//
OFFLINE — VIEWING CACHED CONTENT
← Back to Archive

IC BRIEF

Current as of 0325 EST (UTC-05), Thursday 12 November 2026

Contents

10 stories from 39 sources across 36 organizations

KEY JUDGMENTS

US indictments, regulatory reviews, and sanctions targeting Iranian, Russian, and North Korean operations face December deadlines. The DOJ indictment unsealed Tuesday names the Islamic Revolutionary Guard Corps (IRGC) and Kata'ib Hizballah behind 18 spring 2026 European attacks and the RAF Fairford plot; at least one of the three defendants, Mohajeri, al-Hassani, or al-Saadi, is likely to be in US custody or arrested abroad by the end of December, since al-Saadi is already held in New York. High confidence reflects the indictment and near-automatic arraignment.

A US federal agency or member of Congress will likely announce a formal action on the Alaska LNG surveys, whether an investigation, permit suspension, or hearing request, by December 12; Novatek-steered surveys near the Trans-Alaska Pipeline and an Air Force radar site lacked interagency review. Office of Foreign Assets Control (OFAC) will likely announce new sanctions designations tied to the October 29 Binance hack or its laundering by the end of December; wallet designations are the indicator to watch.

Germany's Bundestag will likely pass the intelligence services reform bill by November 20, expanding Bundesnachrichtendienst (Federal Intelligence Service; BND) and Bundesamt für Verfassungsschutz (Federal Office for the Protection of the Constitution; BfV) domestic authorities over Article 13 objections.

Separately, Israeli authorities will likely announce or confirm closure of the Shin Bet's foreign election-interference file without a criminal investigation by the end of December, removing the legal basis for questioning Arab lawmakers.

Adversary Intelligence

ESET Reveals FSB-Linked Turla Group Compromised Romanian Government Exchange Server to Harvest NATO and EU Emails

BLUF: Turla's use of victims' own Exchange servers as command channels renders standard network-perimeter defenses ineffective, leaving other Eastern European and Central Asian government mail systems at risk of similar undetected collection.

Slovak firm ESET reported on November 10 that Turla, a group it and press accounts link to Russia's Federal Security Service (Russia; FSB), planted a previously undocumented modular .NET toolset called Cereal on Microsoft Exchange servers at government bodies in Kazakhstan and Romania 123. ESET first found it in Kazakhstan in November 2025 and on a Romanian government organization's server, compromised December 23, 2025 13. In Romania, the CerealBox component was configured to copy emails with NATO and EU institutions, selecting messages with Word or PDF attachments by sender, recipient and subject filters 13. ESET observed no external command-and-control infrastructure, as operators sent commands through the victim's own Exchange server disguised as Outlook Web Access, Autodiscover and ActiveSync traffic 34. The Record reported that ESET could not determine the initial access method or how much data was taken 2.

Analyst Note: Turla has turned two governments' Exchange servers into self-contained collection platforms, so perimeter blocking cannot safeguard NATO and EU correspondence. Cereal routes commands through the victim's own server as Outlook Web Access, Autodiscover and ActiveSync traffic, leaving no external command-and-control address to blacklist. The Romanian filters on NATO and EU senders, recipients and subjects with Word or PDF attachments point to a requirement for alliance policy documents rather than bulk mail theft, though they may instead be opportunistic keyword collection serving a broad intelligence requirement. Because the initial access method and data volume are unknown, other Exchange operators in Eastern Europe and Central Asia cannot yet assess their own exposure. Confidence is moderate, resting on a single ESET report relayed by four outlets, with no independent technical confirmation and no victim statement.

Sources:

1: Romanian servers targeted by Russian hackers to scoop up emails about NATO, EU - C4ISRNet

2: Russian hackers compromised government email servers to steal NATO, EU correspondence - The Record (Recorded Future News)

3: Turla hackers use new Cereal malware to spy on govt Exchange servers - BleepingComputer

4: Turla’s Cereal malware turns victims’ Exchange servers into spy hubs - Help Net Security

North Korean Intelligence Officer Contradicts Pyongyang Denial, Says Reconnaissance Bureau Carried Out 6.43 Billion Binance Hack

BLUF: OFAC will likely announce new sanctions designations tied to the October 29 Binance hack or its laundering by the end of December 2026, with the insider admission and $3.24 billion still in motion accelerating targeting of China-based facilitators.

Daily NK reported on Friday that a Reconnaissance and Intelligence General Bureau officer in Liaoning, China, told its source the Binance hack was "a job carried out by our side," while saying his own unit was not involved and he has not identified the responsible unit 1. The officer was not directly involved in the attack, and Daily NK says his remarks cannot prove North Korean responsibility 1. Kim Yo Jong denied the FBI's attribution of the October 29 theft to TraderTraitor in statements carried by Korean Central News Agency (KCNA) and reported by Washington Post, CNBC and CoinDesk 234. Elliptic put the loss at $6.43 billion, of which about $2.85 billion has been frozen or seized 3. Chainalysis and TRM Labs separately attribute the hack to TraderTraitor with high confidence 5.

Analyst Note: The US Treasury (OFAC) will likely announce new sanctions designations explicitly tied to the October 29 Binance hack or its laundering by the end of December 2026. Confidence is low because no Treasury statement or public sign of a designation package exists, so the call rests on past practice against Lazarus-linked actors and the theft's scale. The officer's comment undermines Kim Yo Jong's denial but adds context rather than proof, since he was not involved and named no unit. It may also be inference from the route and method, which Binance's report and press coverage already circulate openly. The contradiction of Pyongyang rests on one anonymous Daily NK stream, though four outlets consistently report the denial and the FBI and analytics-firm attribution. His description of compartmentalized cells, with most overseas IT staff in China, points Washington toward China-based facilitators and over-the-counter brokers as targets. Roughly $3.24 billion remains in motion, so laundering exits will shape timing. Designations would force exchanges, brokers and banks in China and elsewhere to screen and cut off named entities and addresses. Without them, the burden stays on private freezes by Tether, Circle and exchanges, and Washington appears to be delaying action.

Sources:

1: Pyongyang denies Binance hack, but its own spy disagrees - Daily NK

2: North Korea denies involvement in Binance hack and criticizes FBI probe as 'a trite provocation' - The Washington Post

3: North Korea denies links to Binance hack as researchers trace stolen billions - CNBC

4: North Korea denies role in $6.4 billion Binance hack after FBI points to TraderTraitor - CoinDesk

5: What is TraderTraitor, the hacking squad behind the $6.3 billion Binance heist? - CoinDesk

Prior Reporting

OCCRP Investigation Reveals Hundreds of Global Figures Featured in Russian Doppelganger Disinformation Campaign

BLUF: Moscow's Doppelganger operation has industrialized the recruitment of Western voices through non-Russian intermediaries, and the migration to Turkish-hosted domains suggests the pipeline will adapt faster than Western exposure efforts can shut it down.

Organized Crime and Corruption Reporting Project (OCCRP), working with Delfi Estonia, examined a catalogue exposed by a hack of the Russian propaganda site Reliable Recent News (RRN) and identified more than 500 interviewees from over 50 countries, who gave roughly 500 interviews that generated about 1,800 articles on Doppelgänger-linked sites 12. OCCRP contacted more than 60 interviewees; most did not respond or could not recall who arranged the interviews 1. Five said Brazilian Dugin follower Raphael Machado set up their interviews, and four, including former U.K. MP Matthew Gordon-Banks, said a man calling himself Nikolay Maslov approached them 1. Gordon-Banks denied deliberately joining propaganda operations. The Nerve reported that Lembit Öpik, a former Lib Dem MP, appeared on RRN and did not answer its questions about who approached him 2, a finding Nation.Cymru relayed 3.

Analyst Note: The leaked RRN catalogue shows Moscow's influence apparatus recruiting Western interviewees at scale, and some intermediaries were not Russian: Brazilian Dugin followers, including Raphael Machado, arranged interviews for five subjects, and a self-described journalist, Nikolay Maslov, approached four others. Former officials such as Matthew Gordon-Banks and Lembit Öpik now face reputational exposure, though most contacted interviewees did not answer or could not say who arranged their interviews. Two surviving sites on Turkish domains still publish Western interviews, so the pipeline appears to have moved rather than closed. Confidence is low: this rests on one original OCCRP investigation, secondary outlets add no independent verification, and no document shows who directed the interviewers. Contractors chasing Kremlin funding may have inflated the output, with little real audience influence and many interviewees simply willing commentators.

Sources:

1: From Politicians to Academics, Hundreds Around the Globe Interviewed and Featured in Notorious Russian Disinformation Campaign - OCCRP

2: Revealed: Lembit Öpik, a former Tory MP and the 500 other westerners who helped Putin's propaganda war on Ukraine - The Nerve

3: Former Welsh MP named in data leak as helping Russia's propaganda machine - Nation.Cymru

Alaska LNG Project Steered by Partially Sanctioned Russian Gas Giant Novatek Gathered Sensitive Arctic Data Near Military Sites

BLUF: A US federal agency or member of Congress will likely announce a formal action on the Alaska LNG surveys, such as an investigation, permit suspension, or hearing request, by December 12, 2026, given that pending OFAC and Treasury decisions offer ready leverage points.

A ProPublica investigation, republished by Radio Free, reports that surveys of the Beaufort Sea seabed near Prudhoe Bay, begun in 2025 and resumed in mid-2026, were paid for by UAE-based Tech Wave but steered by Russia's partially sanctioned Novatek 12. ProPublica cites documents showing the work lay near the Trans-Alaska Pipeline start and an Air Force radar station 12. Polar Train LNG's OFAC waiver application carried metadata naming Evgeniya Kononova, whom LinkedIn lists as a Novatek deputy head of legal 12. Novatek denies gathering intelligence and says Polar Train and Tech Wave made survey decisions, while Polar Train says the surveys were standard, unclassified and lawful 12. Polar Train CEO Joel Riddle resigned September 19, alleging Russian control 12.

Analyst Note: Confidence is moderate, resting on a single ProPublica investigation with documentary support, including the waiver metadata, which Radio Free republishes verbatim and so offers no independent corroboration. The September resignation of Polar Train's CEO alleging Russian control confirms the relationship was not arm's-length, and surveys near the pipeline origin and an Air Force radar station add an intelligence-collection dimension beyond the covert-funding channel reported earlier. The core exposure is that survey permits for those sites were issued without apparent interagency review. A US federal agency or member of Congress will likely announce a formal action on the Alaska LNG surveys by December 12, 2026, whether an investigation, an OFAC waiver or permit suspension, or a formal letter or hearing request. Congressional letters are the cheapest response, and the pending OFAC waiver and a separate Treasury application to import Russian LNG give regulators a concrete decision point. The administration's interest in Russian energy deals could slow executive action, and the FBI has not responded. The surveys may be routine site selection, with Novatek chiefly seeking to recover stranded Arctic LNG 2 equipment. Without formal action, the survey data stays with Novatek-linked parties and the waiver proceeds unchallenged.

Sources:

1: A Natural Gas Project Off Alaska’s Coast May Be a Russian Ploy for Intel on the Arctic - ProPublica

2: A Natural Gas Project Off Alaska’s Coast May Be a Russian Ploy for Intel on the Arctic - Radio Free (republishing ProPublica)

Prior Reporting

Allied Intelligence

German Bundestag Set to Vote Friday on Sweeping Intelligence Reform Expanding BND and BfV Powers

BLUF: Germany's Bundestag will likely pass the intelligence services reform bill by November 20, granting the BND and BfV expanded domestic authorities that opponents will challenge on Article 13 grounds.

The CDU/CSU-SPD coalition tabled roughly 100 pages of amendments to the intelligence reform ahead of a Bundestag vote planned for Friday, according to Legal Tribune Online and netzpolitik.org 12. The amendments would let the BfV monitor organized-crime structures that support extremist efforts, let the BND covertly enter homes in Germany in exceptional cases, and enlarge the Independent Control Council from nine to twelve members 12. Ad-hoc-news.de reported that such entries require express authorization and prior Control Council review, and that Article 13 of the Basic Law imposes added hurdles for domestic dwellings 3. Former Justice Minister Sabine Leutheusser-Schnarrenberger and other critics have warned against the bill, while the Bundestag's first-reading record shows the Left and AfD opposing it on September 24 34.

Analyst Note: The coalition's roughly 100 pages of late amendments signal a deal within the CDU/CSU-SPD majority rather than a bill in trouble. The Bundestag will likely pass the intelligence services reform bill by November 20, with the Friday vote the decisive step. Confidence is moderate: netzpolitik.org and the Bundestag record confirm the vote date and amendment contents, but the secondary outlets mostly repeat netzpolitik.org's reporting, and there are no whip counts or reporting on SPD dissent. The amendments add BfV monitoring of organized crime, BND covert home entry and a twelve-member Control Council, moving the bill beyond the Cabinet-approved version. The changes may instead be concessions to coalition holdouts or to constitutional concerns, which could delay the vote. Article 13 complaints from the Left or AfD are the main remaining obstacle. Passage lets BND, BfV and the Council begin implementation planning and staffing, while a delay leaves the new powers in limbo.

Sources:

1: Die juristische Presseschau vom 11. November 2026: Urteil im Fall Fabian / Nachbesserung bei der Geheimdienstreform / Prozessauftakt im Fall Schlesinger - Legal Tribune Online

2: Kurz vor Bundestagsabstimmung: An welchen Stellen Union und SPD die Geheimdienstreform ausbauen - netzpolitik.org

3: Nachrichtendienst-Reform: Bundestag berät am 13. November über neue Befugnisse - ad-hoc-news.de

4: Gesetzentwurf zur Reform des Nachrichtendienstrechts beraten - Deutscher Bundestag

Prior Reporting

Israeli Police Find Little Evidence to Support Shin Bet Probe Into Foreign Election Interference

BLUF: Israeli authorities will likely announce or confirm closure of the Shin Bet's foreign election-interference file without opening a criminal investigation by the end of December 2026, stripping Netanyahu's stolen-election narrative of its legal foundation.

Israeli police sent an evaluation to Attorney General Gali Baharav-Miara on Tuesday concluding that the Shin Bet's intelligence does not establish suspicion of election-financing or security offenses, Ynet reported 1. Channel 12, relayed by the Times of Israel, said officials doubt Ayman Odeh will be questioned and described the file on him as thin 23. Haaretz cited senior law enforcement officials saying the Shin Bet has produced no evidence that hundreds of thousands of shekels from the Palestinian Authority were used to buy votes 45. Baharav-Miara said Sunday she had seen nothing that would "even remotely" impact the result 12, while Deputy Commissioner Boaz Balat ordered investigators to refer all Shin Bet assistance requests to him 6.

Analyst Note: Police have now reviewed the Shin Bet material and found it supports neither election-financing nor security offenses, a shift from the November 4 impasse over Zini's undelivered file. Israeli authorities will likely announce or confirm the closure of the examination of the Shin Bet's foreign election-interference file, with no criminal investigation opened, by December 31, 2026. Confidence is low because the Attorney General has issued no decision and police stopped short of ending the examination. Six reports across Israeli outlets agree, but only four are primary, so the corroboration is broad while the original reporting is thin. The police position removes the evidentiary basis for security questioning of Arab lawmakers and weakens Netanyahu's claim that the vote was stolen. Deputy Commissioner Balat's restriction on Shin Bet requests shows police limiting the agency's reach. The Attorney General may instead keep a narrowed examination open for months, a low-cost way to avoid appearing to bury the Shin Bet's claims, which would push formal closure past December. Closure would free investigators and spare Arab party leaders questioning, while an open file keeps pressure on Eisenkot's coalition negotiations and sustains Netanyahu's fraud narrative. New Shin Bet material on polling-station irregularities is the main indicator that could keep the file open.

Sources:

1: Police find no basis for election-financing or security offenses in foreign interference probe - Ynetnews

2: Police said to see little evidence to back Shin Bet probe into foreign election interference - Times of Israel

3: Police said to see little basis for Shin Bet election probe, doubt Aymen Odeh will be questioned - Times of Israel

4: Shin Bet Has No Evidence of Foreign Election Interference, Senior Officials Say - Haaretz

5: Israel's Shin Bet finds no evidence of foreign election meddling: Report - Al Jazeera

6: Police restrict Shin Bet access to election probe as foreign interference allegations deepen - Ynetnews

Prior Reporting

Hungary PM Magyar Appoints New Head of National Information Centre Intelligence Coordination Body

BLUF: Magyar's installation of Orosz completes political consolidation of Hungary's intelligence coordination under Minister Ruff, making early liaison practices with Western partners the key indicator of whether the reshuffle restores or further erodes trust.

Prime Minister Péter Magyar appointed László Péter Orosz director-general of the National Information Centre (NIK), effective November 10, according to a decree in Monday's Magyar Közlöny 123. Index reported that Minister Bálint Ruff, who heads the Prime Minister's Office, proposed Orosz and also proposed his promotion, along with that of Tamás Bertalan, to national security brigadier general 3. Bytes Europe described Orosz as a former national security colonel and attributed the promotions to President András Baka 4; Index likewise names Baka as the promoting authority 3. HVG, citing Telex, reported that Magyar dismissed the previous director, Anna Hatala, in summer 2026, and that Ruff now oversees the NIK and the Defence Administration Office 23.

Analyst Note: Orosz's appointment places the National Information Centre under Ruff's direct political control and closes the leadership transition begun when Hatala was dismissed in July. Promoting Orosz and Bertalan signals the government is rewarding career officers rather than importing outsiders. The centre controls how agency reporting reaches ministers, so Washington and European partners, who reportedly distrusted the Rogán-era arrangement, will judge repaired trust by Orosz's first moves on information-sharing. Watch for staffing changes below director-general level and shifts in partner-service liaison. Confidence is high because a published gazette decree anchors the facts, though the English-language coverage appears to rely on Hungarian reporting, so sourcing is shallower than four outlets suggest. Orosz's agenda and Bertalan's intended post remain unreported. The appointment may also be routine filling of a vacancy, signaling little about policy or Western reorientation.

Sources:

1: Magyar appoints new head of National Information Centre, Hungary’s top intelligence coordination body - Daily News Hungary

2: Magyar Péter kinevezte a titkosszolgálati csúcsszerv új igazgatóját - HVG

3: Magyar Péter kinevezte a Nemzeti Információs Központ új főigazgatóját - Index

4: PM Magyar appoints new National Information Centre chief - Bytes Europe

IC Oversight & Policy

HPSCI Ranking Member Himes Says IC Chiefs Could Not Confirm FBI Counterintelligence Investigation of Nvidia CEO's Ties to Chinese Intelligence

BLUF: Jensen Huang is very unlikely to cease being Nvidia CEO within the next 30 days, but the intelligence community's inability to confirm or deny an FBI counterintelligence probe leaves the political and corporate pressure trajectory unresolved.

Rep. Jim Himes (D-Conn.), House Intelligence Committee ranking member, told POLITICO on Wednesday that he left a classified briefing from intelligence agency heads without knowing whether Alice Huang, a Megaspeed-linked executive close to Nvidia CEO Jensen Huang, knowingly passed information to China or was a "useful idiot" 12. Himes said he has not heard that the FBI opened a counterintelligence investigation, and that DNI Jay Clayton and CIA Director John Ratcliffe told him "they didn't know" whether one exists 1. Politico reported that President Trump said earlier this week the FBI is probing the matter, and that the FBI, Office of the Director of National Intelligence (ODNI) and CIA did not immediately comment 1. Politico also reported that Nvidia announced an internal investigation, and that the Wall Street Journal reported the company was preparing to oust Huang 1; Taiwan's UDN relayed Himes's remarks on November 12 3.

Analyst Note: Confidence is low because everything traces to one Politico report, with Newsmax and UDN only amplifying it, and because there is no visibility into Nvidia's board deliberations or any FBI finding. The intelligence chiefs' inability to say whether a counterintelligence case exists means Congress has no settled assessment of Alice Huang, which lets Democrats press for an investigation and links the matter to the H200 export decision. That answer may instead reflect compartmentation inside a live FBI case, and Himes's framing may be partisan positioning ahead of his expected chairmanship. The Wall Street Journal's report of an ouster, alongside Nvidia's internal investigation, is the main indicator to watch. Jensen Huang is very unlikely to cease being Nvidia CEO by December 12, 2026, despite the pressure now building. If Huang does leave, Nvidia's board, export-control officials and the committees would reset chip-licensing and oversight plans around new leadership. If he stays, H200 China sales and demands for his testimony remain the pressure points.

Sources:

1: Top intel Dem unsure if Alice Huang is a Chinese spy or ‘useful idiot’ after classified briefing - Politico

2: Rep. Himes: Nvidia Spy Allegations Remain Unclear - Newsmax

3: 黃樂是中國間諜還是「有用的笨蛋」？美議員聽完情報簡報這麼說 - UDN (經濟日報)

Prior Reporting

Acting CISA Director Implements Priority Intelligence Requirements Framework Adopting Military Intelligence Planning for Cyber Threats

BLUF: Cybersecurity and Infrastructure Security Agency (CISA)'s pivot to intelligence-led triage will raise reporting demands on critical infrastructure operators through fiscal 2027, and Senate confirmation of the nominated Palantir executive to lead the agency is very unlikely by December 31, 2026, leaving Andersen's framework as operative direction.

Acting CISA Director Nick Andersen issued a November 2 memo to agency leaders setting fiscal 2027 priorities, according to Cybersecurity Dive 1, which obtained it after Nextgov first reported it 12. The memo names three top-line priorities: leading national cyber defense, securing key infrastructure, and overseeing nationwide resilience efforts 1. It lists six critical information requirements, seven priority intelligence requirements covering threat actor targeting of operational technology, vital supply chains, and emerging technology and geopolitical risk, and 13 mission sustainment requirements 1. Andersen directed managers to build the requirements into daily work, share relevant information across divisions, and break down silos between operating divisions 1. Cybersecurity Dive reported that President Trump on Monday nominated a Palantir executive to lead CISA 1.

Analyst Note: CISA's fiscal 2027 requirements memo shifts the agency from service delivery toward intelligence-led triage, so critical infrastructure operators will vie for finite support. Its priority intelligence requirements on operational technology targeting and vital supply chains signal what sector risk management agencies and owners will be asked to report, and information-sharing demands on them will rise. Sourcing is thin: Nextgov/FCW broke the story, Cybersecurity Dive and Defense One follow it, and no primary document confirms the memo's contents. The memo may also be mainly an internal continuity exercise by an acting director, with limited operational effect on outside partners. The Senate is very unlikely to confirm the Palantir executive nominated to lead CISA by December 31, 2026. Confidence is moderate, because the Palantir executive's nomination is only days old, reporting anticipates Senate hurdles, and no committee schedule is visible. Until a director is confirmed, Andersen's framework is the operative direction, so operators and sector agencies should plan reporting around it through early 2027, while a new director could revise it.

Sources:

1: CISA sets operational priorities for partnerships, risk assessments and systemic action - Cybersecurity Dive

2: CISA outlines internal plan to swiftly address cyber, infrastructure threats - Nextgov/FCW

CISA outlines internal plan to swiftly address cyber, infrastructure threats - Defense One

IC Operations & Tradecraft

DOJ Unseals Indictment Naming Iran-Backed HAYI Network Behind RAF Fairford Plot and 18 European Attacks

BLUF: At least one of the three indicted defendants is likely to be in US custody or arrested abroad by the end of December, given that al-Saadi is already detained in a New York jail and can be arraigned on the new counts without further apprehension.

The Justice Department unsealed an eight-count indictment on Tuesday charging Mohsen Mohajeri, Mohammad Ali al-Hassani and Mohammad Baqer Saad Dawood al-Saadi with supporting the IRGC and Kata'ib Hizballah 12. The DOJ alleges al-Hassani, in Iran with Mohajeri, directed and paid UK associates to procure vans and fuel barrels, research accelerants and buy shrapnel for the September RAF Fairford plot 23. It says al-Saadi passed coded messages from a New York jail 2. The DOJ ties the three to 18 spring 2026 attacks in Europe claimed by HAYI, which it calls a Kata'ib Hizballah front, seven in the UK 12. ITV reports no explosives were found in the vans, though petrol was seized 2. Iran denies involvement 2.

Analyst Note: We have high confidence in this assessment because the DOJ indictment is a primary source and al-Saadi is reportedly already held in a New York jail, so arraignment on these counts is near-automatic. The four secondary outlets track the DOJ release closely, so they reflect one official account rather than independent verification. At least one of the three indicted defendants is likely to be reported in US custody or arrested abroad by December 31, 2026. That could occur without any new arrest, which makes a formal US court filing on these counts the indicator to watch rather than an overseas apprehension. Mohajeri and al-Hassani were in Iran, beyond extradition reach, and Tehran's denial points to no handover. The November 10 indictment extends the October 28 UK charges against two London men by naming a director, tying Fairford to the 18 HAYI-claimed attacks, and listing the IRGC and Kata'ib Hizballah as sponsors. The indictment may instead be mainly a signaling instrument aimed at Tehran, leaving the HAYI attribution untested. If a defendant is in custody by year-end, US and UK prosecutors can build a joint case and share evidence. Otherwise, sanctions and diplomatic pressure remain the only tools.

Sources:

1: DOJ: 3 Iranian-backed operatives indicted over terror plots in U.S. and Europe, including RAF Fairford - OANN

2: US authorities charge three men over suspected RAF Fairford terror plot - ITV News

3: RAF Fairford: U.S. Charges Three Iran-Backed Men and Names the HAYI Network - CommandEleven

Three Iranian-Backed Operatives Indicted for Their Roles in Nearly 20 Terrorist Attacks and Plots - U.S. Department of Justice, Office of Public Affairs

US charges three 'Iranian operatives' over RAF Fairford terror plot - France 24

Prior Reporting

COLLECTION GAPS

UNCLASSIFIED // OPEN SOURCE