//
OFFLINE — VIEWING CACHED CONTENT
← Back to Archive

IC BRIEF

Current as of 1749 EDT (UTC-04), Friday 24 July 2026

Contents

9 stories from 41 sources across 35 organizations

KEY JUDGMENTS

Russian intelligence networks faced simultaneous exposure across four theaters this week. Russia will very likely confine its response to the Angola convictions to verbal protests through September 30, since punitive action would risk Moscow's Sub-Saharan Africa partnerships. Moderate confidence rests on Moscow's pattern of absorbing such losses bilaterally in non-NATO states. Italian prosecutors will likely announce additional arrests in the Piras espionage network before October 1. Moderate confidence reflects limited visibility into the investigation; disclosed intercepts between Astakhov and his Russian contacts would confirm wider network reach.

Japan's July 31 launch of a centralized intelligence bureau addresses the enforcement vacuum exposed by a Main Intelligence Directorate of the Russian General Staff (GRU) procurement officer's 17-month Tokyo operation under Aeroflot cover. Dutch intelligence quantified a parallel Russian campaign compromising IP cameras across NATO states, identifying 87,000 vulnerable devices as an attack surface for military logistics tracking. Japan's planned expert panel on anti-espionage legislation will likely convene before November 1. That assessment carries moderate confidence, given the coalition commitment but Japan's record of security-reform delays.

Kimsuky operations will very likely continue supply-chain targeting of South Korean groupware vendors through 2026, exploiting vendor breaches to compromise downstream customers. Seven US agencies broadened an Iranian Programmable Logic Controller (PLC) advisory to Siemens and Schneider Electric, indicating cross-platform targeting beyond the original Rockwell scope.

Adversary Intelligence

SBU Counterintelligence Arrests Two FSB Agents in Kyiv Who Registered 76 Starlink Terminals for Russian Strike Coordination

BLUF: Exploitation of a postal-worker insider to bypass Starlink registration controls reveals a structural verification gap that Security Service of Ukraine (SBU) arrests alone cannot close without systemic reform of the activation chain.

The SBU's counterintelligence directorate arrested two unemployed Kyiv residents on charges of registering 76 Starlink terminals for Russia's Federal Security Service of Russia (FSB), according to an SBU press announcement 12. The SBU said the pair, recruited through Telegram channels advertising quick money, first registered the terminals in their own names and passed the credentials to an FSB handler, then used forged Ukrainian passports and the help of a postal worker to activate additional terminals while bypassing Starlink's verification checks 123. Russian forces intended to use the terminals to coordinate missile and drone strikes and to locate Ukrainian electronic-warfare systems shielding frontline positions, the SBU said 12. Searches at the suspects' residences turned up phones documenting their FSB contacts, and the SBU said it blocked all 76 terminals; both face treason charges under Ukraine's martial-law criminal code carrying life imprisonment with asset confiscation 123.

Analyst Note: The arrests confirm a repeatable FSB pattern for accessing Ukraine's Starlink network: recruit unemployed locals through Telegram job lures, register terminals under clean identities, then use forged passports and a compromised postal-service insider to defeat verification checks. That insider access point is the operationally significant detail, pointing to a structural gap in the verification chain that other cells could replicate, and Kyiv's disclosure of a similar network within weeks suggests the loophole has been exploited repeatedly rather than as an isolated incident. Reporting rests on a single SBU release, with other outlets restating rather than independently corroborating it, and the disclosure may function as much as a deterrence signal against Telegram-recruited registration as evidence of a larger network. Whether the postal-verification gap itself has been closed, or only this cell, remains unresolved.

Sources:

1: SBU Blocks 76 Illegal Starlink Terminals Registered by Russian Agents in Kyiv - United24 Media

2: SBU arrests two FSB agents in Kyiv who registered 76 Starlink terminals for Russian military - Mezha

3: СБУ у Києві викрила агентів ФСБ за реєстрацію 76 Starlink - LB.ua

SBU press announcement on detention of two FSB agents in Kyiv for registering 76 Starlink terminals - Security Service of Ukraine (SBU) official channel

Russian Agents Activate 76 Starlink Terminals in Kyiv, SBU Says - Kyiv Post

North Korean Kimsuky Group Compromised South Korean Software Vendors With Novel Gomir Backdoor Variants

BLUF: Kimsuky's pivot to groupware supply-chain compromise very likely persists through the remainder of 2026, multiplying downstream victim access while its QUIC and cloud-API channels erode conventional network monitoring.

North Korea's Kimsuky group, tracked as APT43, compromised at least two South Korean groupware vendors between November 2025 and early 2026, exploiting a remote code execution flaw in one vendor's externally accessible mail server and social-engineering an employee at the other 12. The group deployed the known Gomir backdoor plus two new Go-based Linux variants, BirdTroy and DriveTroy, with BirdTroy supporting HTTP/3-over-QUIC command traffic and DriveTroy using hardcoded Google OAuth credentials to poll an attacker-controlled Google Drive account for commands 12. ENKI reported the actors stole customer infrastructure data, including one vendor's SaaS configuration server, to install Gomir on downstream customer systems, and tampered with a groupware login page to harvest employee credentials at portals lacking multi-factor authentication 13. ENKI attributed the campaign to Kimsuky based on shared malware certificates, overlapping C2 infrastructure and ASNs, a recurring developer username, and a Korean-keyboard artifact in a recovered proxy tool's authentication key 2. The Record and SC Media corroborated ENKI's findings without independent reporting 34.

Analyst Note: Kimsuky's pivot to compromising groupware vendors rather than direct spear-phishing very likely persists through the remainder of 2026, exploiting the access-multiplier effect of a single breach reaching hundreds of downstream customers. BirdTroy's HTTP/3-over-QUIC transport and DriveTroy's Google Drive C2 channel show deliberate investment in evading TCP-based monitoring, pushing South Korean defenders toward QUIC-aware inspection and outbound API monitoring. Confidence is moderate: the analysis rests on a single technical vendor, ENKI WhiteHat, with other outlets republishing rather than independently verifying, though certificate, ASN, and developer-artifact overlaps offer converging rather than singular attribution signals. The overlapping infrastructure could instead reflect shared North Korean tooling distributed across multiple operator teams rather than one Kimsuky-run campaign. If the supply-chain shift holds, South Korean regulators and groupware customers face pressure toward mandatory MFA and vendor-side audits rather than incident-specific fixes at the two named vendors alone.

Sources:

1: Analysis of Kimsuky's Attack on a South Korean Groupware Vendor Using a New Gomir Family Variant - ENKI WhiteHat

2: North Korea Hid New Google Drive Backdoors Inside South Korean Groupware Firms - Tech Times

3: New Kimsuky campaign compromised South Korean software vendors - The Record

4: North Korean hackers target South Korean software vendors - SC Media

Angola Court Jails Two Russian Operatives on Espionage and Terrorism Charges for Paying Locals to Stage Anti-Western Protests

BLUF: Luanda's decision to jail rather than expel Russian operatives doubles as a pre-2027 election tool, letting the People's Movement for the Liberation of Angola (MPLA) cast opposition-adjacent activism as foreign-directed subversion.

A Luanda court sentenced Russian citizens Igor Ratchin and Lev Lakshtanov to 11 and eight years respectively, convicting both on four of eleven charged counts: criminal association, espionage, terrorism, and illegal retention of currency 12. Prosecutors alleged the two, arrested in August 2025, paid local journalists and experts more than $24,000 to spread pro-Russian and anti-government content and organize protests, and linked the operation to Africa Politology, a network Angolan authorities describe as an outgrowth of the Wagner Group 23. Ratchin and Lakshtanov denied the charges, telling the court they came to Angola to establish a Russian cultural center and that disputed payments compensated legitimate services 24. The same verdict, delivered after 11:00 PM on Tuesday, gave Angolan journalist Amor Carlos Tomé a two-year suspended sentence and acquitted political activist Francisco Oliveira on related charges. The Public Prosecutor's Office has appealed, keeping all three Russian and Angolan defendants in custody pending the Luanda Court of Appeal's ruling 12.

Analyst Note: The verdict marks Angola's first criminal conviction of a Wagner-descended influence network ahead of the 2027 presidential contest, signaling Luanda's willingness to jail Russian operatives rather than merely expel them. The indictment's framing of the operation as engineering "political alternation" toward National Union for the Total Independence of Angola (UNITA) casts the ruling MPLA as treating opposition-adjacent activism as foreign-directed subversion, though sourcing rests on a single primary account with other outlets amplifying rather than independently verifying the proceeding. The prosecution may instead double as a tool for suppressing opposition-linked activism, given that a UNITA youth-wing official and a journalist were also charged. The Public Prosecutor's appeal for harsher sentences, with all three defendants still detained, keeps the case politically live through the pre-election period.

Sources:

1: Luanda court sentences Russian citizens to prison terms of 11 and eight years - Ver Angola

2: Two Russians handed down jail terms for terrorism and spying in Angola - The Star (Kenya)

3: Two Russians sentenced in Angola for terrorism and espionage - Pravda UK

4: Angola Court Jails 2 Russian Spies on Espionage, Terrorism Charges - Kyiv Post

Italy Expels Two Russian Military Attachés for Espionage, Russia Retaliates With Expulsions as Spy Network Uncovered

BLUF: Additional expulsions tied to this dispute are unlikely before August 20, with Rome's criminal investigation into the Piras spy network now the primary vector for escalation beyond the closed diplomatic tit-for-tat.

Russia's Foreign Ministry declared Italian Assistant Defense Attaché Vittorio Parrella and embassy official Davide D'Aprile persona non grata on July 20, ordering them and their families to leave within three days, and summoned Italy's chargé d'affaires Giovanni Scopa in Moscow 123. Moscow characterized the move as reciprocal for Italy's earlier expulsion of Russian military attachés Ivan Petrovich Gorbachev and Mikhail Vasilyevich Astakhov, declared persona non grata by Rome over alleged espionage 3. Italian Foreign Minister Antonio Tajani called the Russian expulsions "blatant retaliation" and wrote on X that the Russian officers had been "caught red-handed" carrying out espionage against Italian national security 23. Tajani tied the case to a Rome prosecutors' investigation in which Astakhov is alleged to have served as the primary Russian contact for a network including retired Carabinieri officer Gavino Raoul Piras 3.

Analyst Note: Reciprocal expulsions close this cycle rather than open a new one, and further personnel action tied to the dispute is unlikely before August 20, since Moscow's response tracks the standard pattern of prior expulsion rounds. The Russian move may instead reflect routine diplomatic reciprocity rather than a deliberate hybrid-campaign signal. Rome's parallel criminal investigation into the Piras network, now narrowed to Astakhov as the alleged primary handler, will drive further fallout, with additional arrests or indictments more probable than fresh persona non grata declarations. Confidence is moderate: Interfax alone supplies a primary account of the Russian statement, with other outlets recirculating rather than corroborating it, and there is no visibility into the investigation's next steps. A further expulsion round would signal Moscow intends to escalate beyond the espionage case, prompting Italian and NATO counterintelligence to widen monitoring of Russian diplomatic staff; absent that, those resources stay concentrated on the Piras prosecution.

Sources:

1: Russia declares 2 Italian diplomats persona non grata - Xinhua

2: Russia expels two Italian diplomats, country's foreign ministry says - The Jerusalem Post

3: Spy Wars Escalate: Italy-Russia Diplomatic Ties Hit New Low - EU Alive

Россия объявила персонами нон грата двух итальянских дипломатов - Interfax

Russia expelling Italian military attache, his aide as response measure — diplomat - TASS

Prior Reporting

Russian Spy Maksim Filchenkov Flees Japan After NYT Exposes Covert Weapon Component Smuggling Operation

BLUF: Press exposure rather than Japanese counterintelligence forced Filchenkov's exit, and the intermediary procurement networks he built for GRU weapons supply chains remain intact without him.

GRU officer Maksim Vladimirovich Filchenkov, 49, a member of the service's 20th Directorate operating under Aeroflot cover in Tokyo since February 2024, fled Japan on July 21 after The New York Times published an investigation identifying him on July 12, according to The Japan Times 1. Filchenkov and his wife traveled from Tokyo Haneda to Shanghai Pudong before boarding a flight to Moscow Sheremetyevo, Aviation A2Z reported, citing confirmation from a senior Ukrainian intelligence official 2. His mission focused on building logistics relationships to procure high-tech components that Russian defense manufacturers require for weapons production, routing shipments through intermediary countries that continue trading with Moscow 12. Ukrainian government estimates hold that 90 percent of Russian missiles and drones contain Japanese-origin components 2. The Times investigation noted Japan had become attractive to Russian intelligence operations due to the country's relatively limited enforcement against espionage activities 1.

Analyst Note: Filchenkov's departure confirms that press exposure, rather than Japanese counterintelligence or prosecution, ended this particular GRU procurement cell. The 20th Directorate's Tokyo operation should be read alongside the Japan National Intelligence Bureau story: Japan's creation of a centralized intelligence agency directly addresses the enforcement vacuum that allowed Filchenkov to operate for 17 months under transparent Aeroflot cover. The pipeline Filchenkov built through intermediary logistics firms remains functional absent Japanese action against those domestic facilitators, since the procurement relationships are commercial and do not depend on a single GRU handler's physical presence.

Sources:

1: A Russian spy, suddenly cast into the spotlight, flees Japan - The Japan Times

2: Russian Spy Posing as Aeroflot Employee Flees Japan After 17 Months - Aviation A2Z

A Russian intelligence officer has left Japan - LIGA.net

Allied Intelligence

Japan Names Director for New National Intelligence Bureau Set to Launch July 31 With 700 Personnel

BLUF: Japan's new intelligence bureau elevates coordination without closing the country's foundational gap: no independent foreign human-intelligence collection capability, which remains contingent on politically uncertain legislation.

The Japanese government named Kazuya Hara, 58, currently director of Cabinet intelligence, as head of a new national intelligence bureau set to launch on July 31, Chief Cabinet Secretary Minoru Kihara said Friday 12. Hara, a National Police Agency veteran who has served as chief of the Saitama Prefectural Police and head of the National Police Agency (Japan) (NPA)'s Security Bureau, will hold a position on par with the secretary-general of the National Security Secretariat 1. The bureau, an upgrade from the existing Cabinet Intelligence and Research Office established under legislation Japan's parliament enacted in May, will have an initial staff of roughly 700 personnel and will serve as secretariat for a new national intelligence council chaired by Prime Minister Sanae Takaichi 13. The government also plans to launch an expert panel as early as this summer to discuss anti-espionage legislation and a proposed external intelligence agency, per a coalition agreement between the Liberal Democratic Party and the Japan Innovation Party 13.

Analyst Note: The bureau's launch consolidates analytic authority under a single director answerable directly to the prime minister, elevating intelligence coordination to a rank equal with the National Security Secretariat for the first time in Japan's postwar history. Wire-concentrated sourcing, with two of three accounts tracing to the same filing, tempers the corroboration to solid rather than fully independent. Tapping a National Police Agency careerist over a diplomat signals continuity with police-centric domestic security tradition rather than a pivot toward foreign tradecraft, and may reflect institutional caution to preserve administrative continuity as much as reform momentum. The bureau consolidates and analyzes existing reporting rather than collecting independently, leaving Japan's absence of a dedicated external human-intelligence service unresolved pending the planned anti-espionage panel. Naming a director and holding the July 31 date counters prior doubts about bureaucratic slippage on this reform.

Sources:

1: Kazuya Hara named head of new national intelligence bureau - The Japan Times

2: 国家情報局 今月31日設置を決定 初代情報局長に原和也氏 - NHK

3: Japan to Set Up National Intelligence Bureau on July 31 - Nippon.com

初代「国家情報局長」に原和也内閣情報官 分析の司令塔、31日に局設置 - Jiji Press

Prior Reporting

Dutch Intelligence Agencies Warn Russian State Actors Systematically Compromising IP Cameras Across NATO States for Military Espionage

BLUF: Russia's exploitation of default-credential IP cameras will likely persist over the coming months as a scalable, low-cost military logistics tracking capability that NATO's fragmented patching governance cannot close at speed.

The Netherlands' General Intelligence and Security Service (Netherlands) (AIVD) and Defence Intelligence and Security Service (Netherlands) (MIVD) published a joint cybersecurity advisory on July 10 warning that at least one Russian intelligence service is systematically compromising internet-connected IP cameras across the Netherlands, other EU and NATO member states, and Ukraine 1. The Russian service uses automated image recognition software to search camera feeds for military vehicles and cargo, mapping EU and NATO military transport routes and weapons deliveries to Ukraine 12. In Ukraine, camera access has been used in attempts to locate and target Ukrainian military personnel and destroy their equipment, according to the advisory 1. Internet intelligence firm Censys identified more than 87,000 exploitable internet-connected cameras across EU, NATO, and Ukrainian territory, including over 4,000 in Ukraine and nearly 2,000 in the Netherlands, many vulnerable through default passwords or outdated firmware such as a Dropbear SSH flaw known since 2017 2. The Dutch services assessed that Russia's digital espionage operations to support military operations have increased systematically since the start of the war in Ukraine 1.

Analyst Note: Default-password cameras require no zero-day exploits, turning bulk access via automated image recognition into a near-real-time military logistics tracking system across an 87,000-camera attack surface that individual organizations patch slowly if at all; the capability likely persists across NATO states over the coming months given the exposure size and patching inertia. Moderate confidence reflects the AIVD's direct attribution to a named Russian intelligence service combined with independent Censys quantification of the exposure, though the advisory does not identify the service or disclose confirmed compromises beyond the Netherlands, and the 87,000 figure measures vulnerability rather than confirmed access, which may concentrate on cameras positioned along logistics routes rather than spanning the full surface. Sourcing rests on the AIVD/MIVD advisory as the sole primary document, with Censys scale data added independently. Persistent exploitation leaves NATO logistics planners exposed on military transport routes unless camera hardening accelerates, which would strip Russia of a low-cost persistent surveillance capability.

Sources:

1: Russian cyber espionage campaign exploits insecure IP cameras in Europe and Ukraine, Dutch agencies say - Industrial Cyber

2: Russian Intelligence Hacks IP Cameras to Spy on Military Logistics Across NATO States and Ukraine - The Hacker News

Cybersecurity Advisory: Russian State Actors Are Compromising IP Cameras - AIVD/MIVD

Russian Intelligence Hijacks IP Cameras to Monitor Weapons Deliveries to Ukraine - Cyber Security News

Prior Reporting

IC Technology

Seven US Agencies Update Joint Advisory on Iranian Cyber Actors Targeting Critical Infrastructure PLCs With New Detection Guidance

BLUF: Expanding the advisory from one PLC vendor to three confirms Iranian cyber operators have industrialized their intrusion tradecraft into a cross-platform capability targeting engineering workflows, not just perimeter gaps.

Cybersecurity and Infrastructure Security Agency (CISA), the FBI, Environmental Protection Agency (EPA) and other US and international partners revised the joint advisory "Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure," first issued in April, with an update released Wednesday 1. The revision adds guidance for detecting and mitigating malicious changes to reusable code modules in Rockwell Automation/Allen-Bradley PLC programs and expands the list of affected manufacturers to include Schneider Electric and Siemens 123. According to the advisory, Iranian-affiliated actors have disrupted PLCs across water, wastewater, energy and government-facility sectors using techniques including downloading malicious project files, manipulating Human-Machine Interface (HMI) and Supervisory Control and Data Acquisition (SCADA) displays, and exfiltrating files through third-party remote command-and-control channels while bypassing security alarms, resulting in operational disruption and financial loss for affected organizations 1. Updated mitigations call on operators to restrict PLCs from direct internet exposure, use secure gateways and firewalls, change default passwords and monitor project files for unauthorized changes, per statements from CISA Acting EAD for Cybersecurity Chris Butera, EPA Assistant Administrator Jess Kramer and FBI Cyber Division Assistant Director Brett Leatherman 1.

Analyst Note: The revision reframes the threat from a single-vendor issue to a cross-platform pattern, treating Rockwell, Schneider Electric and Siemens as facing identical intrusion techniques rather than isolated incidents, and its focus on reusable code modules rather than perimeter controls indicates investigators traced compromises into engineering workflows where malicious logic can persist across firmware updates and device swaps. Sourcing rests entirely on CISA's own advisory, with trade outlets merely summarizing rather than corroborating independently, and the expanded manufacturer list may equally reflect wider baseline monitoring and improved attribution tooling rather than a genuine broadening of Iranian-affiliated targeting. Operators across water, wastewater, energy and government facilities face renewed pressure to segment PLCs from direct internet exposure and audit project files for tampering, since the update ties expanded scope to confirmed operational disruption and financial loss rather than theoretical risk.

Sources:

1: CISA and Partners Revise Iranian-Affiliated PLC Threat Advisory - AFCEA International

2: Federal Agencies Update Warning on Iranian Cyber Actors Targeting PLCs - ExecutiveGov

3: Agencies issue updated advisory on Iranian cyber actors targeting programmable logic controllers - American Hospital Association

Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure (AA26-097A) - CISA

Federal agencies broaden alert on Iran-linked OT attacks - The Record from Recorded Future News

Iranian Hackers Targeting Siemens and Schneider Electric Industrial Control Systems - Infosecurity Magazine

Prior Reporting

IC Technology & Acquisition

Palantir Protests DIA ASTRA AI Solicitation Arguing Commercial Solution Exists Under Federal Acquisition Law

BLUF: Defense Intelligence Agency (DIA)'s pattern of conceding corrective action rather than contesting Palantir's Federal Acquisition Streamlining Act (FASA) challenges suggests the agency lacks confidence in defending its custom-development procurement strategy at Government Accountability Office (GAO).

Palantir filed a pre-award protest with the Government Accountability Office on July 20 against a Defense Intelligence Agency solicitation issued under the Strategic Intelligence Technology Enterprise (SITE) III contract vehicle, arguing the agency's plan to custom-develop a research and analysis software platform for its Advanced Systems for Technical Research and Analysis (ASTRA) program violates the Federal Acquisition Streamlining Act of 1994 12. The company contends it already has a commercially available solution meeting DIA's requirements and that the 1994 law, along with the 2009 National Defense Authorization Act, requires agencies to buy commercial products when available 12. Washington Technology and Singularity Capital Advisors both reported the filing, noting Palantir raised similar grounds in a prior protest against DIA's Prometheus project, which DIA resolved through corrective action without issuing a replacement solicitation 12. GAO is expected to rule by October 28 12.

Analyst Note: GAO's review freezes DIA's ability to proceed with the ASTRA solicitation through October 28, mirroring the Prometheus dispute where DIA withdrew the challenged solicitation without issuing a replacement. Palantir's repeated invocation of the same 1994 statute across DCGS, Prometheus, and now ASTRA reflects a consistent legal strategy targeting agencies' use of custom-development vehicles wherever it argues a commercial alternative exists, and the outcome will determine whether DIA continues bespoke software builds under SITE III or pivots toward commercial procurement for its technical research platforms. The protest also functions to preserve Palantir's competitive position against custom-development bidders on the task order regardless of the FASA claim's merits. Confidence is low given single-source trade press reporting, no visibility into DIA's internal litigation strategy, and no public signal on whether the agency will repeat the corrective-action pattern or instead contest the filing.

Sources:

1: Palantir invokes its favorite law again — this time against DIA's ASTRA solicitation - Washington Technology

2: Palantir invokes its favorite law again — this time against DIA ASTRA solicitation - Singularity Capital Advisors

COLLECTION GAPS

UNCLASSIFIED // OPEN SOURCE