//
OFFLINE — VIEWING CACHED CONTENT
← Back to Archive

IC BRIEF

Current as of 0338 EST (UTC-05), Monday 02 November 2026

Contents

11 stories from 45 sources across 43 organizations

KEY JUDGMENTS

The US enters Election Day with active Russian influence operations, collapsed threat-sharing channels, and no statutory threat reports delivered to Congress. Storm-1516 will likely target at least one additional US candidate with a fabricated newscast before November 10. High confidence reflects three candidate-targeted fakes in two weeks and independent attribution. ODNI is very unlikely to deliver the statutory election threat report by November 10. Moderate confidence rests on consistent lawmaker accounts, though all trace to one briefing. That gap leaves lawmakers reliant on phone access to the CIA Director and DNI, while CISA's relay to local officials is largely non-functional; disclosed use of CISA's replacement tool would alter this assessment.

China-nexus actors are pressing parallel cyber campaigns: China-nexus threat actor (CrowdStrike designation; VAPOR PANDA)'s AI-augmented AI-driven exploitation framework (CrowdStrike designation; ARTEX) framework directed exploitation against more than 200 organizations in 14 countries over 11 days, and Taiwanese authorities will likely attribute the intrusion on Democratic Progressive Party (Taiwan; DPP) candidate Puma Shen's campaign to China-linked actors by November 30. Moderate confidence rests on the National Security Bureau (Taiwan; NSB)'s on-record confirmation of a joint probe; criminal botnets could explain the traffic.

Separately, Iran's designation of MI6, the Royal Navy and the RAF as terrorist organizations gives Iranian courts a framework to prosecute any future detention of British military personnel near the Strait of Hormuz as a terrorism case.

IC Operations & Tradecraft

CIA Resorts to Open Public Recruitment Call for Would-Be Cuban Assets

BLUF: Washington's overt recruitment pitch hands Havana a ready-made justification to expand domestic surveillance while offering Cuban volunteers no credible security against the counterintelligence dragnet it invites.

Secretary of State Marco Rubio posted on X on Friday, October 23, urging Cubans seeking "positive change" to form a "discreet partnership with the CIA" 12. The CIA reposted the message in Spanish with a video and a seven-step contact guide advising VPN use, incognito browsing and disposable email, and asking for city, job and level of access 134. Deputy Foreign Minister Carlos Fernández de Cossío replied on X that the agency must be in "desperation" to sell its services "like a tube of toothpaste" 45. Local 10 reported that none of the Cubans it interviewed had heard of the appeal, and several cited fuel shortages and food access as more pressing concerns 6.

Analyst Note: Washington now treats overt solicitation as a legitimate tool against Cuba, and it couples the appeal with security guidance rather than any pledge of protection. The guide's requests for city, job and access steer collection toward volunteers who self-identify through channels Cuban counterintelligence can monitor, handing Havana a propaganda opening and a pretext to tighten surveillance of online activity and contact with US facilities. The appeal may instead aim at signaling resolve to a Florida audience before the midterms and sowing suspicion inside Cuba's security apparatus. Since June's ultimatums and indictment-based pretext, the shift to a public appeal from the Secretary of State marks escalation. Ordinary Cubans' response is unproven: Local 10's small street sample found no one aware of it, and fuel and food shortages dominate. Confidence is high, based on consistent reporting across six outlets, though audience reach rests on that single sample.

Sources:

1: Rubio calls on Cubans seeking "positive change" to work with CIA: "Now is the time" - CBS News

2: The CIA Is Resorting to an Open Casting Call for Would-Be Cuban Assets - The Intercept

3: CIA now hiring: Rubio posts ad for spies in Cuba - World Socialist Web Site

4: Rubio urges Cubans to work with CIA, but warns: be discreet - Manila Times

5: Cuban Deputy Minister Mocks CIA's Recruitment Call: "They're Selling Their Offers Like Toothpaste" - CubaHeadlines

6: Cubans skeptical of CIA recruitment appeal as daily struggles take priority - Local 10

Prior Reporting

FBI Arrests Former Fort Bragg Contractor With TS/SCI Access for Leaking Classified Military Operations Online

BLUF: Months-long exfiltration of special operations footage by a cleared contractor exposes persistent gaps in personal device controls and inventory oversight at Army Special Operations Command facilities.

Federal agents arrested James Thomas Ashbacher, 37, of Spring Lake, North Carolina, on Tuesday, October 27, and charged him with unlawfully transmitting and retaining national defense information and theft of government property, according to the Justice Department as relayed by WBTV and Task & Purpose 123. Ashbacher worked from about 2021 for a private security contractor at an Army Special Operations Command facility at Fort Bragg, holding a Top Secret clearance with SCI access 23. JNS, citing the indictment, reports he posted 10 classified videos between September 2023 and February 2024, six revealing unit tactics, techniques, procedures and call signs, then messaged another user he was "trying to do some damage control" 13. A home search, which JNS dates to April 2025, recovered missing Army night vision goggles, which JNS says he admitted stealing and values at $40,000, and a document resembling a classified award write-up 123.

Analyst Note: Confidence is high, resting on consistent charging details across four outlets, though the sourcing is thinner than it looks: the pattern points to one Justice Department release, with only JNS supplying indictment specifics. It is unlikely that Ashbacher is indicted by a grand jury or enters a guilty plea in the federal case by November 30, 2026. The case shows a cleared contractor moving special operations footage, including call signs and tactics, onto commercial platforms for months before detection, and goggles recovered only in April 2025 show inventory gaps went unresolved for over a year. His attempt to pull the videos and deactivate his account will anchor prosecutors' showing of knowing transmission. The charging document may be a criminal complaint rather than an indictment, so a later grand jury filing would be routine, not a sign of strength. Unlike April's book-linked Espionage Act case, this one has no whistleblower angle. Contractor security officers get a public record of leak methods only if a filing or plea arrives; otherwise they act on press accounts while defense counsel gains time to contest the evidence.

Sources:

1: Former North Carolina military contractor accused of leaking defense secrets - WBTV

2: FBI Arrests Former Fort Bragg Contractor With TS/SCI Access for Leaking Classified Military Operations Online - Task & Purpose

3: Former US Army contractor charged with posting military secrets to social media - JNS

Fort Bragg ex-contractor charged in info leak; Spring Lake raid uncovers stolen Special Ops night vision goggles: Feds - CBS17

Prior Reporting

US Intelligence Agencies Conclude Chinese Businesswoman Targeting Nvidia CEO Was Passing Information to Beijing

BLUF: Public confirmation that Jensen Huang has received a defensive counterintelligence briefing is very unlikely by November 30, leaving a gap between reported espionage risk and any visible US government response.

The New York Times reported on October 29, citing unnamed sources, that US intelligence agencies concluded Alice Huang (Huang Le), a Chinese citizen and senior Megaspeed executive, was passing information to Beijing 12. Surveillance of her contacts with a US citizen led, through unmasking, to Nvidia CEO Jensen Huang 13. The Times said Trump was briefed about a year ago and took no action, and that Huang has received no defensive briefing 12. Nvidia called the contacts routine customer meetings; a Chinese Embassy spokesman called the allegations "groundless smears" 1. Trump said October 31 he would "check very closely" and has not reviewed the claims in detail 4.

Analyst Note: Confidence is low: every outlet traces to a single New York Times report, with no primary documents and no view into classified counterintelligence channels, so the strongest rewrite, Business Today, adds no independent sourcing. Trump's pledge to "check very closely" commits him to nothing, and he said he had not reviewed the claims in detail. Nvidia's statement that it expects government warnings about threats gives it no reason to disclose a briefing. Nvidia or the US government is very unlikely to publicly confirm by November 30 that Jensen Huang has received a defensive counterintelligence briefing on the Alice Huang contacts. The officials who leaked the findings may have wanted to pressure the White House into acting, so a quiet briefing to Huang could already have happened or be arranged without announcement. Justice Department action on Megaspeed or a congressional demand for a briefing could force the issue into the open. A confirmed briefing would let Congress and Commerce treat Huang as a recognized counterintelligence target and press export-control scrutiny of Megaspeed. Absent one, oversight committees gain grounds to demand answers from the White House, and Nvidia's customers and partners will keep weighing the exposure.

Sources:

1: Chinese businesswoman with a close relationship with Jensen Huang has been found to be passing intelligence to Beijing, the NYT reports - OnInvest

2: Chinese intelligence asset got close to Nvidia CEO Jensen Huang, Trump knew but did not act: Report - Business Today

3: Alice Huang, Close Friend Of Nvidia's Jensen Huang, Is Believed To Be A Chinese Spy; Trump Was Briefed But Took No Action: Report - Free Press Journal

4: President Trump Vows Close Review After Chinese Spy Plot Targets Nvidia CEO - WLT Report

Nvidia denies report that its CEO was allegedly targeted in Chinese spy plot - ABC News

IC Oversight

CISA Election Security Channels at Weakest Since 2016 as Federal Intelligence Sharing With Election Officials Breaks Down

BLUF: Collapse of the federal threat-sharing relay leaves local election officials blind to foreign cyber operations days before the midterms, raising the risk of undetected interference on Election Day.

CNN reported on Sunday, citing nearly a dozen election security experts, that channels for federal officials to pass foreign threat information to election officials are at their weakest since 2016 12. Cuts to CISA, which was gutted during Trump's second term, have hobbled that relay, and a mid-October classified briefing, the first since the 2024 cycle, was marred by video-call failures before being rescheduled 12. David Becker of the Center for Election Innovation and Research said he knows of no election official actively sharing cybersecurity information with federal authorities 12. A CISA spokesperson said the agency launched an "information-sharing tool" open to authorized partners on request, but did not say how many election officials have used it 12.

Analyst Note: The federal relay that once conveyed foreign-threat warnings to election officials is largely non-functional days before the midterms, leaving local jurisdictions to judge Russian, Chinese and Iranian activity on their own. This shifts a structural gap noted in June into an operational breakdown: the first classified briefing since 2024 failed on its first attempt, CISA's replacement information-sharing tool has no disclosed adoption, and officials have stopped reporting incidents, partly because White House releases have used shared cybersecurity material to question election integrity. Detection and attribution of phishing, website disruption and AI-altered video will be slower. Confidence is low: the evidence is a single CNN report, republished once, with no independent corroboration or usage figures for the tool. Critics of the administration may also be overstating the breakdown, since CISA still offers no-cost services and some state offices report no change in preparations.

Sources:

1: Election officials brace for foreign threats and an unpredictable Washington - CNN

2: Election officials brace for foreign threats — and an unpredictable Washington - CNN

Prior Reporting

HPSCI Ranking Member Himes Tells CIA Director and DNI to Answer Phone on Election Day as IC Assesses No Foreign Actor Changed Votes

BLUF: Delivery of the statutorily required election threat report to Congress by November 10 is very unlikely, leaving lawmakers reliant on informal phone access to verify any presidential foreign-interference claim.

Sen. Mark Warner and Rep. Jim Himes, the ranking Democrats on the Senate and House intelligence committees, told reporters on Wednesday they have asked CIA Director John Ratcliffe and DNI Jay Clayton to be reachable by phone on and after Election Day, in case President Trump alleges foreign interference 12. Himes said "we are not seeing either the capability or the intent to interfere," while describing a "pretty robust influence environment" involving Russia, Iran and China 12. An ODNI spokesperson told CBS News that Clayton is available to the committees "24/7," and a CIA spokesperson said Ratcliffe "will continue to be available as appropriate" 1. The lawmakers said Congress has not received the statutorily required reports due 120, 60 and 30 days before the election, though they received a classified update this week 12.

Analyst Note: Congress will enter Election Day without the statutorily required 120-, 60- and 30-day threat reports, leaving Warner and Himes dependent on informal phone access to Ratcliffe and Clayton to check any presidential claim of foreign interference. ODNI is very unlikely to publicly release or deliver to Congress a statutorily required election threat assessment report by November 10, 2026. Confidence is moderate: lawmaker accounts of the overdue reports are consistent and a classified update arrived this week, but all of it traces to one Wednesday briefing relayed by CBS and NPR, and no ODNI or CIA document corroborates it, nor does any ODNI statement commit to a delivery date. Himes's line between a "robust influence environment" and no observed capability or intent to interfere gives the committees a baseline for testing White House assertions. Staffing cuts at the Foreign Malign Influence Center and CISA may erode the detection that baseline relies on. The lawmakers' framing may also be pre-positioning for a possible Democratic majority, and ODNI could be withholding the reports for administrative reasons. Without a report, Warner and Himes must rebut any claim in real time using their own briefings.

Sources:

1: Top intel Democrats say they've "war-gamed" how to react if Trump alleges foreign interference in midterms - CBS News

2: Top 2 Democrats on Intel say they're preparing for Trump to claim foreign meddling - NPR

Warner, Himes Push for Transparency on Election Security - Sen. Mark Warner (Senate press release)

The Real Threat of Election Interference - The Atlantic

US Democrats prepare to counter any Trump claim of foreign meddling in midterms - South China Morning Post

IC Technology & Cyber

DIA Assessment Warns Russian Nuclear Satellite Program Could Threaten Thousands of Spacecraft

BLUF: DIA's public assessment moves Russia's nuclear anti-satellite program from rumor to official intelligence judgment, but the absence of evidence for a launch-ready weapon leaves the operational timeline and scale of threat to allied satellites undefined.

The Defense Intelligence Agency's "Challenges to Security in Space 2026" report states that "Russia is developing a satellite designed to carry a nuclear weapon," despite Moscow's obligations under the 1967 Outer Space Treaty 12. La Voce di New York noted the report does not say whether the device is in orbit or operational 3. The DIA says a detonation could cause "rapid and sudden loss or degradation of thousands of satellites," with radiation belts that "could persist for years" 12. Defence Industry Europe reports the DIA cited Cosmos 2553, launched in February 2022 into an isolated orbit, and Cosmos 2588, which has maneuvered within about 93 kilometers of a U.S. government satellite 1. Fox News reports U.S. Space Command chief Gen. Stephen Whiting declined in April to confirm Moscow was developing such a weapon 2.

Analyst Note: The DIA's statement that Russia is developing a nuclear-armed satellite is a stated US intelligence community assessment, not Washington speculation, but the report does not say whether a device is in orbit or operational, so the threat to thousands of satellites remains unquantified. Cosmos 2553's isolated orbit and Cosmos 2588's approach within about 93 kilometers of a US satellite give planners observable behavior to track, though neither is tied to a warhead. Confidence is low: everything traces to one DIA document that three outlets repeat, General Whiting declined in April to confirm the program, and nothing independent verifies a launch-ready weapon. The report adds a nuclear anti-satellite program atop the escalation continuum it laid out October 27. The language may also aim to build congressional and allied support for space defense funding, and the program could remain at concept stage.

Sources:

1: Defense Intelligence Agency says Russian nuclear satellite program could threaten thousands of spacecraft - Defence Industry Europe

2: America's enemies prepare to take the next major war into outer space - Fox News

3: U.S. Report: Russia Developing Satellite to Carry Nuclear Weapon Into Space - La Voce di New York

Challenges to Security in Space 2026 - Defense Intelligence Agency

Prior Reporting

ODNI Seeks Economic Data Platform to Support Intelligence Community Economic Security Mission

BLUF: ODNI's move to consolidate economic data under a single platform signals an institutional bid to own the IC's economic security analytic baseline, though the survey commits no resources and may not advance beyond market exploration.

ODNI's Office of Economic Security and Emerging Technologies released a market survey on October 26 seeking industry input on a data platform that would ingest, organize and correlate unclassified economic and financial information from commercial and public sources 12. The platform, designated FLOW, would support economic security, foreign investment, sanctions and supply chain analysis across the intelligence community, with ODNI describing it as the government's primary reference point for the broader economy 23. Washington Technology reported that ODNI's primary goals are data management and integration, automated entity resolution linking records across naming variants, and bulk access through APIs, with interested contractors required to complete a capability matrix and submit a 15-page response by November 16 2.

Analyst Note: ODNI's FLOW survey would make the office the integrator of an economic intelligence capability that does not yet exist as a unified platform, consolidating fragmented commercial data purchases across IC agencies into a single reference architecture. The survey does not commit ODNI to a procurement, and the 15-page response format points to early-stage market exploration rather than imminent contracting. Confidence is high, because Nextgov and Intelligence Community News each independently describe the SAM.gov posting, and CDO Magazine and Washington Technology add consistent detail on goals and the November 16 deadline. That sourcing converges on one government document, however, so it confirms the survey's existence, not ODNI's intent. The survey may instead be a routine refresh of data procurement authority, since a market survey is frequently the end of a process rather than its start.

Sources:

1: ODNI issues FLOW market survey - Intelligence Community News

2: ODNI seeks economic data platform - Nextgov/FCW

3: ODNI Seeks Data Platform to Unify Economic and Financial Intelligence - CDO Magazine

Allied Intelligence

Iran Designates MI6 as Hostile Group and UK Royal Navy and RAF as Terrorist Organizations

BLUF: Tehran's reciprocal designations give Iranian courts a legal framework to escalate any future detention or interdiction of British military personnel near the Strait of Hormuz into a terrorism case.

Iran's Foreign Ministry announced on Sunday, November 1, that it has designated the UK Royal Navy and Royal Air Force as terrorist organizations and MI6 as a "hostile group," according to Tasnim 1 and Anadolu, which cited state-run IRNA 2. Tasnim reported that the measures rest on a Supreme National Security Council resolution and took effect on publication of the statement 1. MI6 was listed under Note 2 of Article 1 of Iran's espionage law, while the Navy and RAF fall under legislation enacted in response to the US designation of the Islamic Revolutionary Guard Corps (IRGC) 1, 3. The ministry cited the UK's July 13 listing of the IRGC under the State Threats Act 2026 and alleged British provision of bases and logistics for the US-Israeli war against Iran 12. It said Britain would bear responsibility for the consequences 13.

Analyst Note: Tehran's designations are symbolic in the near term but create a legal basis to prosecute Iranians and third-country nationals for contact with MI6, the Royal Navy or the RAF. They answer the UK's July 13 IRGC listing and mirror Iran's earlier designation of US forces. Grounding them in a Supreme National Security Council resolution signals a coordinated state decision rather than a ministry gesture. Royal Navy and RAF personnel near the Strait of Hormuz now carry a formal terrorism label, which could shape Iranian handling of any detention or interdiction of British forces. The move may instead be mainly a deterrent and bargaining signal to London amid stalled Hormuz security talks, with no intent to enforce it against any named individual or unit. Confidence is high: the Iranian Foreign Ministry's own statement was relayed consistently by four outlets with no contradicting account, though all reporting traces to a single official origin.

Sources:

1: Iran Condemns UK's Hostile Measures, Designates MI6, Royal Navy, RAF as Terrorist Entities - Tasnim News Agency

2: Iran designates British navy, air force as terrorist organizations - A News (Anadolu)

3: Iran declares UK Navy and RAF terror groups, and MI6 hostile - The Jewish Chronicle

Iran designates MI6, Royal Navy and RAF under reciprocal measures against UK - Tehran Times

Taiwan's NSB Probes Suspected Chinese Cyberattacks on DPP Taipei Mayoral Candidate's Campaign Server

BLUF: Taiwanese authorities will likely publicly attribute the cyberattack on Shen's campaign to China-linked actors or open a criminal case by the end of November, aiming to frame Beijing's interference narrative before the November 28 vote.

Taiwan's National Security Bureau is investigating suspected China-origin cyberattacks on DPP Taipei mayoral candidate Puma Shen's campaign, Deputy Director-General Chen Sung-chi told a legislative committee, adding that the probe could lead to criminal charges, according to the Taipei Times 1. Shen's office said the attacks began Friday, exploiting a flaw in a website's upload function to gain administrative access and install back doors 12. The office said the compromised server did not host the internal system or its credentials, and staff removed the back doors and fake administrator accounts and changed all credentials 1. A new supporter swipe-in site received more than 70,000 authentication-code requests from foreign IP addresses within an hour of launch, the office said 12.

Analyst Note: Moderate confidence rests on the NSB deputy director-general's on-record statement that a joint investigation could lead to charges, though no technical attribution or named suspects exist yet. Every report traces to the Shen campaign's own account or that single NSB remark, so nothing independent corroborates a China link. The NSB has moved from silence to confirming a joint probe. A back-door intrusion followed by a 70,000-request authentication flood from foreign IPs suggests a deliberate effort to disrupt the campaign's event platform before the November 28 vote. Taiwanese authorities will likely publicly attribute the cyberattack on Puma Shen's campaign to China-linked actors, or open a formal criminal case naming it, by November 30. Criminal botnets or non-state nationalist hackers could equally explain the traffic, and the campaign has an incentive to frame it as foreign interference. Forensic attribution often lags, and prosecutors may withhold detail while a case is open. Attribution or a named case would push the NSB, the Investigation Bureau and rival campaigns to escalate election-security measures and public warnings, whereas silence would leave candidates relying on their own defenses.

Sources:

1: NSB probes hack on Puma Shen - Taipei Times

2: China suspected of cyberattacks targeting Taiwan opposition candidate ahead of key elections - ANI News

沈伯洋：官網遭境外IP飽和式攻擊 - Liberty Times (自由時報)

沈伯洋車掃系統遭網駭 國安局動起來是否查中共介選 - Newtalk

Adversary Intelligence

Chinese State Hackers Use AI-Powered ARTEX Framework to Target Over 200 Organizations Worldwide

BLUF: VAPOR PANDA's AI-augmented campaign compresses intrusion timelines enough that defenders relying on manual triage will lose the race against parallel, agent-driven exploitation of unpatched and credential-based attack surfaces.

CrowdStrike reported on October 29 that its OverWatch team saw a single ARTEX controller, linked to the China-nexus adversary VAPOR PANDA, direct exploitation activity from October 17 against more than 200 organizations in at least 14 countries over 11 days 12. CrowdStrike Intelligence confirmed post-exploitation activity at nine, where the actor deployed the backdoor malware (CrowdStrike designation; BLOODALCHEMY) backdoor, and observed password spraying against at least 12 others 1. Targets included foreign ministries, a Middle East interior ministry, U.S. semiconductor, defense and pharmaceutical firms, and telecommunications providers in the U.S., Belgium and the Philippines 1. Recovered transcripts show a Chinese-speaking human operator steering agents running mainly on DeepSeek, consuming about 1.4 billion input tokens in one intrusion 13. iTnews reported the campaign is separate from Microsoft's Storm-0940 ARTEX reporting 3.

Analyst Note: VAPOR PANDA's ARTEX use shows a China-nexus espionage unit running parallel intrusions against ministries, defense firms and telecommunications providers with a small human team. Pharmaceutical, semiconductor and nuclear targeting is new for this actor, and 1.4 billion tokens spent on one intrusion point to far heavier use across the campaign. Agents pursue several attack paths at once while the operator steers only at decision points, compressing defenders' timelines. Stolen credentials, unrotated keys and unpatched systems still carry the intrusions, so key rotation, SAML validation and IMDSv2 enforcement blunt the method. Confidence is low: everything traces to one CrowdStrike report, secondary outlets only amplify it, and no victim has independently confirmed compromise beyond nine. The scale may instead reflect opportunistic scanning with a cheap tool rather than a disciplined state campaign, since the framework leaves its own name in artifacts.

Sources:

1: VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign - CrowdStrike

2: China-Nexus VAPOR PANDA Breached Nine of 200-Plus Targets With AI Agents - Unite.AI

3: ARTEX AI hacking framework spreads to another China-linked group - iTnews

Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide - The Hacker News

Russian Storm-1516 Network Targets Third US Senate Candidate With AI-Fabricated Local News Video Before Midterms

BLUF: Storm-1516 will likely target at least one additional US candidate with a fabricated video before November 10, and federal countermeasures are too degraded to blunt the spread before votes are cast.

On October 26, pro-Russian X account @X_Global_tv posted a fabricated Cleveland 19 newscast alleging four former staffers accused Ohio Senate candidate Sherrod Brown of sexual assault. NewsGuard found it used dubbed audio over authentic footage from an October 21 segment, and the station's news director said, "We have reported no such thing" 1. PolitiFact reported that Storm-1516 also altered a CBS affiliate, Bangor, Maine (WABI-TV) report on Maine's Troy Jackson to claim he threatened staff with an axe 2. Clemson's Darren Linvill tied the accounts sharing the new videos to earlier Storm-1516 content 34, and the Gnida Project attributed the Cleveland 19 video to the network 1. X suspended the initial accounts, but copies with hundreds of shares remained online Tuesday 34.

Analyst Note: We assess with high confidence, based on three candidate-targeted fakes in about two weeks, consistent attribution across independent outlets, and a rising tempo toward Election Day, that Storm-1516 is escalating. The network has shifted from AI-generated personas, as in the earlier Talarico deepfakes, to altered authentic local newscasts, and private researchers again made the attribution without any US government statement. Takedowns do not halt spread, since copies with hundreds of shares outlived X's suspensions. With CISA and federal relay channels to election officials at their weakest since 2016, fact-checkers, newsrooms and campaigns carry most of the defense. A new Storm-1516 fabrication aimed at a US candidate other than Brown or Jackson will likely be publicly reported by a fact-checker by November 10. Sourcing rests on a single primary report from NewsGuard, with PolitiFact, Fast Company and MPR News corroborating, so convergence is broad but the original reporting base is thin. The cluster may instead be a small, low-engagement operation whose reach is inflated by coverage, and the next fake could reuse an already-targeted candidate. If a new target surfaces, campaigns and station news directors should pre-position rapid denials and takedown requests. If none does, resources can shift to the election-integrity narratives expected after polls close.

Sources:

1: In pivotal Senate race, Russia targets another Democrat; Japan PM assassination faked by China - NewsGuard Reality Check

2: Russian influence operation linked to attacks targeting Democrats in Maine, Ohio, Texas - PolitiFact

3: Fake videos possibly linked to Russia are targeting these two Democratic Senate candidates - Fast Company

4: Disinformation videos, likely from Russia, are exploiting real people to malign Senate candidates - MPR News

Prior Reporting

COLLECTION GAPS

UNCLASSIFIED // OPEN SOURCE