud, Z-Pentest, and Impuls, tied to Main Directorate of the General Staff (Russia) (GRU) Unit 29155, developers of the Trickbot, Conti, and LummaC2 malware, and ten individuals linked to the pro-Kremlin Rybar outlet for spreading false Ukraine narratives and interfering in Moldovan and Armenian elections 1.

Analyst Note: The EU and UK have targeted the FSB 16th Center's proxies, malware developers, and personnel rather than the unit itself, preserving room for calibrated escalation; formal designation within the next six months is unlikely, given Brussels and London's consistent preference for infrastructure and cutout targets even after attributing the Polish grid-sabotage plot to the unit directly. This judgment carries moderate confidence, resting on a single primary account, the EU Council's own statement, with OCCRP and France 24 providing synthesis and amplification rather than independent corroboration. The omission of the 16th Center itself may reflect deliberate signaling held in reserve rather than a gap in attribution evidence. Formal designation would extend secondary-sanctions exposure to third-country firms dealing with the unit, a threshold that would force European banks and infrastructure operators to tighten due diligence well before any listing occurs.

Sources:

1: Spies Malware and Blackouts EU Blames Secret FSB Unit for Decade of Cyber Sabotage - OCCRP

2: EU, UK slap sanctions on Russian spies and hackers over cyberattacks - France 24

Cyber / Russia: Statement by the High Representative on behalf of the European Union denouncing Russia's malicious cyber ecosystem targeting the EU, its member states and international partners - Council of the European Union

COLLECTION GAPS

UNCLASSIFIED // OPEN SOURCE