//
OFFLINE — VIEWING CACHED CONTENT
← Back to Archive

IC BRIEF

Current as of 1608 EDT (UTC-04), Thursday 23 July 2026

Contents

9 stories from 38 sources across 30 organizations

KEY JUDGMENTS

Russian intelligence services are operating as cyber operators, procurement facilitators, and potential targeting enablers against Western infrastructure simultaneously. The investigation into whether Russia assisted Iran in striking CIA facilities in the Gulf will likely remain in open-assessment status through October 2026. Moderate confidence reflects convergent but single-sourced reporting across the 17-nation Russian state-supported cyber espionage group tracked by Western intelligence agencies (LAUNDRY BEAR) Zimbra advisory, the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU) procurement pipeline exposed in Tokyo, and the Reuters account of Russian-enhanced Shahed drones breaching the Riyadh CIA station. At least one additional allied advisory on these campaigns will likely follow by August 31.

Iran's intelligence apparatus faces exposure from two directions: Araghchi's public acknowledgment that Israel penetrated the supreme leadership's location intelligence, and the Mossad-Shin Bet disclosure of a disrupted Ministry of Intelligence and Security (Iran) (MOIS) assassination network. A visible counterintelligence personnel action publicly tied to wartime intelligence failures is genuinely uncertain by September 30, given the new leadership's incentive to handle breaches quietly rather than reveal further vulnerability.

Domestically, criticism of CIA Director Ratcliffe's characterization of Venezuelan election intelligence has not produced congressional oversight action, and cross-linkage with the Pentagon's AI-enabled commercial data acquisition is very unlikely by mid-September. Woolsey's family attribution of his decline to Havana syndrome will likely prompt at least one congressional statement on IC disability recognition by August 31.

IC Technology & Cyber

CISA, NSA, FBI and 16 Allied Agencies Warn Russian Laundry Bear Group Exploiting Zimbra Zero-Day to Steal Western Government Data

BLUF: LAUNDRY BEAR will likely retool its zero-click collection capability against an alternative collaboration platform within 90 days, as the advisory's public indicators accelerate the group's established pattern of pivoting after exposure.

Cybersecurity and Infrastructure Security Agency (CISA), NSA, FBI and 16 partner agencies from 15 allied nations issued a joint advisory Thursday attributing a year-long espionage campaign against Zimbra Collaboration Suite users to the Russian state-supported group LAUNDRY BEAR, also tracked as Void Blizzard 12. The advisory states the group has exploited Common Vulnerabilities and Exposures (CVE)-2025-66376, a zero-day patched in November 2025, since at least July 2025, using a view-based exploit requiring no user interaction beyond opening an email 13. The exploit, delivered via a custom capability the advisory names "Ulej," attempts to exfiltrate 90 days of email, the organization's Global Address List, search history, account passwords, newly created passwords and two-factor authentication tokens to actor-controlled infrastructure 13. Targeted sectors include defense, government, education, energy, law enforcement, media and technology across the United States and allied countries, with Ukrainian networks targeted first, according to the advisory 13. Officials said unpatched Zimbra Collaboration Suite (ZCS) instances remain under active exploitation and did not name specific victim organizations or estimate the number compromised 3.

Analyst Note: The advisory converts LAUNDRY BEAR's exploit mechanics and indicators of compromise into a public record, placing every unpatched Zimbra Collaboration Suite instance on a known-target list for both defenders and the actor. The group will likely adapt its Ulej exfiltration capability to target an alternative webmail or collaboration platform within the next 90 days, given its documented pattern of retooling from Ukrainian networks to NATO targets after prior exposure. Moderate confidence reflects strong precedent for Russian APT platform-pivoting after advisory publication, offset by the absence of specific indicators pointing to a successor target. The zero-click delivery method, requiring no user interaction beyond opening a crafted email, is the tactically distinctive element: it eliminates the phishing-awareness layer that organizations rely on as a last defense.

Sources:

1: Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite - CISA

2: NSA and Partners Alert Zimbra Collaboration Suite Users of a Russian State-Supported Phishing Campaign - National Security Agency

3: Russian espionage group using novel Zimbra exploit to steal sensitive data from Western countries - CyberScoop

Russian Hackers Exploit New Zero-Click Attack - Infosecurity Magazine

CISA FBI and Cyber Command Update Joint Advisory on Iran-Affiliated Actors Exploiting Industrial Control Systems Across US Critical Infrastructure

BLUF: Expansion of confirmed Iranian Programmable Logic Controller (PLC) targeting across three major manufacturers transforms this from a vendor-specific vulnerability into a systemic threat to US industrial control systems requiring sector-wide remediation.

CISA, the FBI, EPA and other federal partners on July 22 issued an update to an April advisory on Iran-affiliated cyber actors exploiting internet-connected programmable logic controllers across US critical infrastructure 1. The advisory attributes the activity to CyberAv3ngers, also tracked as the Shahid Kaveh Group, linked to Iran's Islamic Revolutionary Guard Corps (IRGC) Cyber Electronic Command, and is co-authored with NSA, the Department of Energy, Cyber Command's Cyber National Mission Force, and Treasury alongside CISA, FBI and EPA 1. The update expands manufacturer scope beyond Rockwell Automation/Allen-Bradley to include observed targeting of Schneider Electric and Siemens PLCs and adds guidance for detecting malicious changes in reusable code modules such as Add-On Instructions 12. CISA said the activity has disrupted PLCs across Water and Wastewater Systems, Energy, and Government Services and Facilities sectors, manipulating Human-Machine Interface (HMI) and Supervisory Control and Data Acquisition (SCADA) displays and causing operational disruption and financial loss 1. Updated mitigations call for restricting direct internet access to PLCs, securing cellular modems, validating project files for unauthorized changes, and informing service providers of active targeting 23. FBI Cyber Division Assistant Director Brett Leatherman and EPA Assistant Administrator for Water Jess Kramer joined CISA's Chris Butera in urging critical infrastructure operators to review and implement the advisory's recommendations 1.

Analyst Note: The update pushes CyberAv3ngers activity from a single-vendor problem into a cross-manufacturer one spanning Rockwell, Schneider Electric, and Siemens PLCs. Confirmed HMI/SCADA manipulation causing operational disruption and financial loss across water, energy, and government-facilities operators shows the campaign has moved past reconnaissance into effects with real consequences for service continuity. New guidance on detecting tampering in Add-On Instructions indicates the actors are burying persistence inside trusted reusable code rather than relying on external access alone, a technique harder to catch through perimeter monitoring. The broader vendor list could equally reflect wider detection reach across the Industrial Control Systems (ICS) community rather than genuine escalation in targeting scope. Sourcing rests solely on CISA's own advisory, with trade press offering only secondary summarization.

Sources:

1: CISA, FBI, EPA and U.S. Government Partners Update Warning of Iran-Affiliated Threat Actors Targeting Critical Infrastructure Programmable Logic Controllers

2: CISA Updates Advisory on Iranian Cyber Actors Exploiting PLCs - Manufacturing Business Technology

3: Updated CISA advisory provides new guidance on Iran-affiliated threats to operational technology devices - Inside Cybersecurity

Prior Reporting

Adversary Intelligence

GRU Officer Who Ran Russia Drone Parts Pipeline From Tokyo Flees Japan After Press Exposure

BLUF: Japan's lack of an espionage statute means GRU procurement networks face reputational risk from press exposure but no legal disruption, leaving Tokyo a permissive operating environment for Russian technology sourcing.

Maksim Vladimirovich Filchenkov, a 49-year-old GRU officer who worked undercover as an Aeroflot employee in Tokyo since February 2024, left Japan after The New York Times published an investigation into his activities on July 12, according to a Ukrainian intelligence official and Yomiuri Shimbun reporting relayed by DroneXL and News On Japan 12. The Times identified Filchenkov as a member of the GRU's 20th Directorate, a unit that sources battlefield technology for Russia through officers posing as diplomats or businesspeople, routing sanctioned Japanese components through front companies such as Proco Air and third countries including Sri Lanka before shipment to Russia 1. Ukrainian government estimates cited in the investigation hold that 90 percent of Russian missiles and drones contain Japanese-made components 1. He was not arrested or charged before departing; Japan has no dedicated anti-espionage statute and has lacked a foreign intelligence agency since World War II 1. Cabinet official Minoru Kihara said Japan "must address this issue with even greater rigor" without addressing Filchenkov or the 20th Directorate directly, and Japanese authorities have taken no arrests or sanctions connected to the operation 1.

Analyst Note: Filchenkov's exit shows exposure alone, absent a legal mechanism, functions as Japan's only current check on GRU procurement networks, and his departure interrupts neither the 20th Directorate's intact sourcing structure nor the front-company routing built over his posting. Reporting rests on a single primary account from the Times, with other outlets amplifying rather than independently corroborating. Tokyo's plan for a foreign intelligence agency addresses collection, not prosecution, leaving component smuggling exposed to journalism rather than law enforcement; the rotation could equally reflect routine GRU tradecraft, pulling a burned officer home before public pressure forces Japanese authorities to act, rather than any structural weakness Tokyo has newly revealed.

Sources:

1: GRU Officer Who Ran Russia Drone Parts Pipeline Out of Tokyo Flees Japan After Press Exposure - DroneXL

2: Russian 'Spy' Flees Japan - News On Japan

How Putin Turned Japan Into a Den of Spies - The New York Times

US Intelligence Investigates Whether Russia Helped Iran Target CIA Facilities in Gulf Strikes

BLUF: Formal US attribution of Russian targeting assistance to Iran remains unlikely by late October, as the investigation rests on circumstantial precision indicators rather than direct evidence of a intelligence handoff.

Reuters reported Wednesday, citing four people familiar with the matter, that US intelligence analysts are examining whether Russia helped Iran target CIA facilities in the Gulf by supplying targeting intelligence or advanced drone technology 1. At least two CIA facilities were hit in March, including the CIA station inside the US Embassy in Riyadh and a facility in eastern Iraq 1. Two Western officials in the Gulf briefed on intelligence reporting said the Saudi attack involved two Russian-enhanced Shahed drones, with the first breaching the embassy exterior and the second flying through the opening before detonating, causing no reported deaths or injuries 1. A memo from a Western intelligence agency, according to a regional official familiar with it, concluded Russia likely played a role in targeting the facilities, while analysts have reached no definitive conclusions and some sources cautioned Iran may have struck the CIA station by chance while targeting the broader embassy 12. The Wall Street Journal reported in March that Russia supplied Iran's Shahed drones with the Kometa-M anti-jamming navigation system, a claim the Kremlin called "fake news" 3.

Analyst Note: Formal confirmation that Russia materially enabled targeting of CIA facilities is unlikely by October 21, 2026, since analysts remain confined to circumstantial indicators of strike precision and prior Russian-Iranian technology transfer rather than direct evidence of a targeting handoff. Moderate confidence reflects convergence between the Western intelligence memo and multiple official accounts on the drones' technical profile, offset by explicit analyst caution that Iran may have struck the CIA station incidentally while aiming at the broader embassy. Absent forensic confirmation tying Kometa-M guidance data to the specific Riyadh and Iraq strikes, the investigation is likely to remain an open assessment through the window rather than resolve into a formal US determination.

Sources:

1: Iranian strikes on CIA facilities prompt questions about possible Russian role - The Times of Israel

2: U.S. Intelligence Probes Who Helped Iran Hit CIA Facilities - Daily Wire

3: Has Russia helped Iran target CIA sites in the Gulf? - Al Jazeera

Exclusive-Iran Strikes on CIA Facilities Prompt Questions About Possible Russian Role - Reuters

Prior Reporting

Allied Intelligence

Mossad and Shin Bet Disrupt Iranian Intelligence Ministry Plot to Infiltrate Israel and Attack Senior Officials

BLUF: Israel's public attribution of named Iranian intelligence officers signals a post-war campaign to degrade Tehran's proxy recruitment networks, though intact handler infrastructure in Iran ensures reconstitution capacity persists.

The Mossad and Shin Bet said Thursday they disrupted an Iranian Intelligence Ministry operation to infiltrate an operational cell into Israel to assassinate senior officials, using a "proxy by proxy" recruitment method to distance Tehran from the plot 12. According to a joint statement issued through the Prime Minister's Office, French national Tarout Ozkor, who used the alias "Philip," was recruited by two Iran-based intermediaries, Baba Mahu-Zadeh Haji Jafan ("Babak") and Ahmat Nadim Yigit ("Nadim"), to assemble a foreign-national cell and gather intelligence on a target inside Israel 23. The plot was uncovered and thwarted through cooperation among Israeli agencies and intelligence and security services from several foreign countries 12. The agencies named four Iranian Intelligence Ministry officers who directed the network, Adala Bahazada Uhsari, Vahid Maatzumi, Mahmoud-Hussein Duki, and Hamid Qasami, and said Uhsari was killed by Israel during the early-2026 war with Iran 13. France expelled Ozkor over his role in the plot, while Babak and Nadim remain in Iran and continue to operate 13.

Analyst Note: Mossad and Shin Bet's disclosure functions more as signaling than fresh threat reporting: naming Iranian Intelligence Ministry officers, confirming one battlefield kill, and publicizing the "proxy by proxy" tradecraft claims credit while Israel's intelligence advantage over Tehran's networks remains fresh from the war. Babak and Nadim's continued operation from Iran under Ministry protection indicates Tehran retains recruitment infrastructure despite this cell's exposure. Reporting traces to a single Mossad statement, with Israeli outlets publishing near-simultaneous secondary accounts rather than independent sourcing, and the roughly six-week gap between the presumed disruption and the announcement suggests the timing serves to sustain domestic and international pressure on Iran after the war rather than reflecting new operational urgency.

Sources:

1: Mossad foils Iranian plot to infiltrate Israel, target senior officials - The Jerusalem Post

2: Mossad reveals: Iranian terror plot to assassinate Israeli officials foiled - Israel National News

3: Mossad exposes Iran's plot to infiltrate hit squads and assassinate Israeli leaders - Ynet

Mossad says it foiled Iranian plot to infiltrate Israel, attack senior officials - Mossad official statement (via Times of Israel liveblog)

Mossad says it foiled Iranian plot to infiltrate Israel, attack senior officials - Times of Israel

Iranian Foreign Minister Admits Israel Had Intelligence on Khamenei Location During Strike Confirming Critical Security Breach

BLUF: Araghchi's public confirmation of a penetration reaching Khamenei's inner circle will likely force a visible counterintelligence purge within IRGC or security ranks by late October, though succession politics may delay accountability.

Iranian Foreign Minister Abbas Araghchi said in a Persian-language interview with journalist Javad Moghouei that Israel and the United States had accurate intelligence on the location of Khamenei and other senior officials before the opening strikes of the war, which he called evidence of an information breach that "probably still exists" 123. He said he no longer attributes the breach to technical or artificial factors and that authorities are now investigating human infiltration of Iran's security apparatus, adding the compromise extends beyond stolen information to influencing decision-making and shaping the country's psychological environment and public perception 23. Araghchi said he was meeting with Khamenei aide Ali Asghar Hejazi when the compound was hit by three successive blasts, killing Hejazi's secretary, and that he escaped through debris and was driven to the Foreign Ministry in a civilian car after his official vehicle was destroyed 134. He disclosed that Iran had prepared a contingency protocol, "Code 110," tied to Article 110 of the constitution, to close the Strait of Hormuz if Khamenei were killed 134. Araghchi said he has not met new Supreme Leader Mojtaba Khamenei and that only a small number of people have seen him, and separately credited warnings to Turkish Foreign Minister Hakan Fidan and Iraqi officials with blocking a US-backed plan to spark a Kurdish uprising against Iran 234.

Analyst Note: Araghchi's admission, resting on a single Khabar Online interview amplified without independent corroboration, will likely force a visible counterintelligence action within Iran's security or IRGC ranks in the coming months, since the same breach could still expose Mojtaba Khamenei's own movements. Moderate confidence reflects a pattern of publicized purges following senior-official acknowledgment, discounted by the succession-period incentive to handle the compromise quietly rather than expose vulnerability to adversaries. The disclosed "Code 110" Hormuz-closure contingency, tied specifically to leadership decapitation, functions as a deterrent signal rather than mere retrospective detail, and the claimed shift from hours to minutes in reactivation speed points to hardening against another decapitation attempt rather than confidence the human network has been patched. Araghchi's framing of an unresolved infiltration may instead serve to shift blame from IRGC command failures onto an unnamed mole. If the access point remains live, Israeli and US planners retain a targetable channel into Iran's top leadership, keeping further decapitation strikes on Mojtaba Khamenei's circle operationally viable.

Sources:

1: Security Breach Admitted: Iranian Foreign Minister Reveals Israel Knew Khamenei Location Before Strike - JFeed

2: Top Iran diplomat says intel breach that allowed Israel to kill Khamenei 'probably still exists' - The Times of Israel

3: 'Everything was wrecked': Iran's foreign minister describes attack that killed Khamenei - The Irish Times

4: Araghchi details escape from Israeli strike, reveals Iranian intelligence failures - The Jerusalem Post

⁨عراقچی: تشخیص نقطه مذاکره سرنوشت‌ساز است / حفره امنیتی که باعث حمله ۹ اسفند شد احتمالا هنوز از بین نرفته‌است / باید دنبال نفوذ انسانی هم بود⁩ - Khabar Online

⁨عراقچی: تشخیص نقطه مذاکره سرنوشت‌ساز است / حفره امنیتی که باعث حمله ۹ اسفند شد احتمالا هنوز از بین نرفته‌است / باید دنبال نفوذ انسانی هم بود⁩ - Khabar Online

IC Oversight & Policy

CIA Director Ratcliffe Accused of Misrepresenting Agency Intelligence to Support Trump Election Fraud Claims

BLUF: Ratcliffe's departure as CIA Director by September 30 is very unlikely; the dispute involves characterization of valid intelligence rather than fabrication, and White House alignment statements insulate him from near-term political pressure.

A declassified CIA note dated June 29, released two days later by Director John Ratcliffe, found Venezuela never developed or deployed a capability to manipulate vote totals in a U.S. election, and states the Maduro government "did not need to resort to gross fraud" to win its own December 2020 legislative vote given an opposition boycott 1. Ratcliffe's public characterization of that intelligence, posted on X during Trump's July 16 address, is disputed by former CIA case officer Kevin Carroll, who said Ratcliffe's description "is misleading" and blurs a theoretical concern about U.S. election-system vulnerability with an actual foreign attack 1. A senior administration official told MS NOW that Ratcliffe, during preparation of the speech and document release, opposed a request by acting Director of National Intelligence (DNI) Bill Pulte and task-force member John Solomon to strip additional redactions, citing risk to sources and methods, a claim Solomon has denied 2. Former CIA analyst Julia Curlee, who resigned after 20 years, and other critics have called on Ratcliffe to resign or publicly challenge Trump's election-fraud claims, while CIA spokesperson Liz Lyons dismissed the criticism and White House communications director Steven Cheung said all parties involved were "in alignment" on the speech and release 23.

Analyst Note: Ratcliffe is very unlikely to depart or be removed as CIA director by September 30, 2026: the dispute turns on characterization rather than fabrication, the underlying note survives declassification intact, and CIA public affairs and Cheung's alignment statement have removed near-term pressure for resignation or ouster. The imprecision may reflect political communication strain rather than deliberate misrepresentation of the intelligence, and the address's occurrence now produces a documented discrepancy between the text and the administration's framing rather than an anticipated event. Reporting traces almost entirely to MS NOW, with subsequent pieces built on shared sourcing and quotes, leaving no independent outlet corroborating the internal redaction dispute; confidence in the judgment is low given reliance on anonymous accounts of how firmly Ratcliffe actually pushed back. His continued tenure leaves congressional Democrats without a cooperating inside witness on the redaction fight, forcing them to press the White House on politicization using anonymous sourcing alone.

Sources:

1: CIA head gored for playing fast and loose with agency data to back Trump lies - Raw Story

2: Is the CIA enabling or restraining Trump's election conspiracy theories? - MS NOW

3: 'Conspiracy of silence' critics urge CIA director to 'stand up to Trump' or 'resign' - Raw Story

Declassified documents touted by Trump say election systems 'would be difficult to manipulate' - ABC News

CIA Declassified Documents Refute Trump's Claims of Electronic Fraud in Venezuela - El Ciudadano

Prior Reporting

Just Security Analysis Warns AI Amplifies Intelligence Agency Warrantless Commercial Data Surveillance of Americans

BLUF: Pentagon procurement of commercial data for AI-enabled analysis will very likely outpace statutory guardrails through year-end, leaving voluntary vendor refusals as the sole meaningful check on warrantless domestic surveillance expansion.

Just Security published an analysis on July 21 examining how large language models compound existing gaps in oversight of government purchases of commercially available data 1. The piece reports that in May 2026 the Pentagon reached deals with eight AI companies, including SpaceX, OpenAI, Google, NVIDIA, Reflection, Microsoft, Amazon Web Services, and Oracle, to run their AI systems on classified networks for "lawful operational use," while Anthropic refused a Pentagon request to drop contract restrictions barring use of Claude for mass domestic surveillance and was subsequently blacklisted from defense contracting, a move Anthropic is now litigating 1. The article states that the Defense Department has acknowledged buying data from commercial brokers, including location and internet-traffic records, without a warrant, and cites a 2020 Motherboard report on Special Operations Command's purchase of location data from a prayer app with 98 million downloads and a 2021 New York Times report on the Defense Intelligence Agency's use of aggregated smartphone geolocation data 1. beSpacific republished the same account without independent additions 2.

Analyst Note: Commercial data broker purchases by the Pentagon very likely continue without new statutory restriction by year-end, since the Fourth Amendment Is Not For Sale Act remains stalled in the Senate and the administration has offered only voluntary company-level assurances rather than binding policy change. High confidence reflects the bill's multi-session failure to reach a floor vote combined with the absence of administration support. Anthropic's blacklisting and litigation set a precedent that other AI vendors are unlikely to follow, leaving contractual restrictions as the primary check on domestic-use expansion. Large Language Model (LLM)-enabled re-identification and inference capabilities widen the practical reach of already-purchased data faster than oversight mechanisms can adapt.

Sources:

1: AI and the Commercial Data Loophole - Just Security

2: AI and the Commercial Data Loophole - beSpacific

IC Workforce & Leadership

Former CIA Director R. James Woolsey Jr. Dies at 84 After Health Decline Linked to Havana Syndrome

BLUF: Woolsey's family attribution will likely prompt congressional action on IC disability recognition by late September, reviving institutional pressure on a question the community has tried to close.

R. James Woolsey Jr., who directed the CIA from 1993 to 1995 under President Clinton, died Tuesday at his Washington home, according to multiple outlets citing his wife, Conchita Sarnoff Woolsey 12. She told the Washington Post and the New York Times he died of a stroke 13, and told the Post separately that his health had declined in recent years due to Havana syndrome, a condition first reported among U.S. diplomats and government personnel in Cuba in 2016 marked by headaches, balance problems and cognitive difficulties 1. Woolsey, 84, left the CIA in early 1995 after facing criticism over the agency's handling of Aldrich Ames, a CIA officer who spied for Moscow for nearly a decade before his 1994 arrest 1.

Analyst Note: Woolsey's death removes the last Clinton-era CIA director from public commentary at a moment when Havana syndrome causation remains institutionally unresolved, and the family's attribution of his decline to the condition will likely draw a congressional letter or floor statement pressing for expanded IC disability recognition within the coming months, consistent with every prior high-profile attribution by a named official or family. This assessment reflects moderate confidence: that precedent is unbroken, but the August recess compresses the legislative calendar and the 2024 IC assessment largely dismissed a foreign-attack origin. Sourcing on the death itself is broad, spanning AP, the Post, The Hill, and U.S. News, while the Havana syndrome link rests narrowly on the Post's account; the stroke, not the syndrome, may have been the proximate cause of death. Congressional citation of Woolsey would bolster the case for disability recognition amid separate politicization-driven morale pressure on the workforce; silence would confirm the issue has receded as a legislative priority.

Sources:

1: R. James Woolsey, CIA director during the Clinton administration, dies at 84 - ABC News

2: James Woolsey, CIA director under Bill Clinton, dies at 84 - Washington Post

3: James Woolsey, former Clinton-era CIA director, passes away at age 84 - The Hill

R. James Woolsey, CIA Director During the Clinton Administration, Dies at 84 - U.S. News & World Report

COLLECTION GAPS

UNCLASSIFIED // OPEN SOURCE