//
OFFLINE — VIEWING CACHED CONTENT
← Back to Archive

IC BRIEF

Current as of 0324 EDT (UTC-04), Tuesday 21 July 2026

Contents

9 stories from 46 sources across 36 organizations

KEY JUDGMENTS

At least one additional allied arrest or charge tied to Iranian intelligence is likely within 30 days, as CENTCOM's destruction of the Chabahar surveillance tower and sustained allied counterintelligence tempo converge to intensify pressure on Tehran's intelligence networks. The Islamic Revolutionary Guard Corps (IRGC)'s claim of Jordanian civilian intelligence cooperation almost certainly serves propaganda. Iran is unlikely to publicly link a retaliatory operation to the Chabahar strike within 14 days. Moderate confidence rests on the pattern of eight to twelve allied Iran-linked CI actions annually and UK counterterrorism's reported tempo increase.

Political pressure on U.S. IC institutional norms is widening. Acting Director of National Intelligence (DNI) Pulte's push to name intelligence analysts during the declassification episode was blocked by the chief of staff, making public disclosure unlikely within 30 days. Patel's Federal Security Service (Russia) (FSB)-hosted Russia trip is likely to proceed in October. Moderate confidence reflects single-source reporting with no independent corroboration. Congressional action on the Patel trip agenda would shift the assessment.

Taiwan's first national core technology espionage indictment and the bipartisan Stop People's Republic of China (PRC) Economic Espionage Act represent simultaneous allied testing of new legal frameworks against Chinese economic espionage. The US legislation is very likely to remain unenacted through year-end absent National Defense Authorization Act (NDAA) attachment.

IC Oversight & Policy

FBI Director Patel Plans Fall Trip to Russia With FSB Meetings in Moscow and St. Petersburg

BLUF: Patel's fall visit to Moscow and St. Petersburg will likely proceed by mid-October, making direct FBI-FSB engagement a policy channel whose scope and oversight remain undefined.

FBI Director Kash Patel is scheduled to visit Russia October 14-15, stopping first in Moscow and then St. Petersburg, according to a U.S. official cited by Politico 1. His likely host is the FSB, Russia's security service and successor to the Soviet-era KGB, per the same official 1. A separate person familiar with the plans confirmed the fall Russia trip and the two-city itinerary 1. Whether Patel will meet President Vladimir Putin or senior Russian officials is unclear, and the agenda has not been disclosed 12. The White House referred comment requests to the FBI, and the FBI and Justice Department did not respond 1. The last FBI director reported to have traveled to Russia was Robert Mueller in 2013 12.

Analyst Note: Patel's Moscow-St. Petersburg itinerary is likely to proceed on the October 14-15 window, since two independent sources confirm scheduling detail down to specific cities and an FSB host, indicating the plan has moved past preliminary discussion. This assessment is held with moderate confidence, resting on convergent sourcing that nonetheless traces back to a single original report rather than independently corroborated channels. The undisclosed agenda and unconfirmed Putin meeting mean the trip's substantive outcome, not its occurrence, carries the greater uncertainty. Congressional scrutiny of Patel's travel patterns raises the odds that any last-minute change would draw public attention before the visit date.

Sources:

1: Kash at the Kremlin? FBI director plans Russia trip. - Politico

2: FBI Director Kash Patel schedules fall trip to Russia: Report - Washington Examiner

Kash at the Kremlin? FBI director plans Russia trip. - Politico

Kash at the Kremlin? FBI director plans Russia trip. - Politico

FBI Director Kash Patel expected to visit Russia, Politico reports - Kyiv Independent

FBI Director Kash Patel Planning a Trip to Russia, Politico Reports - U.S. News & World Report (Reuters)

SSCI and House China Committee Leaders Introduce Stop PRC Economic Espionage Act Closing Prosecution Loophole

BLUF: Bipartisan committee leadership gives the bill unusual credibility, but enactment by end of 2026 is very likely foreclosed absent attachment to a must-pass vehicle like the NDAA.

Select Committee on China Chairman John Moolenaar, Senate Intelligence Committee Chairman Tom Cotton, and Senator John Cornyn introduced the Stop PRC Economic Espionage Act of 2026, filed as S.5024 and read twice and referred to the Senate Judiciary Committee . The bill would amend federal economic espionage law to classify organizations domiciled in China, Russia, Iran, or North Korea as "foreign instrumentalities," removing prosecutors' current burden to prove a company is substantially owned or controlled by a foreign government . Under existing law, prosecutors must show an offense was intended to benefit a foreign government, agent, or foreign instrumentality, defined as an entity substantially owned, controlled, sponsored, commanded, managed, or dominated by a foreign government . Cornyn, Cotton, and Moolenaar each stated Chinese law treats all businesses as arms of the Chinese Communist Party, and the bill's text is available through the House Select Committee on China . The standard requiring proof of government ownership or control would continue to apply to companies from all other countries .

Analyst Note: The bill is very likely to remain unenacted by the end of 2026, since standalone economic-espionage amendments of this kind typically require attachment to a must-pass vehicle such as the NDAA rather than advancing on standalone floor time. Low confidence reflects the absence of any scheduled markup, floor commitment, or administration endorsement in the three days since introduction, leaving the reference class of single-digit annual enactment rates as the primary analytical anchor. Bipartisan committee leadership backing raises the odds of eventual vehicle attachment, but no concrete step beyond introduction has materialized. If enacted, prosecutors would no longer need to prove Chinese Communist Party control case by case, materially lowering the evidentiary bar in trade-secret prosecutions involving Chinese-domiciled firms.

Sources:

Moolenaar Cornyn Cotton Introduce Stop PRC Economic Espionage Act - House Select Committee on China

Moolenaar Cornyn Cotton Introduce Stop PRC Economic Espionage Act - House Select Committee on China

US bill targets Chinese firms in espionage cases - IANS

共和党参众议员推出《制止中华人民共和国经济间谍活动法案》 - VOA Chinese

Acting DNI Pulte Pushed to Reveal Intelligence Officials Names During Trump Declassification, Endangering CIA Officers

BLUF: White House guardrails blocked Pulte's push to name analysts this cycle, making public disclosure within 30 days unlikely, but sustained pressure on career intelligence officers will persist.

Acting Director of National Intelligence Bill Pulte pushed in the days before President Trump's Thursday elections-fraud speech to reveal the names of intelligence officials accused of concealing election interference from Trump, according to two senior officials cited by Politico's Dasha Burns 1. The push set off an internal White House scramble, with officials including chief of staff Susie Wiles concerned it could undermine Trump's broader argument about election vulnerabilities and put intelligence analysts at risk, warning that naming individuals could prompt conspiracy theorists to take the law into their own hands 1. Pulte ultimately "got really scared" and pulled back from the push after realizing people could be endangered by his approach, one official said, and Trump's speech ended up more restrained than aides had feared 1. Pulte simultaneously serves as a MAGA-aligned federal housing official known for probes of Democrats while holding the acting DNI post 1. Trump's associated declassification of intelligence reports included a September 2020 assessment describing Russian President Vladimir Putin and senior officials overseeing proxy efforts to spread corruption claims about then-Vice President Biden and his family's Ukraine dealings, aimed at securing Trump's reelection 1.

Analyst Note: Wiles's intervention shows internal guardrails held this cycle, but Pulte's push to name analysts signals pressure on career intelligence officers that is unlikely to abate in the coming weeks, given the administration's pattern of overriding institutional caution on declassification and personnel matters; disclosure of the officials' names within 30 days is unlikely now that White House pushback has blocked that outcome. Pulte's ask may reflect genuine tradecraft concerns about concealed findings rather than a purely political motive to expose critics. Moderate confidence rests on single-source reporting of internal deliberations with no independent corroboration. If names surface later, CIA leadership would need to weigh protective measures for exposed analysts; absent that, oversight committees lack a concrete basis to probe the alleged concealment.

Sources:

1: SpyWeek: How Trump Shanked Elections Fraud, the Bipartisan Rush on Clayton, Rubios Global Terrorism Stunt, and More - SpyTalk

'Pulte got really scared': Inside the White House debate over Trump's elections speech - Politico

Officials debated White House push to declassify documents amid Trump campaign to sow election mistrust - CNN (via ABC17 News)

Prior Reporting - [Trump to Deliver National Address on Declassified 2020 Election Intelligence and Voting Machine Security](https://yournews.com/2026/07/14/7109591/trump-to-deliver-national-address-on-declassified-2020-election-intelligence/) (2026-07-14) - [Trump to assert voting machine vulnerabilities in Thursday speech](https://www.yahoo.com/news/politics/articles/trumps-speech-foreign-interference-2020-210847563.html) (2026-07-14) - [Trump Will Use Primetime Speech to Claim Newly-Declassified Intel Reveals Foreign Plot to Interfere in 2020 Election: MS NOW](https://www.mediaite.com/media/news/trump-will-use-primetime-speech-to-claim-newly-declassified-intel-reveals-foreign-plot-to-interfere-in-2020-election-ms-now/) (2026-07-13) - [Trump, despite his record, eyes prime-time address on foreign election interference](https://www.ms.now/rachel-maddow-show/maddowblog/trump-foreign-election-interference-2020) (2026-07-14)

Adversary Intelligence

IRGC Claims Jordanian Civilian Intelligence Enabled Strikes on US Military Installations Despite Low Public Support for Iran

BLUF: Iran's claimed Jordanian cooperation is almost certainly coercive messaging aimed at raising Amman's political cost for hosting U.S. forces, and Jordan will likely withhold public comment within seven days.

The IRGC on Monday thanked "the people and mujahid soldiers of Jordan" for providing intelligence it said enabled strikes on US forces at the Al-Azraq air base and Aqaba Airport, per Iranian state media reports carried by Press TV and RT 12. The IRGC claimed the intelligence supported the destruction of 20 hangars and the killing of dozens of American personnel at Al-Azraq, and damage to US C-17 transport and P-8 command-and-control aircraft at Aqaba 134. Jordan has not publicly acknowledged any such cooperation, and Iranian state media offered no evidence to support the claim 5. Jordan expert Ronen Yitzhak told the Jerusalem Post that public opinion surveys show most Jordanians view Iran as a competitor or enemy, citing an April survey and a June Fikra Forum poll finding 45 percent see Iran as a competitor and 42 percent as an enemy; he said many Jordanians felt "stabbed in the back" by the claim given prior public opposition to Jordan's support for the US and Israel against Iran, and described Jordanian intelligence, which maintains ties to Western services including Mossad, as the strongest in the Arab world 6.

Analyst Note: The IRGC's claim of Jordanian civilian complicity almost certainly serves domestic propaganda and coercive pressure on Amman rather than reflecting a real intelligence network, given Jordan's negligible Shia population, its deep integration with Western and Israeli services, and public opinion showing most Jordanians view Iran as a competitor or enemy. Sourcing rests on a single unverified Press TV statement, with other outlets merely amplifying it without independent corroboration. The rhetoric may instead function as an information operation aimed at sowing suspicion of Jordanian civilians and straining Amman's internal security posture regardless of any actual intelligence transfer. Jordan will likely maintain public silence in the coming week, and continued silence would confirm the claim as information warfare, while any explicit Jordanian response would force reassessment of Jordan-Iran dynamics and US basing security posture.

Sources:

1: IRGC conducts high-fatality, destructive strikes on regional US targets, thanks Jordanians - Press TV

2: Iran thanks Jordanians for help targeting US forces - RT

3: How Iran's Jordan-based sources helped IRGC strike the al-Azraq air base while war escalates in Mideast - India TV News

4: IRGC reveals attacks on US bases in Jordan aided by 'accurate intel' from locals - The Cradle

5: Iran claims Jordanian soldiers, civilians provided strike intel - World Israel News

6: IRGC manufactures espionage fears in Jordan despite low public opinion of Islamic Republic - Jerusalem Post

CENTCOM Destroys IRGC Strategic Naval Intelligence and Surveillance Tower at Chabahar Port

BLUF: CENTCOM's systematic dismantling of IRGC maritime surveillance infrastructure around Hormuz marks a deliberate campaign to sever Iranian targeting loops against commercial shipping, though decentralized backups will partially offset the loss.

CENTCOM announced on July 17 that U.S. forces destroyed the Chah Bahar Shahid Kalantari Port surveillance tower on July 16, describing it as part of a maritime surveillance network IRGC has used for decades to track and target commercial vessels transiting the Strait of Hormuz 123. CENTCOM framed the strike as protecting freedom of navigation for all vessels in regional waters except those attempting to violate the ongoing U.S. naval blockade against Iran 1. The strike came during the sixth consecutive night of U.S. air operations against Iranian infrastructure, which also hit coastal surveillance and air defense sites, logistics infrastructure, and road and rail bridges near Bandar Abbas 1. Iran's state news agency Islamic Republic News Agency (IRNA) confirmed the tower's destruction but reported the port's berths and cargo-handling equipment were undamaged, with authorities inspecting the site before resuming operations 23. Iranian state media reported at least 38 people killed and more than 400 injured in the broader overnight strikes, including six damaged bridges in Khamir County 23.

Analyst Note: CENTCOM's folding of the Chabahar tower strike into its sixth-night campaign against Bandar Abbas logistics and transport bridges signals a move from defensive posture toward systematically stripping Iran's targeting loop against Hormuz shipping. IRGC's decentralized backup of mobile radar trucks and converted civilian vessels means the loss degrades rather than eliminates near-term maritime tracking. Reporting rests entirely on CENTCOM's own account, with JFeed, OANN, Republic World, and The Tribune merely syndicating the same command statement rather than corroborating independently. Tehran's choice to confirm the strike via IRNA while stressing undamaged port operations reads as containment over escalation, prioritizing cargo throughput over contesting the narrative. The strike may register more as messaging for domestic and allied audiences than as a decisive blow given the tower's known redundancy.

Sources:

1: CENTCOM: U.S. destroys Iranian surveillance tower after 6th night of strikes - One America News Network

2: US Strike Hits Chabahar Port Tower Used By IRGC To Target Ships In Strait Of Hormuz, Confirms CENTCOM - Republic World

3: US CENTCOM confirms destruction of Chabahar Port surveillance tower in Iran - The Tribune

On July 16, U.S. forces successfully destroyed the Chah Bahar Shahid Kalantari Port surveillance tower - U.S. Central Command (CENTCOM)

The Chabahar Port Surgical Strike: United States Central Command Destroys Strategic Revolutionary Guard Spy Tower in Coastal Raid - JFeed

Allied Intelligence

Dutch Intelligence Services AIVD and MIVD Were Split on Whether Putin Would Invade Ukraine, AIVD Cited Unique Source CIA and MI6 Lacked

BLUF: Allied intelligence failures rooted in single-source overconfidence against converging multi-modal indicators remain an unresolved structural risk for NATO pre-conflict warning.

The Dutch Military Intelligence and Security Service assessed before February 2022 that President Putin would invade Ukraine, while the General Intelligence and Security Service concluded he would not, according to an investigation by NU.nl citing multiple intelligence officials 1. The General Intelligence and Security Service (Netherlands) (AIVD) based its assessment on a long-established source close to Putin that it said neither the CIA nor MI6 could claim to have, but that source proved unaware of the invasion plans, which Putin confined to an extremely narrow circle of advisers 1. The official Dutch government position followed the AIVD line: the government told allies that Putin would not invade, despite U.S. and British efforts to persuade The Hague otherwise 1. A separate Volkskrant investigation, based on interviews with 19 intelligence officers and officials, reported that AIVD Director Erik Akerboom and Military Intelligence and Security Service (Netherlands) (MIVD) Director Jan Swillens briefed Prime Minister Rutte on February 22 that Russia would not invade; two days later the invasion began 2. Dutch skepticism toward U.S. warnings was reinforced by the 2003 Iraq War experience, when American intelligence wrongly claimed Baghdad held weapons of mass destruction, and the Dutch probability assessment moved from "unlikely" to "possible" only about three weeks before the invasion after intelligence on blood plasma transfers to Russian units near the front 2. NATO Military Committee Chairman Rob Bauer rejected the AIVD conclusion, and most Dutch Foreign Ministry experts aligned with the MIVD assessment that an invasion was coming 1.

Analyst Note: Dutch services split before the invasion because AIVD leaned on a single long-established Putin-adjacent source it judged superior to anything CIA or MI6 held, a confidence that overrode MIVD's converging multi-source warning and shaped the government's line to allies. The asset's access proved narrower than assessed, since Putin confined invasion planning to an extremely small circle, exposing how a service's trust in a unique source can outweigh partner fusion even when other services are reading the same battlefield indicators, such as the blood-plasma and field-hospital movements that shifted US and British estimates. AIVD's caution may equally reflect institutional wariness after the 2003 Iraq WMD failure, weighting false-positive costs over false-negative ones. The episode now pushes allied services to discount single-source certainty against corroborating multi-modal indicators before acting on it.

Sources:

1: Dutch spy agencies were split on whether Putin would invade Ukraine in 2022 - NL Times

2: Dutch intelligence dismissed US warnings before Russia invaded - DutchNews.nl

We Did Not See the Beginning of the War: How a Unique Source Let Down Dutch Intelligence - De Volkskrant (via inbox.lv)

Dutch intelligence services did not see Russian invasion of Ukraine coming - NL Times

AIVD en MIVD zaten mis bij analyse over inval Rusland - NOS

UK Charges Liverpool Man Under National Security Act for Assisting Iranian Foreign Intelligence Service

BLUF: Prosecuting rather than quietly disrupting Iran's UK network signals London's confidence that the 2023 National Security Act can sustain courtroom scrutiny, raising exposure risk for other Iranian-linked operatives across England.

Counter Terrorism Policing London charged Vahid Aberi, 39, of Liverpool with assisting a foreign intelligence service under Section 3(1) and 3(9) of the National Security Act 2023, in connection with alleged activity linked to Iran 123. Aberi was arrested on July 15 in the Birmingham area, and officers searched addresses in Birmingham and Liverpool before he was questioned at a West Midlands police station 13. Commander Helen Flanagan, head of Counter Terrorism Policing London, said the force has seen "a significant and sustained increase in the tempo" of national security investigations in recent years and stated no direct threat to the public, a community, or an individual had been identified in connection with the case 13. Aberi was remanded in custody and appeared at Westminster Magistrates' Court on July 17 3.

Analyst Note: Counter Terrorism Policing London's decision to charge rather than quietly disrupt indicates prosecutors met the evidentiary threshold under the National Security Act's Section 3 assistance-to-foreign-intelligence provisions, an early practical test of the 2023 law. Flanagan's reference to a sustained rise in investigative tempo suggests a broader caseload against Iran-linked networks across the Birmingham and Liverpool corridor beyond this single defendant, though the charge may equally reflect the newer law's lower evidentiary bar rather than any actual escalation in Iranian intelligence activity. Sourcing rests on the Metropolitan Police's own statement corroborated independently by ITV, with LBC and other outlets merely repackaging those facts, so four-outlet coverage still amounts to single-source consensus. Charging documents remain narrow, leaving unspecified what access or tasking Aberi allegedly provided ahead of trial.

Sources:

1: UK Charges Liverpool Man in Iran Case - The British Eye

2: Liverpool man charged with assisting foreign intelligence service relating to Iran - ITV News

3: Man, 39, charged under National Security Act on suspicion of spying for Iran - LBC

Man charged with National Security Act offence - Metropolitan Police

Counterintelligence

Taiwan Indicts Former TSMC Employees in First National Core Technology Espionage Case Linked to China

BLUF: Taiwan's first national core technology espionage indictment signals escalating legal deterrence against China-linked semiconductor theft, though a conviction matching the recommended seven-year sentence is unlikely within 24 months given the case's statutory novelty and Taiwan Semiconductor Manufacturing Company (TSMC)'s pre-transfer file recovery.

Taiwan's High Prosecutors Office Intellectual Property Prosecution Division indicted a former TSMC deputy manager surnamed Chen on Monday for allegedly stealing core semiconductor technologies for transfer to China, and recommended a seven-year prison sentence 12. Prosecutors allege Chen copied 21 files containing core national technologies and trade secrets, removed them from TSMC for study at his residence between May 2023 and February 2024, and worked with Hong Kong resident Ding Xiaohu under a scheme prosecutors called the "Blue Ocean Project" 1. TSMC said its internal investigation detected the alleged breach and recovered the copied documents before any transfer to China occurred, and declined further comment on the indictment 13. The case is linked to a separate investigation into Ding, who prosecutors allege sought to build a semiconductor materials firm in China (identified in reporting as CSMAC) using stolen technology and to recruit Taiwanese military personnel; Ding was indicted in a related case in November and died in February 1. Digitimes and Reuters both describe the case as Taiwan's first indictment under national core technology espionage provisions tied to China, though Digitimes' reporting refers to the indictment covering former TSMC employees plural, while Reuters and Taiwan News describe a single indicted individual, Chen 23.

Analyst Note: Taiwan's judiciary is unlikely to secure a conviction matching the prosecutors' recommended seven-year term within 24 months, as first-of-kind national core technology cases typically face prolonged appellate review and evidentiary contestation over the "Blue Ocean Project" scheme's intent element. Low confidence reflects the case's novelty under this statute and the absence of comparable precedent to anchor sentencing outcomes. TSMC's pre-transfer recovery of the 21 files weakens the prosecution's damage narrative and may factor into judicial leniency at trial or on appeal. The linkage to Ding Xiaohu's now-closed prosecution, following his death in February, removes a potential corroborating witness for the state's case.

Sources:

1: Taiwan indicts ex-TSMC manager for leaking secrets to China - Taiwan News

2: Taiwan indicts ex-TSMC employee over alleged theft of trade secrets for intended use in China - Reuters

3: Taiwan indicts ex-TSMC employees in first China-linked national core tech espionage case - DIGITIMES

Taiwan indicts ex-TSMC employee over alleged theft of trade secrets for intended use in China - Reuters

Taiwan indicts ex-TSMC manager for allegedly stealing chip secrets for China - Tom's Hardware

IC Technology & Cyber

HOLLOWGRAPH Espionage Malware Uses Microsoft 365 Calendar Events as Covert Command Channel

BLUF: Espionage malware family abusing Microsoft Graph API for covert C2 (HOLLOWGRAPH)'s abuse of legitimate Microsoft 365 Graph API traffic for command and control very likely sustains targeting of Israeli-linked organizations through the remainder of 2026, rendering conventional network monitoring ineffective.

Group-IB researchers identified a new espionage implant, HOLLOWGRAPH, that abuses the Microsoft Graph API to turn a compromised Microsoft 365 mailbox calendar into a two-way command-and-control channel, supporting only two commands, "get" and "send", executed exclusively through trusted Microsoft cloud infrastructure 1. Operators plant tasking as calendar events and the malware exfiltrates stolen files as encrypted attachments on events dated to 13 May 2050 to avoid drawing the mailbox owner's attention, with Graph traffic secured by hybrid RSA and AES-256-GCM encryption using separate key pairs per direction 1. The malware's configuration is stored as a file named logAzure.txt disguised as a routine log, holding the Microsoft Entra ID tenant ID, application client ID and secret, target mailbox address, C2 domain, and two RSA keys 1. A secondary channel uses DNS tunneling via IPv6 AAAA queries against the domain cloudlanecdn[.]com to refresh Microsoft Entra ID credentials 1. Group-IB attributes the malware with high confidence to the Cavern backdoor framework, a judgment that reflects identification of 12 infected systems with roughly three actively communicating with attackers between 3 June and 9 July, and linked recovered indicators, including an Israeli compromised mailbox and malware samples uploaded from Israel, to a targeted interest in Israeli entities 1. The Hacker News and BleepingComputer reported the findings, both crediting Group-IB as the source 23.

Analyst Note: Group-IB's disclosure, resting solely on its own technical findings and republished without independent corroboration, forces defenders off signature-based DNS and IOC blocklists onto Graph API behavioral auditing, since HOLLOWGRAPH's traffic rides legitimate Microsoft 365 calls that standard network monitoring waves through. Organizations with Israeli operations or partnerships very likely face continued targeting through the remainder of 2026, given the operation's demonstrated selectivity, three of twelve infections actively tasked rather than opportunistic spray, though the low infection count may instead reflect a still-developing capability rather than mature targeting discipline. That ambiguity leaves security teams protecting Israeli-linked entities weighing whether to fund Graph API behavioral monitoring now or wait for confirmed exploitation against their own tenants.

Sources:

1: HOLLOWGRAPH: Turning Microsoft 365 Calendars into Covert Command-and-Control Channels - Group-IB

2: HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050 - The Hacker News

3: New HollowGraph malware uses Microsoft Graph for stealthy C2 comms - BleepingComputer

Microsoft 365 calendars become spy drop boxes in HOLLOWGRAPH campaign - The Register

COLLECTION GAPS

UNCLASSIFIED // OPEN SOURCE