//
OFFLINE — VIEWING CACHED CONTENT
← Back to Archive

IC BRIEF

Current as of 0347 EST (UTC-05), Sunday 15 November 2026

Contents

9 stories from 38 sources across 36 organizations

KEY JUDGMENTS

Russian intelligence is collecting against NATO through both a recruited officer and compromised mail servers. Lt. Col. Tyner will likely be formally charged with at least one criminal offense in the UK or the US between November 16 and November 22. High confidence reflects on-record US official and police statements. The charge sheet will first show whether NATO personnel data was compromised. Turla's Cereal toolset, filtering NATO and EU addresses on a compromised Romanian Exchange server undetected since December 2025, shows perimeter monitoring alone cannot detect the collection.

EU Council sanctions on Shahid Kaveh or its members over the October French retail cyberattacks are unlikely by the end of December. France's public attribution marks a change, though the evidentiary package for unanimous EU listing has not been circulated. Arrest, custody or extradition of IRGC-directed defendants Mohajeri or al-Hassani to the US is very unlikely by the end of December, leaving the alleged directing layer active and UK base force protection elevated.

Separately, a Section 702 reauthorization is unlikely to pass Congress and receive the President's signature by the end of December. High confidence reflects a divided Republican conference, civil liberties opposition, and collection authority surviving until March 16.

IC Technology & Cyber

US Endorses International Pall Mall Process Guidelines for Commercial Spyware

BLUF: Without binding enforcement or a reporting mechanism, the Pall Mall guidelines will function as diplomatic signaling rather than an operational constraint on the commercial spyware market.

Fourteen governments, including the United States, endorsed the Pall Mall Process Guidelines for Industry at the initiative's third conference in Paris on Wednesday, according to CyberScoop 1 and Bytes Europe 2. MLQ.ai lists the endorsers as Austria, the Bahamas, Costa Rica, France, Germany, Italy, Japan, Luxembourg, the Netherlands, Poland, Slovakia, Switzerland, the UK and the US 3. Representatives of 43 countries attended, and Bytes Europe reported it is unclear why 15 of the 27 signatories to the 2025 states' code did not endorse the text 2. The voluntary guidelines carry no penalties and ask firms to vet customers, build safeguards, monitor abuse, halt sales when serious misuse is credible, and "consider" remedies for victims 24. Access Now and the Business and Human Rights Centre told CyberScoop the text falls short, citing the absence of mandatory kill switches and binding rules 1; the State Department did not respond to CyberScoop's request for comment 1.

Analyst Note: The US endorsement adds a major spyware buyer and exporter, but the guidelines bind no vendor, so any effect depends on Washington and the other 13 endorsers writing them into procurement and export licensing. Fewer than half of the 43 attending states signed, and 15 of the 27 signatories to the 2025 states' code stayed out for reasons no outlet explains. Access Now and the Business and Human Rights Centre say the text lacks kill switches and enforceable rules, and it asks firms only to "consider" victim remedies. Governments that champion their own spyware industries may be endorsing mainly for diplomatic positioning, with little intent to restrict purchases or exports. Participants describe no mechanism for reporting national actions, so tracking implementation is the next test. Confidence is low: the four outlets largely rework the same ministry statements and one Record account, no primary text is available, and the State Department has not commented on US plans.

Sources:

1: Industry guidelines for offensive cyber tools unveiled through international Pall Mall Process - CyberScoop

2: Britain, France set out first guidelines for commercial hacking firms - Bytes Europe

3: Britain and France publish the first guidelines for commercial hacking firms, endorsed by 14 countries - MLQ.ai

4: Fourteen Governments Adopt Commercial Spyware Guidelines That Bind No Vendor, Carry No Penalties - Tech Times

DOJ Announces Coordinated Takedown of Gootloader Malware Network Targeting Pentagon

BLUF: Dismantling Gootloader's infrastructure degrades a key access-broker layer feeding ransomware affiliates, but defense contractors should treat the Defense Criminal Investigative Service (DCIS) disclosure as a trigger to audit networks for intrusions stretching back years.

The Justice Department announced on November 12 that it removed Gootloader malware from more than 100 servers, including compromised WordPress sites, and seized U.S. domain names used to deliver and control it 12. DOJ said Gootloader has infected at least 25,000 computers since 2018 and was used in ransomware attacks on at least 44 U.S. victims, causing about $28.8 million in losses 1. Defense Criminal Investigative Service official Kenneth DeChellis said the malware targeted the Department of War and the Defense Industrial Base 1. The Record reported the action was part of a wider Thursday takedown of 235 servers and 257 domains also tied to StealC and CastleRAT 3, and SecurityWeek reported disruption of all three strains' infrastructure 4. DOJ said the operation ran under Operation Endgame, with the FBI Denver office, DCIS and Army CID leading and Shadowserver assisting with victim notification 1.

Analyst Note: Removing Gootloader from more than 100 servers cuts a loader that sold access to ransomware crews, but the crews themselves remain. Defense contractors should review logs for Gootloader-linked intrusions dating to 2018, since investigators say the Department of War and Defense Industrial Base were targeted. Shadowserver's notifications through internet service providers and CSIRTs will reach infected hosts, so notified organizations should expect remediation requests. Striking Gootloader, StealC and CastleRAT together shows DOJ concentrating on the loader and access-broker layer that feeds ransomware affiliates. Confidence is high because a primary DOJ release is confirmed in detail by three independent outlets, though the infection count and loss figures trace to DOJ alone. The seizure may prove a brief setback, since operators who keep their code and affiliate relationships can rebuild delivery on fresh compromised sites, and the Pentagon framing may reflect DOJ messaging more than a distinct military targeting campaign.

Sources:

1: Gootloader Malware Disrupted In International Cyber Operation - U.S. Department of Justice, Office of Public Affairs

2: Justice Dept. announces coordinated takedown of malware network used to target the Pentagon - Inside Cybersecurity

3: DOJ: Gootloader used in at least 44 ransomware attacks costing $29 million since 2018 - The Record (Recorded Future News)

4: Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure - SecurityWeek

US-Sanctioned Jinan Supercomputing Center Still Gets Nvidia AI Products Despite Entity List

BLUF: Bureau of Industry and Security (BIS) action against Qiyuan Jiasu or enforcement tied to the Jinan supercomputing center's Nvidia purchases is very unlikely by the end of December 2026, as the public evidence falls well short of what Commerce typically requires to designate or penalize a supplier.

Radio Free Asia reported that a June 17 Chinese government procurement notice lists Nvidia RTX 5090 graphics cards and DGX Spark systems in a 148,500 yuan (about $22,000) award from the Shandong Computing Center, also called the National Supercomputing Center Jinan 123. The U.S. Commerce Department added the center to the Entity List in April 2021, which in principle requires a license for transfers of items subject to the Export Administration Regulations, with a presumption of denial 1. The winning bidder, Qiyuan Jiasu (Tianjin) Technology, shares website text, addresses and an identical client list with Sitonholy, an Entity List company since April 2024 14. RFA noted that no direct evidence ties the two companies' ownership, that the notice does not specify quantities or whether the RTX 5090 was a China-specific variant, and that Nvidia, Qiyuan Jiasu and the center had not responded 13.

Analyst Note: Confidence is moderate, resting on a single original investigation by Radio Free Asia, which three outlets merely republish, and on a procurement notice with no identified primary document behind it and no sign of an open BIS case. The evidence shows only overlapping website text, addresses and client lists with Sitonholy, not common ownership, and the notice omits quantities and whether the RTX 5090 was a China-specific variant. Commerce therefore lacks a clear basis for action. BIS is very unlikely to add Qiyuan Jiasu to the Entity List or announce enforcement tied to the Jinan purchases between November 16 and December 31, 2026. Qiyuan Jiasu may be an unrelated reseller that copied a competitor's marketing, and the Nvidia products may have arrived through authorized channels, leaving no violation to enforce. Nvidia's response, any BIS statement, and the Senate National Defense Authorization Act (NDAA) chip-tracking provision would shift this. Inaction leaves compliance staff and Congress relying on pending tracking language rather than new enforcement, while action would signal that BIS acts on open-source procurement findings.

Sources:

1: Exclusive: US-sanctioned Jinan Supercomputing Center still gets Nvidia AI products - Radio Free Asia

2: US-Sanctioned Jinan Supercomputing Center Still Gets Nvidia AI Products – Analysis - Eurasia Review

3: Exclusive: US-sanctioned Jinan Supercomputing Center still gets Nvidia AI products - Newsgram

4: A sanctioned Chinese military-linked lab just bought Nvidia AI gear — and a cloned website helped hide it - Dagens

IC Operations & Tradecraft

Russian Espionage Scandal Rocks NATO After Arrest of Senior US Army Officer in UK

BLUF: Formal charges against Lt. Col. Tyner will likely come between November 16 and November 22, and the charge sheet will be the first real indicator of whether NATO personnel data was compromised or prosecutors must settle for an attempt theory.

British authorities arrested Lt. Col. Brandon Tyner, 41, a human resources officer with NATO's Allied Rapid Reaction Corps at Imjin Barracks near Gloucester, on Tuesday, November 10, on suspicion of assisting a foreign intelligence service and obtaining or disclosing protected information 12. Stars and Stripes, citing The Wall Street Journal, reported the arrest followed a sting in which Tyner unwittingly spoke with British officials 2. The Metropolitan Police said the case relates to Russia and that searches were under way at two Gloucestershire locations 1. A U.S. official told the Associated Press that no information reached Russian hands, and U.S. officials expect charges Sunday or Monday 2. Kremlin spokesman Dmitry Peskov denied any connection 12, and neither government has disclosed the alleged activity or motive 12.

Analyst Note: We have high confidence in this assessment because U.S. officials have told reporters to expect charges Sunday or Monday and British police already hold Tyner on named National Security Act offenses, though coverage rests on one wire report and two follow-on pieces drawing on the same U.S. official and police statements, so convergence is broad but independence is limited. Lt. Col. Tyner will likely be formally charged with at least one criminal offense in the UK or the US between November 16 and November 22. The charge, not the arrest, will first show what Tyner allegedly gave or offered, and whether his human resources access exposed NATO personnel data. A U.S. official's statement that no information reached Russia leaves open that prosecutors may plead an attempt rather than a completed disclosure. British prosecutors may instead hold him without charge for several days, or the Army may defer to British proceedings, pushing any charge past November 22. If charged, NATO headquarters security officers and Army counterintelligence begin personnel access reviews and prepare for British prosecution followed by a U.S. court-martial. If not, allied planners should treat the case as unresolved and delay judging any data exposure.

Sources:

1: Russian Espionage Scandal Rocks NATO After Arrest of Senior U.S. Officer in UK - EUToday

2: US soldier arrested in Britain spy case identified as lieutenant colonel - Stars and Stripes

US soldier arrested in Britain on suspicion of espionage linked to Russia - Associated Press (via KOLD)

DOJ Indicts Three in IRGC and MOIS-Directed Attack Network Targeting Jewish and US Sites Across Europe

BLUF: Arrest or extradition of Mohsen Mohajeri or Mohammad Ali al-Hassani to the US is very unlikely by the end of December 2026, leaving prosecutors to build their case around the sole defendant in custody while the two alleged operational directors remain fugitives.

The US Justice Department unsealed a superseding indictment in Manhattan federal court on November 10 charging Mohammad Baqer Saad Dawood al-Saadi, Mohsen Mohajeri, and Mohammad Ali al-Hassani with involvement in nearly 20 attacks and attempted attacks tied to the Islamic Revolutionary Guard Corps (IRGC) and Kataeb Hezbollah; only al-Saadi is in custody 12. The indictment alleges al-Hassani directed a London synagogue attacker by video call, and the defendants watched an April firebombing of a Jewish charity live on FaceTime, per Times of Israel 1. The Record also reported the FaceTime direction 3. ITV News, relayed by Iranwire, cited Western officials saying a seven-man network financed by the IRGC Quds Force and Iran's intelligence ministry enlisted local criminals, and that senior IRGC commanders approved the RAF Fairford plot 2. Iran denies involvement, and the allegations have not been tested in court; G7 foreign ministers cited grave concern over Iranian plots on November 9-10, and no public link has been confirmed between the Fairford and RAF Mildenhall incidents 4.

Analyst Note: We hold high confidence, based on a primary DOJ document that places both men outside US custody and the absence of any reported arrests or extradition proceedings. It is very unlikely that Mohsen Mohajeri or Mohammad Ali al-Hassani is arrested, taken into custody or extradited to the US between November 16 and December 31, 2026. Al-Hassani, who allegedly directed a London synagogue attacker by FaceTime, is the key defendant, yet neither man has a publicly identified location or detention in a cooperating state, leaving prosecutors with al-Saadi alone. The superseding indictment widens the May case by adding two co-defendants, the Fairford and New York synagogue plots, and live video direction of attackers. Independent corroboration of the network's wider structure is slimmer than the agreement suggests, because the DOJ release anchors the charges and the other outlets largely relay it or a single ITV investigation. The indictment may serve mainly to build signaling and sanctions pressure on Tehran and Baghdad, not to precede arrests. If neither man is taken, planners should treat the directing layer as still active and keep force protection at UK bases heightened.

Sources:

1: US charges 3 Iran-backed operatives over attacks against Jews, plot targeting UK airbase - Times of Israel

2: ITV Investigation Links Islamic Republic Intelligence Agencies to Wave of Attacks Across Europe

3: Iran-backed network directed London attacks over FaceTime, US prosecutors say - The Record

4: Seven-man Iran-linked network helped orchestrate wave of attacks across Europe - ITV - Iran International

Three Iranian-Backed Operatives Indicted for Their Roles in Nearly 20 Terrorist Attacks and Attempted Attacks - US Department of Justice, Office of Public Affairs

Prior Reporting

Adversary Intelligence

Russian FSB Hackers Target NATO and EU Emails Exploiting Microsoft Flaws

BLUF: Turla's use of victim Exchange servers as silent command infrastructure means NATO members relying on perimeter monitoring alone have no assurance their own diplomatic mail has not already been siphoned undetected.

a Slovak cybersecurity firm (ESET), which publicly disclosed the operation on November 10, attributed a previously undocumented .NET toolset it named Cereal to Turla, a group generally considered affiliated with Russia's Federal Security Service (Russia; FSB), with high confidence 1. Cybernews reported that Turla compromised Romanian government Microsoft Exchange servers, and Commondef put the breach at December 23, 2025, about a month after ESET first found the tool on a Kazakh government server 12. Per Commondef, the CerealBox component filtered for NATO and EU addresses, selected emails with Word or PDF attachments, then compressed and encrypted copies for later retrieval 1. Cybernews, citing ESET, said the victim's own Exchange server served as the command hub in place of external infrastructure, and that how the attackers gained initial access and how much data they took remain unknown 2.

Analyst Note: Turla's Cereal toolset shows that Exchange servers holding NATO and EU correspondence can leak for months with no external command traffic for defenders to block. Allied governments running on-premises Exchange must audit transport agents and in-memory .NET modules, since perimeter monitoring would have caught nothing. The Romanian compromise dates to December 23, 2025, so exposure ran about ten months before disclosure. The unknown initial access route and unmeasured volume of stolen mail leave other NATO members unable to size their own exposure. Confidence is low: ESET is the sole primary source, secondary outlets only repeat its findings, and no victim has independently confirmed. The Romanian and Kazakh servers may also be opportunistic footholds, with the NATO and EU filters reflecting broad collection tasking rather than a campaign aimed at alliance communications.

Sources:

1: Russian FSB Hackers Breach Romanian Servers, Siphon NATO and EU Emails - Commondef

2: Russian hackers breach Romania emails with new malware - Cybernews

Exchange for breakfast: Turla's Cereal tricks are not for kids - ESET Research (WeLiveSecurity)

Russian FSB targets NATO emails as hackers exploit Microsoft flaws - Defence24

France Accuses Iran of Cyber Sabotage as Europe Confronts New Infrastructure Threat

BLUF: It is unlikely that the Council of the EU adopts sanctions on Shahid Kaveh or its members over the October French retail cyberattacks by the end of December 2026, leaving exposed industrial controllers as the more immediate policy gap.

France's Foreign Ministry attributed the overnight October 11-12 cyberattacks on refrigeration controls at more than 700 French retail sites to Shahid Kaveh, a unit affiliated with the Islamic Revolutionary Guard Corps, citing fires and food losses in the tens of millions of euros 1. CNBC reported that attackers used Danfoss and Dixell controllers' web interfaces to start unlimited defrost cycles, raising temperatures by up to 50 degrees Celsius, and that investigators found Farsi and Iran-linked IP addresses 2. Foreign Minister Barrot said the Iranian ambassador was summoned and sanctions would be sought at European level, while the Paris prosecutor requested international arrest warrants for the unit's leader and two deputies 3. Iran's Foreign Ministry rejected the accusation as "baseless and malicious" 2; EU Today noted the attribution does not cover separate early November incidents in other European countries 4.

Analyst Note: We assess with high confidence that Iran-linked Shahid Kaveh is responsible for the October 11-12 refrigeration sabotage, though that confidence rests on a single primary French declaration, and Al Jazeera, CNBC and NPR repeat the same official statements rather than investigating independently. Paris has committed only to propose measures, and no other member state or EU body has signaled support. It is unlikely that the Council of the EU adopts sanctions on Shahid Kaveh or its members over the October retail attacks between November 16 and December 31, 2026. France has not yet circulated the evidentiary package that unanimous EU listings require, so the Paris arrest warrants and national measures will come first. The attribution excludes the November 2 incidents in Belgium, Ireland, Sweden and elsewhere, which could dilute a joint response. Paris may also be using attribution and warrants mainly for domestic and diplomatic signaling, with sanctions moving slowly through the EU cyber framework into 2027. Operators of exposed Danfoss and Dixell controllers remain at risk regardless, so retailers and officials must rely on patching and national measures unless sanctions land.

Sources:

1: Declaration of attribution to Iran of cyber attacks against France - French Ministry for Europe and Foreign Affairs

2: France blames Iran for supermarket refrigerator cyberattacks, weighs sanctions - CNBC

3: France accuses Iran of cyberattack on supermarket fridges - Al Jazeera

4: France Accuses Iran of Cyber Sabotage as Europe Confronts a New Infrastructure Threat

France accuses Iran of cyber 'sabotage' in fridge attacks - NPR

IC Oversight & Policy

Trump Officials Press Congress to Renew Section 702 Surveillance Law in Lame-Duck Session

BLUF: It is unlikely that Congress passes and the President signs a Section 702 reauthorization by the end of December, given a divided Republican conference, civil liberties opposition, and collection authority that survives until March.

Attorney General Todd Blanche, Director of National Intelligence Jay Clayton and CIA Director John Ratcliffe penned congressional leaders on Friday urging extension of FISA Section 702, according to The New York Times 1 and Fox News 2. Fox reported the letter sets a December 9 deadline to begin the 2027 renewal process, says the statutory authority has lapsed, and says collection will expire March 16 absent reauthorization 2. Mother Jones reported the authority lapsed in June and that seven Republicans voted against renewal earlier this year 3. House Intelligence ranking Democrat Jim Himes urged Republicans on Wednesday to pass the renewal in the lame-duck session, per The Hill and Mother Jones 34. Senator Ron Wyden said the issue should wait for the next Congress, and a civil liberties coalition including the American Civil Liberties Union (ACLU) sent a letter Thursday urging the same 13.

Analyst Note: The December 9 request gives Republican leaders about three weeks to move a bill that already split their conference, when seven Republicans voted against renewal earlier this year. Wyden and a coalition including the ACLU want the issue left to the next Congress, so any vehicle such as the National Defense Authorization Act would draw a fight over warrant requirements. Congress is unlikely to pass and the President to sign a Section 702 reauthorization between November 16 and December 31, 2026. High confidence rests on four outlets reporting consistent positions and a letter that states its timeline, though no floor schedule exists. Himes backs a lame-duck deal but has signaled a more restrictive first-quarter renewal is acceptable, and collection continues until March 16. The letter may aim less at passage than at building a record, letting Republicans blame Democrats for any later lapse and set first-quarter terms. If a bill passes, agencies start the 2027 renewal on schedule and reform advocates lose Democratic-majority leverage. If it fails, Democrats could add warrant requirements, and agencies must plan around the March 16 expiration.

Sources:

1: Trump Officials Press Congress to Renew Spying Law in Lame-Duck Session - The New York Times

2: Trump officials push lame-duck Congress on FISA renewal before Dem takeover - Fox News

3: Top Intelligence Democrat Says GOP Should Renew Spy Program Before Democrats Take Over - Mother Jones

4: Himes urges Republicans to pass FISA during the lame-duck session - The Hill

Prior Reporting

Allied Intelligence

Mossad Warned CIA of Iranian Drone Plot Against Trump and Senior Officials

BLUF: It is unlikely that a named senior US official or office publicly confirms by November 30 that Iran planned a drone or explosive attack on Trump or senior officials, since the leak serves Israeli leverage while Washington has every reason to stay silent.

Israel Hayom reported, citing unnamed senior Israeli and American officials, that the Mossad gave the CIA specific intelligence on an Iranian plan to attack President Trump and senior administration officials, including with explosive-laden drones 123. The officials said Washington asked Israel to verify the information and that another Western intelligence agency corroborated it 13. JFeed and The Yeshiva World, relaying the report, said Treasury Secretary Scott Bessent, Secretary of State Marco Rubio and Defense Secretary Pete Hegseth were moved to military facilities, Trump cut back outdoor appearances, and counter-drone systems were deployed at his events 12. Bessent confirmed in an interview that he moved onto a military base because of Iranian threats 1. Neither the White House nor the CIA has confirmed the plot, and Israel.com noted that all versions trace to the single Israel Hayom account 14.

Analyst Note: Confidence is low: the account rests on one original report from unnamed officials, with no US government statement and no detail on timing, location or operatives, and every English-language outlet relays that single stream. Relocated officials and added counter-drone cover are visible protective steps, but Washington can justify them by the general Iranian threat without acknowledging a specific plot, and Bessent tied his own move only to Iranian threats. It is unlikely that a named senior US official or office (White House, CIA, Director of National Intelligence (DNI), DOJ or Secret Service) publicly confirms on the record, between November 16 and November 30, that Iran planned a drone or explosive attack on Trump or senior officials. The account may serve Israeli aims more than it reflects an imminent plot, since it casts Israeli intelligence as the reason Trump has hardened against talks with Tehran, and its release during Mossad chief Gofman's Washington visit lets Israel press against a US-Iran deal while US agencies keep their own assessment private. Without official confirmation, protective planners and Iran-policy officials can discount the report rather than treat the plot as established grounds for tougher measures against Tehran.

Sources:

1: Report: Mossad Warned CIA of Iranian Drone Plot Against Trump - JFeed

2: IRAN THREAT: Mossad Warns CIA of Iranian Assassination Plots Against Trump and Senior U.S. Officials - The Yeshiva World

3: Mossad warned the CIA of Iran's plans to attack Trump and senior US officials - media - Mezha

4: Mossad warned CIA of Iranian drone plot targeting Trump and top officials - Israel.com

Israeli intelligence warns of Iranian plot to target Trump, top US officials with drones - Israel Hayom

COLLECTION GAPS

UNCLASSIFIED // OPEN SOURCE