//
OFFLINE — VIEWING CACHED CONTENT
← Back to Archive

IC BRIEF

Current as of 0906 EDT (UTC-04), Saturday 25 July 2026

Contents

9 stories from 32 sources across 29 organizations

KEY JUDGMENTS

Iranian proxy operational willingness and strategic nuclear intent have converged. The Secret Service switched Air Force One in Ankara after detecting a credible proxy missile plot, while a separate US assessment found Mojtaba Khamenei seeks a miniaturized warhead rather than the crude deterrent his father tolerated. New Iran-specific sanctions, force posture changes, or expanded military action citing these intelligence developments are likely by November 30. Moderate confidence reflects two operationally distinct threat streams without evidence that proxy and nuclear tracks are coordinated.

The Trump-Xi summit will likely convene and produce law-enforcement deliverables before November, despite the Five Eyes advisory publicly attributing Chinese HUMINT recruitment, since Patel's Beijing meeting built a cooperation channel on fentanyl, fraud, and fugitives that supplies ready-made product. Japan's new National Intelligence Bureau, launching July 31, is likely to publicly identify Chinese intelligence activity as a priority threat within 120 days, extending the allied counterintelligence perimeter. Summit postponement would indicate the allied intelligence posture is gaining policy weight over engagement.

IC Operations & Tradecraft

Trump Switched to Older Air Force One at NATO Summit After Intelligence Detected Credible Iranian Missile Plot

BLUF: Washington's decision to publicly disclose the plane swap signals a deliberate shift toward using intelligence exposure as deterrence against Iranian targeting of presidential assets.

President Trump departed the NATO summit in Ankara this month on the older Air Force One jet rather than the new Qatari-donated 747, after U.S. officials told CBS News the government had detected a credible plot by Iran and allied proxy groups to fire a missile at the aircraft 1. The New York Times first reported the Iranian proxy threat that prompted the switch 2. Upon receiving the intelligence, the Secret Service shifted to a backup plan, and Trump flew the older plane from Ankara to the United Kingdom before returning to the newer jet to complete the trip home 1. The White House said Trump will continue flying on the older aircraft while the new 747 undergoes about a month of additional upgrades this fall, with press secretary Karoline Leavitt stating the newer plane "is perfectly safe" 1.

Analyst Note: The plane swap indicates the Secret Service assessed the Iranian proxy threat as operationally credible rather than aspirational, since a switch of this cost and disruption during a NATO summit is not undertaken for routine chatter. It also exposes an unresolved capability question for the newer Qatari 747: its defensive systems against missile threats remain unverified against the older aircraft's documented laser countermeasures, forcing continued reliance on the legacy jet through the fall retrofit. The disclosure itself, following Trump's earlier public warning to Iran, indicates Washington now favors disclosing awareness of Iranian targeting over managing the threat quietly.

Sources:

1: Trump flew from Turkey on older plane after credible threat from Iran and proxies - CBS News

2: Iranian Proxy Threat to Air Force One Prompted Trump to Switch Planes in Turkey - The New York Times

Report: Trump switched planes in Turkey over 'credible threat' by Iranian proxies - The Times of Israel

Donald Trump returning to US on old Air Force One amid Iran threats - The Hill

Prior Reporting - [Israel reportedly warned US that Iran devised a new plot to assassinate Trump](https://www.timesofisrael.com/israel-reportedly-warned-us-that-iran-devised-a-new-plot-to-assassinate-trump/) (2026-07-10) - [Iran's reported assassination threat raises fears around risk to Trump](https://thehill.com/homenews/administration/5963476-iran-trump-assassination-risk-israel-air-force-one/) (2026-07-10) - [Israel Shared New Intelligence Indicating Fresh Iranian Plot to Kill Trump](https://www.wsj.com/politics/national-security/israel-shares-intelligence-on-iran-plot-to-kill-trump) (2026-07-09)

US Intelligence Assesses New Iranian Supreme Leader Mojtaba Khamenei Far More Inclined to Pursue Nuclear Weapons

BLUF: Assessed Iranian intent has shifted toward a deliverable warhead under Mojtaba Khamenei, but concrete weaponization steps such as resumed enrichment remain unlikely by January 2027 absent fresh collection access.

A New York Times report Friday, citing officials briefed on US intelligence assessments, said Iran's new Supreme Leader Mojtaba Khamenei is far more interested in acquiring a nuclear weapon than his father, who held a longstanding fatwa against weaponization 123. Officials said the assessment draws mainly on public statements and intercepted conversations from before the war, since Mojtaba has avoided public appearances and limited his communications after being wounded in the February 28 strike that killed his father 234. US intelligence assesses he seeks a warhead that could eventually be miniaturized for a long-range missile, a different objective than the crude deterrent device officials said Iran pursued late in the Biden administration 23. Separately, officials said Iran has not resumed enrichment but has moved centrifuges to the fortified underground Pickaxe Mountain complex, a transfer Israel has tracked and that some US officials assessed as an effort to preserve equipment beyond the reach of American strikes 234.

Analyst Note: The assessment rests on statements and intercepts collected before the war, against a leader who has since gone dark, so confirmation of concrete Iranian weaponization steps, such as resumed high-level enrichment or weapons-trigger work, is unlikely by January 31, 2027. Moderate confidence reflects an assessment built on dated collection with no fresh corroborating access to Mojtaba's current thinking. The Pickaxe Mountain centrifuge transfer indicates asset preservation rather than an active weaponization sprint, and Tehran's continued avoidance of enrichment resumption removes the clearest observable indicator Washington would need to validate the harder line now attributed to the new supreme leader. Taken together with the Air Force One proxy missile plot, which demonstrates current Iranian operational willingness even as the strategic nuclear trajectory remains unconfirmed.

Sources:

1: US intel said to find Mojtaba Khamenei far more inclined than father to seek nukes - Times of Israel

2: Iran's Mojtaba Khamenei pursuing nuclear warhead, US intelligence says - Ynetnews

3: US assesses Mojtaba Khamenei more interested in nuclear weapons than predecessor - report - The Jerusalem Post

4: US intelligence: Mojtaba Khamenei more open to build nuclear bomb - Israel National News (Arutz Sheva)

Iran's New Leader Is More Open to Pursuing a Nuclear Weapon, U.S. Intelligence Says - The New York Times

Prior Reporting - [Irans injured supreme leader out of public view but still shaping strategy, US intel assesses](https://www.cnn.com/2026/05/08/politics/iran-khamenei-us-deal-intelligence) (2026-05-08) - [US intelligence believes Khamenei remains key figure in Irans war strategy despite serious injuries](https://www.ynetnews.com/article/sj1ykm2rbl) (2026-05-08) - [US intel said to assess Mojtaba Khamenei is playing key role in crafting Irans war strategy](https://www.timesofisrael.com/liveblog_entry/us-intel-said-to-assess-mojtaba-khamenei-is-playing-key-role-in-crafting-irans-war-strategy/) (2026-05-08) - [Irans new Supreme Leader shaping war strategy even as questions swirl over his health: Report](https://aninews.in/news/world/us/irans-new-supreme-leader-shaping-war-strategy-even-as-questions-swirl-over-his-health-report20260509082431/) (2026-05-09)

FBI Director Patel Meets China Public Security Chief Wang Xiaohong in Beijing on Fentanyl and Fraud Cooperation

BLUF: Beijing and Washington are quietly building a law-enforcement channel that bypasses the missing extradition treaty, creating summit-ready deliverables whose shelf life hinges on broader political conditions.

FBI Director Kash Patel met Chinese State Councilor and Minister of Public Security Wang Xiaohong in Beijing on Friday, according to Xinhua and Reuters 12. Wang called for deepened practical cooperation on drug control, telecom and online fraud, anti-money laundering, and fugitive pursuit, per China's official summary of the talks 12. Patel said on social media the engagement has produced results on fentanyl precursor pipelines, scam centers, violent crimes against children, and a joint fugitive task force 23. Reuters reported the meeting followed two recent fugitive repatriations between the two countries, including a handover Thursday of a U.S. fugitive wanted for suspected murder and sexual assault, despite the absence of a bilateral extradition treaty 2. The talks precede a planned Trump-Xi summit in Washington expected in late September 23.

Analyst Note: The Patel-Wang meeting establishes a functioning law-enforcement channel operating independent of the absent bilateral extradition treaty, with fugitive handovers substituting for formal judicial process. Scope has widened beyond fentanyl precursors to telecom fraud, child exploitation, and fugitive recovery, pointing to an institutionalized rather than single-issue relationship. The meeting falls ahead of the planned Trump-Xi summit in Washington, giving both governments a concrete deliverable to display before leader-level talks. Whether the channel persists past the summit depends on political will in both capitals rather than on the law-enforcement mechanics themselves.

Sources:

1: Update: Senior Chinese official meets FBI director - Xinhua

2: China's top police chief and FBI director vow closer law enforcement cooperation - Reuters

3: FBI head Kash Patel meets China security chief Wang Xiaohong in Beijing on crime crackdown - South China Morning Post

Houthi Senior Leadership Goes to Ground Imposing Total Electronics Ban After Wave of Israeli Decapitation Strikes Kills 12 Officials

BLUF: Houthi countermeasures after the August 28 decapitation strike make another senior kill unlikely within 90 days, while leaving the group's missile campaign operationally unbroken.

Last August 28, an Israeli airstrike killed Houthi Prime Minister Ahmed al-Rahawi and 11 other ministers and senior officials, the Israel Defense Forces and Long War Journal reported 1. Some 200 Israeli intelligence personnel from IDF units 8200, 9900 and 504, alongside US CENTCOM representatives, prepared the operation for weeks from a secret bunker, according to Israeli security sources cited by Kan 2. Defense Minister Israel Katz said the remaining Houthi leadership was "escaping Sanaa," citing an Asharq Al-Awsat report describing "unprecedented confusion and panic" among survivors 2. JFeed reported that Houthi leaders have since imposed a total ban on smartphones and GPS-enabled devices, relocated to unlisted safehouses, and replaced in-person meetings with couriers and encrypted paper notes 3. The group has also swapped armored convoys for unmarked vehicles and launched mass arrests in Sanaa and Al-Hudaydah targeting suspected informants for Israel, the US and Saudi Arabia 3.

Analyst Note: The counter-surveillance measures indicate Israel's decapitation strike degraded, but did not eliminate, Houthi command continuity, since Abdul Malik al-Houthi and the group's missile and drone campaign against Israel remain intact. Another strike killing a minister-level or equivalent Houthi official by October 23 is unlikely, as the electronics ban, courier-based communications, and dispersal to unlisted safehouses raise the intelligence-collection burden that enabled the August 28 operation. Moderate confidence reflects convergent reporting on the Houthis' operational security overhaul but no independent indicators of a new Israeli targeting package in motion. Continued purges of suspected informants further narrow the pool available to Israeli human intelligence inside Sanaa.

Sources:

1: Israel kills 12 top officials in Yemen's Houthi-controlled government - FDD's Long War Journal

2: Katz: Top Houthis 'escaping Sanaa' after IDF killed Yemeni terror group's PM, ministers - The Times of Israel

3: Yemini Houthi Leadership Goes to Ground Following Wave of High-Profile Assassinations - JFeed

Allied Intelligence

Five Eyes Issue Joint Advisory Warning of Chinas Expanding Human Intelligence Campaign via Online Recruitment

BLUF: Public attribution by all five services simultaneously functions as a deterrence signal to Beijing and a defensive inoculation for the expanded target set of academics, journalists, and freelance analysts now inside China's recruitment aperture.

The Five Eyes intelligence alliance published a joint bulletin, Safeguarding Our Secrets, on June 3, warning that Chinese military intelligence services are using online recruitment platforms to target Western academics, journalists, researchers and security-clearance holders 12. The bulletin, issued jointly by Australia's Australian Security Intelligence Organisation (ASIO), Canada's Canadian Security Intelligence Service (CSIS), the FBI, the UK's MI5 and New Zealand's New Zealand Security Intelligence Service (NZSIS), describes officers posing as consultancy or HR-firm employees on professional networking sites, offering paid analytical work before shifting to encrypted channels and requesting increasingly sensitive material 23. Payments reportedly range from several hundred to several thousand dollars, often routed through third-party services or cryptocurrency 2. The advisory identifies targets beyond traditional security-clearance holders to include academics, journalists, think tank researchers and freelance writers, and notes that some individuals involved have already faced criminal prosecution, dismissal or revocation of security clearances 2.

Analyst Note: The joint advisory marks a shift toward public attribution of Chinese human-intelligence tradecraft rather than confinement to classified channels, and it extends the recruitment risk pool beyond security-clearance holders to academics, journalists and freelance analysts previously treated as low-value targets. Publication functions as a resilience measure, aiming to make the recruitment pattern recognizable before targets accept payment or transmit sensitive material. The emphasis on aggregating individually unclassified fragments reflects assessed Chinese collection doctrine rather than disclosure of a single new operational method. Universities, media organizations and consultancies face pressure to build vetting protocols for unsolicited paid analytical work, particularly where compensation routes through cryptocurrency or third-party payment services.

Sources:

1: Safeguarding Our Secrets - MI5 / Five Eyes

2: Guarding the Knowledge Frontier: Five Eyes Warn of Chinas Expanding Human Intelligence Campaign - Defence Matters

3: Five Eyes: China expanding state secret recruitment campaign - The Register

Five Eyes Joint Bulletin - Safeguarding Our Secrets - MI5 / Five Eyes (ASIO, CSIS, FBI, MI5, NZSIS)

Safeguarding Our Secrets - MI5 / Five Eyes (joint bulletin: FBI, MI5, ASIO, CSIS, NZSIS)

Prior Reporting - [Five Eyes security alliance warns of Chinese espionage threat](https://www.straitstimes.com/world/europe/five-eyes-security-alliance-warns-of-chinese-espionage-threat) (2026-06-04) - [U.S. and intelligence allies issue rare joint warning about China](https://www.washingtonpost.com/world/2026/06/03/us-allies-say-china-is-using-job-platforms-target-security-personnel/) (2026-06-03) - [Chinese spies using online job platforms to recruit, Five Eyes security alliance warns](https://www.cnn.com/2026/06/03/world/five-eyes-china-espionage-latam-intl) (2026-06-03)

Japan Launches National Intelligence Bureau to Consolidate Fragmented Spy Agencies by July 31

BLUF: Without a foreign collection service or statutory authority to compel agency reporting, Japan's new bureau centralizes the routing of intelligence but not the production of it.

Japan's Cabinet approved the establishment of a National Intelligence Bureau to launch July 31, upgrading the existing Cabinet Intelligence and Research Office into a control-tower body under the prime minister's office 123. Kazuya Hara, a former senior police official and director of Cabinet intelligence, will lead the roughly 700-person bureau, and Prime Minister Sanae Takaichi will chair the accompanying National Intelligence Council's first meeting the same day 13. The council, established under legislation Japan's parliament enacted in late May, will include the chief Cabinet secretary, foreign minister and justice minister, and will set policy on national security, counterterrorism and foreign intelligence activity 23. The reorganization does not create a separate foreign intelligence service, which the Yomiuri Shimbun reported has been postponed; Japan's existing agencies, including the Defense Intelligence Headquarters and the Public Security Intelligence Agency, will continue operating independently of the new bureau 2. A government-appointed expert panel is expected to convene as early as this summer to weigh anti-espionage legislation and a proposed external intelligence agency 3.

Analyst Note: The reorganization concentrates analytic authority over North Korean, Chinese, and Russian threat reporting inside the prime minister's office without adding collection capacity, since Tokyo again shelved the foreign intelligence service needed to build human networks abroad. Hara inherits a control-tower mandate but no explicit authority to compel the Defense Intelligence Headquarters, Public Security Intelligence Agency, or Foreign Ministry to share raw reporting, so integration will hinge on bureaucratic culture the reform does not touch. Centralizing threat judgment under one office also raises the risk that a single flawed assessment on Chinese rare-earth coercion or North Korean missile activity propagates further before correction. The pending anti-espionage legislation and external-agency review, still at the expert-panel stage, will determine whether this reform gains new authorities or only faster routing.

Sources:

1: Japan to launch new intelligence agency and intel oversight body at end of July - Washington Times

2: Japan to launch national intelligence bureau July 31 - UPI

3: Japan to Set Up National Intelligence Bureau on July 31 - Nippon.com (Jiji Press)

Prior Reporting - [Japan Is Finally Building a Modern Intelligence Service. Heres Why.](https://nationalinterest.org/blog/buzz/japan-finally-building-modern-intelligence-service-heres-why-ps-071626) (2026-07-16) - [Japan is setting up its first centralised intelligence agency to counter China](https://www.globaldefensecorp.com/2026/07/14/japan-is-setting-up-its-first-centralised-intelligence-agency-to-counter-china/) (2026-07-14) - [What is Japan's new intelligence agency, and why is Tokyo building it?](https://www.aljazeera.com/news/2026/7/13/what-is-japans-new-intelligence-agency-and-why-is-tokyo-building-it) (2026-07-13)

IC Technology & Cyber

Russian Hackers Target US Nuclear Scientists and Defense Contractors in Year-Long Email Espionage Campaign

BLUF: Allied attribution of "Laundry Bear" across more than a dozen governments signals that Russia's cyber-collection against Western nuclear and defense targets has reached a scale forcing coordinated defensive response.

A joint advisory from US and allied security agencies, released Thursday, warns of an ongoing Russian cyber-espionage campaign targeting nuclear scientists, defense contractors, and government employees over the past year 12. Security firm Proofpoint told CNN the hackers targeted email servers used by "nuclear installations and the defense industrial base," with an apparent focus on entities working on nuclear fusion research 12. The advisory said the group used a software exploit requiring only that a target open an email, capable of extracting up to three months of correspondence and an organization's full email directory, and reported the operators tested techniques against Ukrainian targets before deploying them against NATO members 123. Finland's Supo, working with the Finnish Defence Intelligence Agency and the US NSA, separately identified the actor as "Laundry Bear," saying it has used social engineering and stolen credentials against public administration, critical infrastructure, and defense-sector targets in NATO countries and Ukraine 4. Thai authorities arrested an alleged member of the group in November, extradited to the US, who made an initial court appearance in Boston last month 123.

Analyst Note: The joint publication by more than a dozen governments obligates targeted sectors to audit email logs against the exploit's signature, since the level of technical detail in the advisory indicates allied services hold collection on the group beyond what Proofpoint and other private researchers have disclosed. Identification of the same activity as "Laundry Bear" by Finnish and US services confirms a shared attribution across multiple national intelligence services rather than an isolated private-sector finding, widening the set of NATO organizations expected to conduct retrospective reviews. The focus on nuclear fusion research indicates Russia's collection priorities extend beyond battlefield-relevant intelligence into energy-technology competition. Continued silence from the Department of Energy, FBI, and NSA on specifics indicates the scope of any compromise remains under assessment.

Sources:

1: New warnings that Russian operatives are targeting the emails of US nuclear scientists and defense contractors - CNN

2: New warnings that Russian operatives are targeting the emails of US nuclear scientists and defense contractors - CNN

3: Russian State-Backed Hackers Target US Defense and Nuclear Organizations - UNITED24 Media

4: Finnish spy agency issues new warning of Russian cyberattacks via email servers - YLE News

Adversary Intelligence

North Korea Intelligence Agency Busts Elite Hacking Ring of Former RGB Cyber Operatives Inside State Banks

BLUF: Pyongyang's own cyber veterans turning state-trained offensive tools against regime banks undercuts Western assumptions that Reconnaissance General Bureau (RGB)-linked hacking units operate under tight, reliable state control.

North Korea's National Intelligence Agency arrested a hacking ring on the night of July 12 after raiding a safe house in Pyongyang, catching members laundering funds at their computers, according to a Daily NK source inside the country 1. The group, led by discharged veterans of a Reconnaissance and Intelligence General Bureau cyber unit and staffed with recruits from Kim Chaek University of Technology and Pyongyang University of Science, breached internal networks at the Chosun Central Bank and the Foreign Trade Bank 1. Using Chinese-made wireless equipment and encrypted messaging, the ring diverted state trade funds and foreign currency into cryptocurrency, moved it through brokers in China, and exchanged it back into dollars and yuan through contacts in Sinuiju and Hyesan 1. Investigators traced the scheme after flagging discrepancies in currency-payment approvals and irregular overseas IP access; authorities seized computer equipment and burner phones during the arrests 1. CoinTurk News and ChinaTechNews.com relayed the same account, both citing Daily NK as the sole underlying source 23.

Analyst Note: The breach exposes a control failure inside North Korea's own financial and cyber apparatus: veterans of the Reconnaissance and Intelligence General Bureau turned state-trained offensive skills against the Chosun Central Bank and Foreign Trade Bank rather than foreign targets. Discovery through payment-approval discrepancies and irregular overseas IP access indicates Pyongyang's internal monitoring caught the scheme only after sustained operation, not through preventive controls. The National Intelligence Agency's show of force and the warning that punishment extends across family lines are directed at the broader IT and cyber workforce trained at Kim Chaek and Pyongyang University of Science. The episode complicates external assessments of loyalty and reliability within RGB-linked cyber units that Western governments attribute to state-directed hacking campaigns abroad.

Sources:

1: North Korea busts elite hacking ring inside its own banks - Daily NK

2: North Korea arrests state-trained hackers for stealing regime's crypto funds - CoinTurk News

3: North Korean Hackers Arrested After Laundering State Funds With Crypto - ChinaTechNews.com

IC Oversight & Policy

Senate to Vote on Jay Clayton DNI Nomination After Intelligence Committee Advances on Party-Line 9-8 Vote

BLUF: Clayton's confirmation is very likely by late August, and Warner's decision not to obstruct signals Democrats have conceded the fight before it reaches the floor.

The Senate Intelligence Committee advanced Jay Clayton's nomination for director of national intelligence in a closed-door, party-line 9-8 vote, with all Democrats opposed, according to a person familiar with the vote cited by PBS NewsHour 1. Senate Majority Leader John Thune filed cloture on the nomination the following day, setting up a floor vote as early as next week, Roll Call reported 2. Committee Vice Chairman Mark Warner said he was "bitterly disappointed" in Clayton after a hearing in which the nominee repeatedly declined to say that Joe Biden won the 2020 election, though Warner said he did not intend to slow the floor vote 1. Committee Chairman Tom Cotton said Clayton is "a highly qualified nominee with a deep experience combating a wide range of national security threats" 1.

Analyst Note: Thune's same-week cloture filing locks the floor calendar before opposition can organize further, and Warner's refusal to slow the vote despite his "bitterly disappointed" remarks removes the last plausible Democratic lever short of the full post-cloture debate window. High confidence in that assessment rests on the 53-47 Republican majority, cloture as a concrete procedural commitment, and Warner's explicit disavowal of delay. Confirmation would end Pulte's interim tenure atop US intelligence agencies and clear the calendar for Thune's planned FISA Section 702 revote. Democrats may use the 30-hour debate allotment to register objection to Clayton's refusal to affirm the 2020 election outcome, but the procedural window cannot alter a result Republican numbers already control.

Sources:

1: Senate panel advances Jay Clayton's nomination for director of national intelligence - PBS NewsHour

2: Jay Clayton heads toward DNI confirmation vote - Roll Call

Prior Reporting - [Feat of Clayton](https://www.spytalk.co/p/feat-of-clayton) (2026-07-22) - [Senate Intel advances Jay Clayton nomination for DNI](https://thehill.com/homenews/administration/5981416-senate-intelligence-committee-advances-clayton/) (2026-07-21) - [Senate committee advances Jay Clayton's nomination for intelligence chief over Democrats' opposition](https://www.cbsnews.com/news/jay-clayton-director-of-national-intelligence-senate-intelligence-committee/) (2026-07-21) - [Senate Intelligence Committee advances Jay Clayton's nomination for DNI, floor vote expected soon](https://www.washingtontimes.com/news/2026/jul/21/senate-intelligence-committee-advances-jay-claytons-nomination-dni/) (2026-07-21)

COLLECTION GAPS

UNCLASSIFIED // OPEN SOURCE