//
OFFLINE — VIEWING CACHED CONTENT
← Back to Archive

IC BRIEF

Current as of 0411 EDT (UTC-04), Friday 31 July 2026

Contents

8 stories from 34 sources across 28 organizations

KEY JUDGMENTS

The convergence of Russian, Iranian, and Democratic People's Republic of Korea (DPRK) cyber campaigns on three separate US defensive domains this week demonstrates state actors exploiting the gap between advisory publication and target remediation. Russia's Laundry Bear deployed an Exchange zero-day against government targets one day after the relevant Proofpoint-NSA advisory, while Iran-affiliated actors struck operational technology at over 30 Minnesota water utilities four days after Cybersecurity and Infrastructure Security Agency (CISA)'s updated Programmable Logic Controller (PLC) advisory. Public confirmation of government victim compromise from the OWAReaper campaign is unlikely within the next month.

Low confidence in the victim-confirmation assessment reflects the persistence mechanism, which survives credential rotation and full device re-imaging, extending both eradication timelines and the window before any agency would disclose impact. Amazon's parallel attribution of four npm supply-chain compromises to DPRK's Sapphire Sleet consolidates previously isolated crypto-theft incidents into a single actor's repeatable maintainer-targeting playbook.

AhnLab's documentation of shared infrastructure between DPRK state intrusions and Gunra ransomware operators in South Korea points to potential state-to-criminal tool proliferation that the current evidence does not resolve. Whether CISA proceeds to formal attribution of the Minnesota attack to Iran-affiliated actors determines whether the response escalates beyond coordination.

Adversary Intelligence

Amazon Links Debug and Chalk NPM Supply Chain Attacks to North Korean State Hackers

BLUF: Collapsing four npm compromises into one DPRK campaign means any organization consuming popular JavaScript packages faces a persistent, socially engineered supply-chain threat with no reliable upstream trust signal.

Amazon Threat Intelligence attributed four npm supply-chain compromises to a single DPRK-linked threat actor tracked as Sapphire Sleet, also known as Stardust Chollima, BlueNoroff, CageyChameleon and Alluring Pisces 1. The group trojanized the typo-crypto package in March 2025, then compromised the widely used debug and chalk packages in September 2025, an event Wiz Research found affected roughly one in ten cloud environments within a two-hour window 12. In March 2026 the same operational playbook appeared in a compromise of axios, a JavaScript library with more than 100 million weekly downloads that Google and Microsoft had already tied to North Korean actors; Amazon says the axios incident had not previously been linked to the earlier package compromises 13. Amazon assesses the attribution with medium confidence based on shared tactics, techniques, procedures and command-and-control infrastructure, and says the attacker gained access in each case by socially engineering a trusted package maintainer before publishing a malicious update 14.

Analyst Note: Amazon's attribution collapses four npm compromises spanning March 2025 to March 2026, including the September breaches of debug and chalk and the March 2026 axios incident already tied by Google and Microsoft to North Korean actors, into one financially motivated DPRK campaign built on maintainer social engineering, with medium confidence resting on shared TTPs and command-and-control infrastructure rather than direct operational access. The disclosure traces to a single primary source, AWS's own technical writeup, with other outlets offering same-day summaries but no independent corroboration, and newly links the earlier typo-crypto, debug, and chalk incidents to the actor behind axios. Shared tooling could instead reflect TTPs copied or sold across multiple DPRK-aligned units rather than one group running all four operations, a distinction that determines whether defenders consolidate monitoring around a single adversary's indicators or must keep treating each compromise as a separate threat cluster.

Sources:

1: Amazon identifies North Korean hacker group behind open-source supply chain attacks - AWS Security Blog

2: Amazon links Debug, Chalk NPM supply-chain attacks to North Korean hackers - BleepingComputer

3: North Korean hackers behind major open-source supply chain attacks, Amazon says - The Record

4: Amazon links four poisoned npm packages to one North Korean crew - The Register

Amazon Links Debug and Chalk npm Hijack to North Korea's Sapphire Sleet - The Hacker News

North Korea Lazarus Group Sharing Attack Tools With Ransomware Criminals, South Korean Agencies Warn

BLUF: Shared infrastructure between Pyongyang's state hackers and criminal ransomware operators complicates attribution for defenders and almost certainly will not be formally confirmed as unified command before late October.

A joint advisory from South Korea's National Intelligence Service (NIS), National Police Agency, Korea Internet and Security Agency (KISA), and the Financial Security Institute, published alongside an AhnLab technical report Wednesday, states a state-sponsored threat group exploited a buffer-overflow vulnerability in AnySign4PC (versions 1.1.4.4-1.1.4.6, patched in 1.1.5.0), mandatory financial security software, via a WebSocket connection that triggered backdoor installation without any user prompt or download, from 2025 into the first half of 2026 12. The joint advisory and AhnLab's report do not formally name the actor as Lazarus; that attribution stems from AhnLab's separate April 2026 report tying a March 2026 AnySign4PC watering-hole attack to the group and from outside researchers' tracking of the SIGNBT/COPPERHEDGE toolset 23. AhnLab documented 15 compromised South Korean websites across media, education, healthcare, and manufacturing sectors used in watering-hole attacks alongside spear-phishing, and confirmed related activity at 72 organizations 3. The campaign delivered backdoors AhnLab designated Struggle (SIGNBT 3.0) and Brandoor (COPPERHEDGE) 23. Separately, AhnLab found a March incident involving Gunra ransomware operators exploiting the same software vulnerability against a South Korean healthcare organization, sharing an identical SSH key fingerprint, a reverse-tunneling address, a file distribution domain, and process-injection technique with the state-sponsored intrusions, though AhnLab stated the evidence shows "a likely technical link" without confirming common operator control 234.

Analyst Note: The AnySign4PC flaw sat unpatched for at least six months, so any actor who obtained it before KISA's fix, not just the two campaigns AhnLab caught, could still hold usable access. Shared infrastructure across the state-linked intrusions and the Gunra ransomware incident: an identical SSH key fingerprint, reverse-tunneling address, and distribution domain points to a shared technical resource rather than a single command structure, though this is a low-confidence read given AhnLab's own hedged language and the lack of corroboration beyond its single advisory. The overlap could instead reflect a common access broker or leaked toolset rather than coordination between Lazarus and Gunra. Reporting rests entirely on AhnLab as sole primary source, with other outlets merely repackaging its findings. Enterprises detecting Struggle or Brandoor indicators cannot treat those signatures alone as confirmation of state sponsorship.

Sources:

1: North Korea Lazarus Group sharing tools with ransomware hackers, South Korean agencies warn - The Record

2: [[합동 사이버 보안 권고문] Operation Double Barrel (국가배후 해킹조직과 Gunra 랜섬웨어 그룹의 관계)](https://asec.ahnlab.com/ko/94695/) - AhnLab ASEC

3: State Hackers Made South Korea's Mandatory Banking Software Into Zero-Day Weapon - Tech Times

4: [[Joint Cybersecurity Advisory] Operation Double Barrel (The Relationship Between a State-Sponsored Threat Actor and the Gunra Ransomware Group)](https://www.hendryadrian.com/joint-cybersecurity-advisory-operation-double-barrel-the-relationship-between-a-state-sponsored-threat-actor-and-the-gunra-ransomware-group/) - Hendry Adrian

Russian Satellite Intelligence Sharing With Iran on US Gulf Military Installations Raises Counterintelligence Alarm

BLUF: Zelenskyy's satellite claim functions as leverage diplomacy rather than actionable intelligence, and Trump's dismissive framing makes US public confirmation within 30 days very unlikely.

Ukrainian President Volodymyr Zelenskyy said on July 25 that Russian satellites tracked four Gulf air bases, two in Bahrain and one each in Jordan and Kuwait, within their area of interest on July 19 and 20, and announced he had directed Ukrainian intelligence to share related findings with partners 1. President Trump, asked about the claim Monday aboard Air Force One, said he would raise it with Putin and that any Russian assistance "hasn't been at a high level" and had proven "very unimpactful" given US strikes on Iran 1. A Defence Matters analysis described the underlying allegation, that Russia supplied Iran's satellite imagery of US Gulf installations, as unproven in its strongest form but credible enough to warrant scrutiny 2. No public evidence has surfaced establishing Russian personnel involvement in Iranian targeting or attack planning 2.

Analyst Note: Zelenskyy's disclosure operates chiefly as pressure diplomacy directed at Washington, not as a technical intelligence release, and Trump's public response treats the claim as diplomatically manageable rather than operationally urgent. Trump's characterization of any Russian assistance as unimpactful forecloses immediate pressure for sanctions or exposure of Russian space and intelligence assets, routing the matter toward a personal conversation with Putin. No technical indicators, imagery specifics, targeting data, or evidence of Russian personnel involvement in Iranian planning have surfaced publicly, which keeps the allegation short of establishing an operational intelligence-support relationship between Moscow and Tehran. Low confidence in this assessment rests on the single-source nature of Zelenskyy's claim and the absence of any corroborating technical evidence from allied services.

Sources:

1: Trump downplays Zelensky's Russia-Iran intelligence claim - Washington Examiner

2: Russia Gulf intelligence gamble could test Trump apparent reluctance to confront Putin - Defence Matters

Zelenskyy says Russia is providing Iran with satellite imagery of US military sites in Gulf - Ukrainska Pravda

Zelenskyy statement on Russian satellite surveillance of Gulf U.S. military sites shared with Iran - Volodymyr Zelenskyy (X/Twitter)

Prior Reporting - [Zelenskyy accuses Russia of assisting Iran with satellite imagery of US bases in Middle East](https://www.cbsnews.com/news/zelenskyy-russia-iran-satellite-imagery-us-bases/) (2026-07-25) - [Zelenskyy Says Russia Shared Satellite Imagery of US Bases With Iran](https://www.theepochtimes.com/world/zelenskyy-says-russia-shared-satellite-imagery-of-us-bases-with-iran-6067489) (2026-07-25) - [Zelenskyy claims Russia providing satellite intel on US bases and Gulf states to Iran](https://www.tribuneindia.com/news/ballistic-missiles/zelenskyy-claims-russia-providing-satellite-intel-on-us-bases-and-gulf-states-to-iran) (2026-07-26) - [Zelenskyy statement: Russian satellite surveillance of Gulf US bases shared with Iran](https://x.com/ZelenskyyUa/status/2081074329115078813) (2026-07-25)

IC Technology & Cyber

Russian Laundry Bear Group Deploys New Microsoft Exchange Zero-Day That Triggers on Email Open

BLUF: OWAReaper's server-side persistence model renders standard credential rotation and endpoint remediation ineffective, leaving compromised Exchange tenants exposed until administrators audit every mailbox permission grant.

Proofpoint reported that Russia-aligned TA488 (Void Blizzard, Laundry Bear) began exploiting Common Vulnerabilities and Exposures (CVE)-2026-42897, a cross-site scripting flaw in Outlook Web Access, on July 22, one day before Proofpoint's joint release with NSA on the group's prior activity 1. The campaign targets US and European government entities and organizations in telecommunications, finance, hospitality, and aerospace, using lure subject lines such as "Global Gas Markets" and "Semiconductor Supply Chain Indicators" 1. Opening the email in Outlook Web Access (OWA) triggers arbitrary JavaScript that installs an implant Proofpoint calls OWAReaper, which grants itself owner-level mailbox permissions on the server side and maintains browser-side persistence via localStorage manipulation and IndexedDB cache poisoning, together surviving credential rotation and full device re-imaging 123. Proofpoint assesses OWAReaper as an evolution of the ZimReaper payload used in TA488's earlier Zimbra campaign, sharing code for harvesting autofill credentials and error-handling routines but confined to the OWA reading pane rather than ZimReaper's mass mailbox exfiltration, and receiving commands via GitHub Commit Search API queries every 24 hours and polled operator emails every five minutes 14. Infrastructure tied to the campaign dates to March 2026, two months before Microsoft's out-of-band patch 15.

Analyst Note: Server-side persistence surviving credential rotation and re-imaging forces administrators toward mailbox-permissions review, manual audits of folder-level Owner grants across tenants, rather than standard credential resets. The shift from Zimbra-era mass exfiltration to selective, add-in-mediated token theft prioritizes stealth and longevity over collection volume, though the broad targeting across telecommunications, finance, hospitality, and aerospace could reflect opportunistic reach as easily as deliberate collection expansion. Dual tasking channels through GitHub commit search and inbound email give the group resilience that ordinary domain takedowns will not disrupt. Infrastructure dating to March 2026, two months before Microsoft's patch, points to undisclosed prior access against government and critical-sector targets predating public awareness of the flaw. Proofpoint is the sole primary source; other outlets amplify without independent verification.

Sources:

1: Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit - Proofpoint

2: Russian hackers exploit Exchange OWA zero-day for long-term mailbox access - BleepingComputer

3: Russian Hackers Exploit Microsoft OWA Flaw to Keep Mailbox Access After Credential Rotation - The Hacker News

4: Russian spies take their half-click email attack from Zimbra to Outlook - The Register

5: Laundry Bear new Microsoft Exchange attack triggers on email open (CVE-2026-42897) - Help Net Security

CISA Coordinates Federal Response After Iran-Affiliated Cyber Actors Attack Over 30 Minnesota Water Utilities

BLUF: Iran-linked actors exploiting PLCs at scale across 30-plus small utilities within days of a CISA advisory update exposes a structural gap between federal warning and municipal remediation capacity.

A coordinated cyberattack struck operational technology at more than 30 Minnesota community water utilities on July 26-27, and Minnesota IT Services activated a statewide cybersecurity incident response on July 28 1. Four cities, Braham, Plymouth, South St. Paul, and Maple Plain, have publicly confirmed being affected; Braham's water plant went offline for roughly three hours on July 27 and the city asked residents to minimize non-essential water use before treatment resumed, while no other city reported disruption to water service or drinking water safety 1. CISA has not publicly attributed the attack, but Acting Director Nick Andersen said the agency is coordinating with the EPA and other partners to assess scope and provide technical support 2, and CISA joined Australian, UK, and Canadian cyber authorities on July 28 in issuing guidance urging Operational Technology (OT) operators to isolate vital systems 1. Security firm Tenable assessed the attack's operational pattern as consistent with the Iran-linked CyberAv3ngers threat ecosystem, noting the intrusion began four days after CISA updated an advisory on Iranian-affiliated actors exploiting internet-connected programmable logic controllers 12.

Analyst Note: The intrusion shows Iran-linked PLC exploitation moving from advisory warning to operational targeting of US water infrastructure within days of CISA's July 22 update, exposing the gap between publishing guidance and utilities acting on it. Small municipal systems lacking dedicated OT security staff remain the primary attack surface, and the absence of confirmed water-safety impact so far reflects contained scope rather than resolved vulnerability. CISA's joint isolation guidance with Australian, UK, and Canadian counterparts extends the defensive perimeter beyond US utilities, indicating an expectation of recurring PLC-targeting across the sector. Moderate confidence in the Iran-linkage assessment rests on Tenable's tactical pattern analysis without forensic confirmation or formal government attribution.

Sources:

1: Coordinated cyberattack hits more than 30 Minnesota water utilities - Help Net Security

2: CISA urges water utilities to utilize advisory on Iran-affiliated OT activity, following widespread attack on Minnesota systems - Inside Cybersecurity

MNIT activates statewide cybersecurity response to support affected communities and protect critical infrastructure - Minnesota IT Services (MNIT)

U.S. investigating whether Iran was behind cyberattack on Minnesota water systems - CBS News

IC Operations & Tradecraft

On-the-Ground Investigation Finds Alleged Russian SIGINT Base at Lourdes Cuba Cited in Trump Executive Order Is a University With No Intelligence Infrastructure

BLUF: Absent a credible rebuttal, the executive order's Cuba sanctions predicate rests on a SIGINT facility claim that the only independent on-site investigation found physically nonexistent.

Drop Site News and Belly of the Beast reported that a two-day, on-the-ground investigation of the Lourdes site outside Havana found no evidence of the Russian signals-intelligence facility described in President Trump's January executive order and a March 24 New York Times article by Michael Crowley, which stated the base "bristles with antennas and other eavesdropping equipment" targeting US Central Command, Cape Canaveral and Mar-a-Lago 12. Reporters found the site occupied by Cuba's University of Computer Sciences, built on the grounds after Russia dismantled and removed the original base's equipment between 2001 and 2002 12. University co-founder Rafael Torralbas told the outlets Russian personnel "handed over the buildings completely empty," removing "absolutely every antenna" via six cargo flights, with the last Russians departing in August 2002 and university classes beginning that September; the only antennas reporters found on campus were two mobile-phone masts belonging to Cuba's state telecom ETECSA, and over 80% of the campus's buildings were constructed after the Russian departure 2. The State Department and Michael Crowley did not respond to requests for comment; The New York Times also did not respond 1.

Analyst Note: The on-site findings strip the evidentiary basis Washington has cited for treating Cuba as host to an active Russian collection platform, since the executive order's SIGINT claim and the Times' antenna description now rest on no verified physical corroboration. Neither the State Department nor Crowley has produced evidence contradicting the site visit, leaving the gap between the official threat characterization and observed conditions at Lourdes unresolved. Unless a rebuttal surfaces, the discrepancy weakens the factual predicate underlying the fuel-tariff sanctions regime imposed on countries trading with Cuba. Low confidence in the broader implications for sanctions policy reflects the single collaborative investigation as the sole evidentiary basis for contradicting the executive order's factual claims.

Sources:

1: Trump and NYT Say There Is a Russian Spy Base in Cuba. Turns Out It Is a School - Drop Site News

2: Trump and NYT Say There's a Russian Spy Base in Cuba. Turns Out, It's a School - Belly of the Beast Cuba

IC Oversight & Policy

House Administration Chair Requests Classified DHS FBI ODNI Briefing on Chinese Intrusions Into US Voter Systems

BLUF: White House alignment with Steil's claims makes agencies likely to confirm a September briefing by August 13, converting contested election fraud allegations into a formal legislative channel ahead of the midterms.

House Administration Committee Chairman Bryan Steil, R-Wis., sent letters Thursday to DHS Secretary Markwayne Mullin, FBI Director Kash Patel, and acting Director of National Intelligence (DNI) Bill Pulte requesting a classified, Member-level briefing on non-citizen voter registrations and cyber vulnerabilities in voting systems 12. Steil asked DHS to be contacted by August 13 to schedule the briefing for September, along with any relevant documents 2. The request follows President Trump's July 16 address citing a DHS finding of more than 250,000 non-citizens registered to vote across California, Nevada, New Jersey, and Pennsylvania, and New Jersey Governor Mikie Sherrill's subsequent disclosure of 6,600 non-citizens found on that state's rolls 1. Steil's letters also referenced Trump's claims of Chinese hacking intrusions into US voter registration systems, and the White House separately released a statement from intelligence agency chiefs characterizing China's targeting of voter files as likely meeting the intelligence community's definition of election interference 1.

Analyst Note: Agencies will likely confirm a September briefing date to Steil's committee by August 13, the deadline he set, given the White House's own recent public alignment with his claims about noncitizen registrations and Chinese targeting of voter files. Confidence in that assessment is low, reflecting the absence of any DHS, FBI, or Office of the Director of National Intelligence (ODNI) response on the record and reliance on a single congressional letter to project agency behavior. Scheduling would formalize the classified channel Steil has sought since raising Chinese voter-file intrusions earlier this year, advancing legislative drafting ahead of the midterms. A missed deadline would indicate agency reluctance to substantiate the 250,000-noncitizen figure Trump cited in unclassified form.

Sources:

1: House committee requests classified briefing on Chinese election hacks, noncitizens on voter rolls - Just The News

2: House panel demands classified briefings on noncitizen voting, alleged Chinese election interference - Fox News

Chairman Steil Requests Classified Briefings on Non-Citizen Voting and Foreign Interference in American Elections - United States Committee on House Administration

House members call for classified briefings on noncitizens voting in U.S. elections - WND News Center

House Republicans Demand DHS, FBI Briefings On Non Citizens Voting - Liberty One News

Allied Intelligence

Former French Navy Pilot Formally Charged With Sharing Rafale Carrier Operations Intelligence With China

BLUF: France's first prosecution of a carrier-qualified pilot for Chinese knowledge transfer will pressure allied governments to close the retirement-to-foreign-consulting pipeline that TFASA and similar brokerages exploit.

Pierre-Henri Chuet, a former French Navy Rafale and Super Étendard pilot who built a YouTube following of more than 560,000 subscribers as "Até Chuet," was presented to an investigating magistrate the week of July 20, 2026, and placed under formal investigation and judicial supervision by France's Direction Générale de la Sécurité Intérieure (DGSI) on four counts including disclosure of national defense secrets and intelligence activity with a foreign power 12. The case centers on two trips to China in September 2018 and August 2019, made while Chuet was still on active duty and, investigators allege, without informing his chain of command as required by military regulations 13. Defense News reports the trips were arranged and financed by a South African aviation firm and that Chuet conducted training seminars for Chinese military personnel on Catapult-Assisted Take-Off But Arrested Recovery (CATOBAR) carrier operations and precision GPS landing procedures, with payments routed through his UK-based company, Mach 3 Management 1; the 2018 seminar focused on carrier landing technology while the 2019 session extended to naval aviator and landing signal officer training, the E-2C Hawkeye early-warning aircraft, and recent Western combat missions in Syria 13. PNC Contact identifies the South African intermediary as Test Flying Academy of South Africa 2. France's Ministry of the Armed Forces referred the matter to the Paris prosecutor's office on February 19, 2025, after which a preliminary investigation escalated to formal charges 13. Chuet has denied wrongdoing, telling Le Canard Enchaîné he conducted only two three-day seminars and has not returned to China since 2019 1.

Analyst Note: The mise en examen converts a two-year-old preliminary probe into the first formal French prosecution of a Rafale-qualified pilot for transferring CATOBAR carrier expertise to Chinese military trainees, establishing a legal precedent Paris can apply to other veterans who worked through the same South African brokerage networks. The case exposes a structural gap: French chain-of-command notification rules bind only active-duty officers, leaving post-retirement consulting and speaking work with foreign-linked intermediaries unmonitored until after the fact. Test Flying Academy of South Africa has separately drawn scrutiny from UK, US, and Spanish authorities, so French prosecutors' evidentiary approach provides a template for allied governments investigating their own recruited pilots.

Sources:

1: Former French Navy Pilot Pierre-Henri Chuet Placed Under Judicial Supervision Over Alleged Rafale-Related Intelligence Sharing With China - The Defense News

2: Até Chuet mis en examen ! - PNC Contact

3: Ex-French Navy pilot investigated over work in China - AeroTime

French ex-fighter pilot charged over training sessions in China - Intelligence Online

Prior Reporting - [Ex-Rafale Pilot Who Praised Chinas J-10C and JF-17 Fighter Jets Now Under Investigation for Beijing Ties](https://www.eurasiantimes.com/french-ex-rafale-pilot-who-praised-chinas-j-10c-jf-17-jets-now-under-investigation-for-beijing-ties/) (2026-07-29) - [French ex-Rafale pilot investigated over alleged intelligence activity for China](https://www.aerotime.aero/articles/french-rafale-pilot-china-intelligence-investigation) (2026-07-28) - [Qui est le youtubeur Até Chuet, ex-pilote de Rafale, mis en examen pour «intelligence avec une puissance étrangère»](https://www.europe1.fr/police-justice/qui-est-le-youtubeur-ate-chuet-ex-pilote-de-rafale-mis-en-examen-pour-intelligence-avec-une-puissance-etrangere-991836) (2026-07-29) - [Un ex-pilote de chasse mis en examen pour «intelligence avec une puissance étrangère»](https://www.intelligenceonline.fr/europe-russie/2026/07/27/un-ex-pilote-de-chasse-mis-en-examen-pour-intelligence-avec-une-puissance-etrangere,110851752-art) (2026-07-27)

COLLECTION GAPS

UNCLASSIFIED // OPEN SOURCE