//
OFFLINE — VIEWING CACHED CONTENT
← Back to Archive

IC BRIEF

Current as of 0309 EDT (UTC-04), Sunday 25 October 2026

Contents

10 stories from 37 sources across 34 organizations

KEY JUDGMENTS

Russian intelligence operations are diversifying across orbital, proxy, and embedded-agent vectors as Iranian lethal plotting drives embassy drawdowns, stretching Western services across domains. A repeat Russian satellite approach within 10 km of a Western spacecraft by November 30 is unlikely, and a US military strike on Iranian territory by the same date is unlikely. High confidence in both reflects consistent multi-source reporting. Moscow retains orbital geometry to close again; the Director of National Intelligence (DNI) memo backs drawdowns, not strikes.

Russia's human-intelligence infrastructure includes a registered Israeli think tank linked to a Russian presidential directorate that placed paid journalists near Knesset access, and a Ukrainian citizen arrested in Germany for collecting armored-vehicle data from defense industry contacts. German prosecutors are unlikely to charge the suspect within 90 days. NATO supplier firms face a vetting gap that expulsions do not close, absent a shift from Russian non-traditional cover.

A halt to US intelligence sharing with Ukraine by late November is unlikely, as CIA operational tempo constrains a cutoff, though a Ukrainian strike on Russian energy infrastructure remains the strongest trigger for a presidential order. Moderate confidence rests on anonymous sourcing. Convicted Brazilian intelligence chief Ramagem is very unlikely to face US custody by November 30; ICE's release and the expelled police liaison signal political protection.

Agency Operations

CIA Publishes Collaboration Guide as Rubio Calls on Cubans to Partner with Agency

BLUF: Washington's shift from covert contact to public solicitation of Cuban sources invites Havana to frame any future bilateral engagement as resistance to an open intelligence offensive.

Secretary of State Marco Rubio wrote on X on Friday that "now is the time" for Cubans seeking "positive change" to pursue "a discreet partnership with the CIA" 12. On Saturday the CIA posted a seven-step Spanish-language guide on Instagram, per CiberCuba, telling prospective contacts to use an unlinked device, a disposable email account and a VPN server outside Cuba, Russia, Iran or China 3. Al Jazeera reported that the CIA also posted an X video urging those able to travel safely to visit a US embassy in person 1. Deputy Foreign Minister Carlos Fernández de Cossío replied on X that the agency must be in "desperation or misery" to sell its services "like a tube of toothpaste" 13.

Analyst Note: The CIA is running an open, multi-channel recruitment effort in Cuba, and Washington has shifted from covert contact to public solicitation. Rubio's post, the Instagram guide and the X video all steer Cubans toward self-initiated, anonymized contact, with an embassy visit preferred for those who can travel safely. Havana's reply suggests it will read the campaign as proof of US hostility, which could harden its position in talks that remain stalled. Cubans who respond face exposure risk, since the guide assumes the state is not monitoring their devices and networks. The campaign may instead aim mainly to signal resolve and sow distrust within Cuba's security apparatus before negotiations. Confidence is high: CiberCuba directly confirms the guide's content, three further outlets match on the Rubio post, and no reporting contradicts either.

Sources:

1: Rubio calls on Cubans to partner with CIA 'to create positive change' - Al Jazeera

2: Rubio floats CIA 'partnership' to Cubans tired of 'failed promises, corruption' - The Hill

3: CIA publishes a detailed guide for collaboration with the agency for those seeking to create positive change in Cuba - CiberCuba

Rubio Calls On Cubans to Work With the CIA - Political Wire

CIA Continues Aggressive Intelligence Sharing with Ukraine Despite Trump-Zelensky Tensions

BLUF: It is unlikely that Washington halts intelligence sharing with Ukraine by the end of November, but the lever remains live and a single Ukrainian strike on Russian energy infrastructure could trigger a presidential cutoff order.

The Atlantic reported that the US has not officially halted intelligence sharing with Ukraine, though President Trump could do so at any time 12. Citing a retired senior officer who travels often to Ukraine, the outlet said the CIA leads among US personnel there, and a Baltic intelligence officer said CIA operations are "much more aggressive" than under Biden 13. People who have worked with CIA Director John Ratcliffe told The Atlantic he would not try to dissuade Trump from a cutoff, despite misgivings at CIA headquarters 12. Last week, disruptions to Starlink and US early-warning systems left Ukraine unable to track some incoming Russian missiles; a Ukrainian intelligence official blamed the Americans, though technical failure may also have contributed 12. Zelensky confirmed to NPR on October 14 that Ukraine had received warnings and threats on intelligence sharing, none yet carried out 12.

Analyst Note: The CIA's operational tempo in Ukraine and its institutional stake in the partnership constrain a cutoff, even though Ratcliffe would not resist a presidential order. It is unlikely that the US government publicly confirms, or credible major outlets report, a halt or suspension of intelligence sharing with Ukraine between October 26 and November 30. Confidence is moderate because all five outlets rewrite one Atlantic report built on anonymous sourcing, with no on-record US official confirming continuity or a pending order. Last week's three-day pause ended with access restored, and the CIA channel apparently kept working throughout, yet the threat remains. Agency sources may instead have shaped the narrative to pressure the White House, while the Starlink and early-warning gaps point to quiet, deniable throttling already under way. Trump's open refinery-strike ultimatum is the real exposure, and a new Ukrainian strike on Russian energy infrastructure would be the strongest trigger. If a halt is confirmed, Kyiv and European capitals must quickly find missile-warning substitutes and rework refinery-strike planning. If not, Kyiv can keep its deep-strike campaign on its current timeline.

Sources:

1: The Atlantic: CIA director would not dissuade Trump if he decided to cut off intelligence to Ukraine - Ukrainska Pravda

2: The Atlantic: CIA director will not try to persuade Trump against cutting intelligence support for Ukraine - Mezha

3: Ukraine continues to receive intelligence from CIA, despite strained relations between Trump and Zelenskyy - Interfax-Ukraine

The CIA Is in the Lead in Ukraine—for Now - The Atlantic

CIA Continues Intel and Warning Feeds to Ukraine - Kyiv Post

CIA continues sharing intelligence with Ukraine despite tensions between Trump and Zelenskyy - New Voice of Ukraine

Prior Reporting

Leaked DNI Memo Warns Iran's Lethal Plots Against US Personnel Reached Advanced Stages

BLUF: Despite the leaked DNI memo and Trump's "Epic Fury" rhetoric, a US military strike on Iranian territory or state forces by November 30 is unlikely, with the drawdown serving more as diplomatic leverage than a prelude to action.

Director of National Intelligence Jay Clayton sent Secretary of State Marco Rubio a one-page unclassified memo on Friday stating that "the lethal plotting efforts by the Iranians against U.S. citizens have reached advanced stages" 1. A U.S. official confirmed its authenticity to NBC News after Axios first reported it 1, and the memo names no targets, methods, or attack dates, according to International Business Times 2. Clayton said the risk extends to more individuals than are cleared to receive it and pledged to downgrade intelligence for sharing with State personnel 1. The State Department ordered further staff cuts at its restricted-operations posts in Jordan, Lebanon, Qatar and the UAE, which remain open 12; a U.S. official told NBC News that Houthi attack threats and Iranian plots both inform those adjustments 1. Nonessential personnel were ordered out of Saudi Arabia on Wednesday 2, and President Trump said at a Florida rally on Friday, "We may do another little Epic Fury" 12.

Analyst Note: We assess with high confidence, based on a confirmed unclassified memo reported consistently by three outlets and no observed strike preparations beyond options presented to Trump, that the memo gives State a legal and bureaucratic basis to thin posts further. Drawdowns now rest on a lethal Iranian plotting threat as well as Houthi attacks. All three accounts trace to one document, and none verifies the underlying intelligence. A US strike on Iranian territory or state forces between October 26 and November 30 is unlikely to happen. Trump's "another little Epic Fury" remark pairs a threat with an offer to negotiate, and the November 3 midterms and stalled mediation weigh against a major operation. The memo may instead prepare the ground for a strike rather than flag a specific, imminent plot. If a strike comes, State and Pentagon planners must move from reduced staffing to ordered departures across the region. A Saudi-style ordered departure at the four restricted posts would signal planning has moved toward action.

Sources:

1: Iranian plots to kill U.S. officials in Middle East have reached 'advanced stages,' intel memo warns - NBC News

2: Leaked Intelligence Memo Reportedly Reveals Iran Is in Advanced Stages of Plotting Against US Officials - International Business Times

Iran Has Ramped up Efforts to Target US Personnel, Intelligence Memo Warns - U.S. News & World Report (AP)

Prior Reporting

Allied Intelligence

Convicted Brazilian Intelligence Director Ramagem Remains Free in Florida as ICIJ Reveals Sealed Investigation Records

BLUF: Ramagem is very unlikely to face US immigration custody or arrest by November 30, as ICE's administrative release and the expulsion of Brazil's police liaison signal Washington has no appetite to act on the extradition request.

ICE released Alexandre Ramagem, the former Brazilian intelligence chief sentenced to 16 years for the coup plot, on April 15, two days after Orlando police detained him for a visa overstay, while his asylum claim is pending 12. Brazil filed an extradition request on December 30, 2025, and officials declined to say whether the U.S. has responded 1. Department of Homeland Security (DHS) told International Consortium of Investigative Journalists (ICIJ) that a pending application confers no legal status 1. ICIJ and Agência Pública, citing sealed Federal Police records, report that the De Mello family housed Ramagem in Miami and sought documents for a Florida driver's license 1. The Rio Times says Rodrigo de Mello's release request was rejected on October 19 2.

Analyst Note: Confidence is moderate, because the account rests on a single original ICIJ investigation shared with Agência Pública, with The Rio Times adding only secondary amplification and no visible sign that Washington is moving to revoke his release. Ramagem is very unlikely to be taken back into US immigration custody or arrested by US authorities between October 26 and November 30, 2026. DHS rhetoric treats him as an illegal alien, yet ICE freed him within two days and the State Department expelled the Brazilian police liaison who helped locate him, which points to political protection. An asylum-processing pause and a slow removal docket may instead explain the release, so a routine immigration hearing could still bring re-detention. Flavio Bolsonaro winning Sunday's runoff and issuing his promised pardons would remove Brazil's main pressure for extradition. Only the unanswered extradition request and the sealed Federal Police file on the De Mello family could still force a US response. If he is re-detained, Brasília can press extradition, and if he stays free, Brazilian officials should plan for a Florida safe haven.

Sources:

1: The US is letting a convicted Bolsonaro spy chief stay in Florida. Brazil wants answers. - ICIJ

2: Brazil Spy Chief Free in US Despite 16-Year Sentence - The Rio Times

Prior Reporting

Royal Navy Intelligence Branch Sailor Faces New Espionage Charges for Plotting to Leak Classified Secrets to Russian SVR

BLUF: Teddy Young is very unlikely to be granted bail at or following the November 6 decision, given the prosecution's evidence of dark-web outreach to Russian intelligence and unreturned classified storage media.

Teddy Young, 24, a Royal Navy warfare intelligence rating, appeared by video link from Belmarsh prison at the Old Bailey on Friday and now faces five charges, including two under the National Security Act 12. Prosecutor Kelly Brocklehurst told the court Young accessed and retained sensitive intelligence, and that the website he took particular interest in belonged to Russia's Foreign Intelligence Service of Russia (SVR) 12. New counts allege misconduct in public office for sending classified material to a personal email address, WhatsApp and Discord, and two counts of failing to disclose a USB stick and SD card 13. Forces News reported he allegedly drafted a Russian-language message and used the dark web to seek contact with Russian authorities 4. Mrs Justice Cheema-Grubb remanded him in custody, with a bail decision due November 6 per GB News 1. The News reported a plea hearing on March 12, and Reuters and GB News reported a provisional trial date in October 2027 123. Police said the case is unconnected to the RAF Fairford investigation 24.

Analyst Note: Young now faces five charges rather than two, and prosecutors have named the SVR for the first time, adding misconduct in public office and two counts of failing to disclose devices. Teddy Young is very unlikely to be granted bail at or following the November 6 decision. We hold high confidence because four outlets consistently report the charges, remand and hearing dates, though near-identical wording and shared court-reporting origin make their independence thinner than the count implies, and no outlet has published the bail arguments. The alleged Russian-language draft, dark web contact attempts and unreturned storage media give the court grounds to cite flight and interference risks. The SVR website interest and the dark web approach may instead reflect curiosity or a failed overture by a junior rating, leaving the preparatory-conduct charges resting on intent. Forensic review of the USB stick and SD card could widen the counts before the March 12 plea hearing, and Ministry of Defence security staff should assume transfers reached personal devices over many months.

Sources:

1: Royal Navy sailor accused of plotting to leak secrets to Russia faces three new charges - GB News

2: UK Royal Navy sailor appears in court charged under National Security Act - New Straits Times

3: Royal Navy sailor faces new charges after alleged classified information breach - The News (Portsmouth)

4: Royal Navy sailor accused of spying and using dark web to try to make contact with Russia - Forces News

Dossier From 51 Israeli Intelligence and Military Officials Accuses Netanyahu of Near Treason Over Secret Submarine Sale to Egypt

BLUF: Fifty-one senior officials leveling near-treason accusations marks an unprecedented security-establishment revolt, but absent judicial traction or independent corroboration, Netanyahu's political standing faces no immediate threat.

SpyTalk reported on October 22 that a confidential dossier containing sworn affidavits from 51 senior Israeli intelligence and military figures accuses Prime Minister Benjamin Netanyahu of "harming the security of Israel" in a way that "borders on treason" 1. The most serious claim is that Netanyahu secretly approved Germany's sale of advanced submarines to Egypt without informing his defense minister or navy commanders, then lied about it 1. SpyTalk says an official inquiry resuming next month will examine separate criminal allegations over Israel's 2009-2017 purchase of four submarines and other warships from Thyssenkrupp 1. Netanyahu has denied wrongdoing, and SpyTalk notes none of his three existing trials has reached a verdict 1.

Analyst Note: Netanyahu faces a security-establishment challenge that no court or independent forum has yet tested. The alleged concealment from his defense minister and navy commanders is the sharpest charge, but the resuming inquiry covers separate Thyssenkrupp procurement allegations and may not address the Egypt claim. His three existing trials have run seven years without a verdict, which indicates new allegations will move through the courts slowly. Confidence is low because a single outlet reports the dossier, and no primary document or second source confirms the affidavits or signatories. The "borders on treason" language may reflect an election-week effort by his security-establishment opponents to shape the vote, which would make it political motive more than new evidence.

Sources:

1: Top Former Israeli Military and Intelligence Officials Accuse Netanyahu of Near Treason - SpyTalk

Counterintelligence & Espionage

Germany Detains Ukrainian Citizen in Brandenburg on Suspicion of Spying for Russian Intelligence

BLUF: Alleged use of defense industry contacts as collection vectors exposes a vetting gap that NATO supplier firms and counterintelligence services must now treat as a persistent, expanding threat.

Federal Criminal Police officers arrested a Ukrainian citizen identified as Vadym Y. on Thursday in Eisenhüttenstadt, Brandenburg, and a Federal Court of Justice investigating judge in Karlsruhe has since ordered him held in pretrial detention, federal prosecutors said 12. Prosecutors allege he has been in contact with a Russian intelligence service through an intermediary since at least July 2025 13. They say he collected information on armored vehicle, ammunition and explosives production and on personnel and facilities securing NATO's eastern flank, some of it public and some obtained from European defense industry representatives 13. Der Spiegel, as relayed by Meduza, reported he is 53 and had shown interest in the Bundeswehr's 45th Tank Brigade 3. Chancellor Merz said Germany should expect more such cases "in the coming months and years" 2.

Analyst Note: It is unlikely that German federal prosecutors formally charge the Ukrainian suspect by January 25. Confidence is low, because the only primary account of the allegations is the federal prosecutor's statement, with no public detail on the evidence held or the investigation's timetable. The six secondary outlets rework that statement rather than confirm it independently, so their convergence reflects shared origin. Detention only began Friday, and cases of this kind usually need months of evidence review before an indictment reaches court. Prosecutors may still move faster, since a suspect in contact with Russian intelligence since July 2025 and flagged by domestic security services may already have a nearly complete file. The alleged method of drawing information from European defense industry contacts exposes procurement and supplier-security officers at armored vehicle, ammunition and explosives firms. Merz's warning points to more arrests, which would push counterintelligence services to widen vetting of industry contacts. An indictment would mark the case as evidentially strong and a confirmed pattern. Without one, the allegations stay untested and supplier-vetting changes remain discretionary.

Sources:

1: Ukrainer soll Kontakte in Rüstungsindustrie genutzt haben: Mutmaßlicher Russland-Spion in Brandenburg gefasst - Der Tagesspiegel (dpa)

2: Ukrainian held in Germany on suspicion of spying for Russia as Merz warns of more cases - Yahoo News

3: Germany detains Ukrainian national suspected of spying for Russia - Meduza

Festnahme wegen mutmaßlicher geheimdienstlicher Agententätigkeit - Der Generalbundesanwalt beim Bundesgerichtshof

Germany arrests Ukrainian man accused of spying for Russia - Al Jazeera

Germany Arrests Ukrainian Suspected of Spying for Russia - Kyiv Post

Mutmaßlicher Russland-Spion in Brandenburg festgenommen - ZDFheute

IC Technology

Russia Tails Ukraine-Linked US Satellite in Threatening Orbital Maneuvers

BLUF: Moscow's orbital shadowing of a Ukraine-linked radar satellite establishes a coercive precedent, but it is unlikely that a Russian satellite closes within 10 km of another Western spacecraft by November 30.

Russian military satellite Cosmos 2612 maneuvered for more than two weeks toward ICEYE-X36, a US-registered radar satellite owned by Finnish-American synthetic aperture radar satellite company (ICEYE)'s American arm, and shadowed it through the weekend of October 17 1. LeoLabs told Axios the Russian craft closed from over 200 miles to about 3 miles on October 15 and 16 2, and later put the closest approach near 500 metres with an uncertain estimate 2. The Washington Times cited Orbital Radar tracking data showing a miss distance of about 85 feet 3. At the UN on Wednesday, Undersecretary of State Thomas DiNanno called the behavior "threatening" and "consistent with on-orbit weapons operations" 1. LeoLabs said the maneuvers "do not establish hostile intent," and Russia's purpose remains unreported 1. The satellite began pulling back October 18 and was about 250 miles behind ICEYE-X36 on Wednesday, per Integrity ISR's Greg Gillinger 1.

Analyst Note: Confidence is high because trackers and press consistently report that Cosmos 2612 began withdrawing October 18 and now sits roughly 250 miles behind its target, though miss-distance estimates range from 85 feet to about 500 metres and most secondary coverage traces back to the same tracking firms. It is unlikely that a Russian satellite is publicly reported by LeoLabs, the US Space Force or another credible tracker to approach within 10 km of another Western or Ukraine-linked satellite between October 26 and November 30, 2026. Russia keeps the fuel, coplanar geometry and ability to close the gap on its own schedule, and two more satellites from the same launch will soon align with the orbit of ICEYE-X37. Since October 18 the Russian craft has stopped station-keeping, and Washington has now called the behavior consistent with on-orbit weapons operations, though no interference with ICEYE-X36 has been reported. The pause may instead reflect Moscow's reaction to the US move easing sanctions, which would make the retreat tactical and tie any renewed approach to the state of US-Russia talks. A confirmed approach would push the Space Force, ICEYE and other commercial operators toward maneuver, shielding and attribution postures and press Washington for a declared response, while its absence lets them keep monitoring-only arrangements through November.

Sources:

1: The West cant stop me: Space wars heat up as Russia tails a Ukraine-linked US satellite - Defense News

2: Is Russia stalking satellites which help Ukraine from space? - Al Jazeera

3: Russian satellite stokes fears of space warfare, comes within 100 feet of key U.S. radar satellite - The Washington Times

Russian space satellite approaches U.S. satellite, raising alarms about intent - Axios

Prior Reporting

Adversary IC

Investigation Links Fake Israeli Think Tank to Suspected Russian Spy and Presidential Administration Intelligence Directorate

BLUF: Russia's use of a registered Israeli entity with paid local journalists and legislative access marks an escalation from digital influence to embedded human infrastructure that Israeli counterintelligence will struggle to uproot quietly.

Shomrim, VSquare and Delfi Estonia reported that the International Burke Institute, registered in Israel in July 2025, was founded by Haifa resident Igor Kaminnyk and Gabriel Mart, formerly Innokentiy Martynov 12. Both outlets tie Kaminnyk to Alexey Martynov, who is named in a 2022 Estonian court ruling; VSquare says the indictment describes him as acting on instructions from a Russian presidential administration directorate 12. Leaked Social Design Agency chats show a December 2024 proposal for an Israeli think tank budgeted at about $80,000 for six months, including Haifa office rent 2. Journalist Rachel Avraham told Shomrim she was paid for her institute work, then denied it 12. The Insider separately documented Social Design Agency (Russian disinformation entity; SDA) operations in Israel since 2023 3.

Analyst Note: The International Burke Institute was a Russian influence vehicle with human infrastructure inside Israel, not merely a network of fake accounts. Its founders' link to Alexey Martynov, tied by an Estonian court ruling to a Russian presidential administration directorate, and a Haifa office and budget matching leaked Social Design Agency plans support this. A journalist's admission of payment, quickly retracted, suggests the operation reached genuine Israeli media and a Knesset lobby, which exposes outlets to paid placement they struggle to detect. Confidence is high because two independent investigations and leaked documents converge on the same individuals, though the payment claim rests on one retracted phone statement. A small, opportunistic local venture seeking Russian funding, with the Martynov link coincidental, may instead explain the operation. The founders' resignations suggest the brand may be abandoned or rebuilt under new names, and Israeli security services have not commented publicly.

Sources:

1: An Alleged Russian Influence Operation, an Israeli Think Tank and the People Behind It - Shomrim

2: Journalist Admits to Receiving Cash to Promote Fake Russian Think Tank - VSquare

3: "Write like a 38-year-old Israeli woman": The Kremlin used fake media and fabricated "experts" to spread disinformation in Israel - The Insider

Adversary Intelligence

Russian Espionage Shifts to Disposable Gig Operatives After 700 Intelligence Officer Expulsions

BLUF: Moscow's shift to disposable, app-recruited proxies turns every cheap failed plot into a resource drain on European security services, sustaining the threat despite 700 officer expulsions.

Elena Grossfeld of King's College London, writing in The Conversation 1, reports that more than 400 Russian intelligence officers under diplomatic cover were expelled across Europe within months of the 2022 invasion of Ukraine, a total that has since passed 700 12. She writes that Moscow has since shifted to disposable "gig-economy" operatives, recruited on messaging apps and paid in cryptocurrency, who are often unaware of their handlers or mission goals 1. Tasks have included arson, beatings, kidnappings and assassination plots on US soil 1. In August 2026, an explosives-laden drone crashed into the wing of a parked Ukrainian cargo plane at Leipzig/Halle Airport but failed to detonate 1. The article cites a report by MP Graeme Downie putting annual UK costs of Russian hostile activity at no less than £2 billion 13.

Analyst Note: Russian sabotage now runs on expendable recruits rather than diplomatic-cover officers, shifting the counterintelligence burden from tracking known residents to detecting anonymous, short-lived proxies. Expulsions removed the declared platform but not the operations, which moved to messaging apps and cryptocurrency payments that evade traditional surveillance. The Leipzig/Halle drone failed through amateur execution, not restraint, and European services must treat each failed plot as a cost-imposition success for Moscow, since volume drains investigative resources. The gig model may instead reflect Russian capacity loss after the expulsions, with strategic logic imposed retroactively on forced improvisation. Confidence is low: the analysis rests on a single academic author, republished elsewhere without independent reporting, and neither the expulsion totals nor the Leipzig details are confirmed.

Sources:

1: From elite spies to 'gig-economy' operatives: the changing face of Russian sabotage - The Conversation

2: From elite spies to 'gig-economy' operatives: the changing face of Russian sabotage - NZCity

3: Russian espionage evolves from elite spies to gig operatives - Asia Times/The Conversation

COLLECTION GAPS

UNCLASSIFIED // OPEN SOURCE