A NOT-SO-SECRET REUNION -- The NSA is reportedly calling some of its former top hackers back to Fort Meade tomorrow — both a reunion and recruiting push. The Record reports the gathering will bring together alumni of Tailored Access Operations (TAO), the highly secretive unit that penetrates foreign computer networks for U.S. intelligence operations. (Truth be told, we hear they are the best of the best hackers in the world). Deputy Director Tim Kosiba, himself a TAO veteran, is reportedly driving an effort to strengthen the unit and persuade former talent to return. In an ironic twist, some alumni have questioned the security of the outreach after hundreds of former operators gathered in a private Signal chat to reconnect ahead of the event.
AI ON OFFENSE, BUT WHO’S ON DEFENSE? The Justice Department and FBI announced Wednesday that they had seized the domains of two hacking platforms operated by a Chinese group that officials say provided cyber services to China’s Ministry of State Security and People’s Liberation Army. According to the Justice Department, the outfit known as QTFY’s QScan tool hunted for vulnerable computers and internet-connected devices, while QTRouter helped hackers hide where their attacks were coming from. Among the targets: NASA, the Federal Reserve, the Senate and several federal departments. The FBI seized the domains that the malware needed to communicate, effectively pulling the plug. Former Director of Cybersecurity for the National Security Agency Rob Joyce (who we’re told has some impressive skills of his own in cyber), told The Cipher Brief this week that he’s concerned about how much AI is turbocharging the hunt for system vulnerabilities and how defense using AI just hasn’t caught up yet. “There will be a dark period,” Joyce told The Cipher Brief.
RATCLIFFE'S RIDE TO MOSCOW WASN'T EXACTLY SUBTLE: CIA Director John Ratcliffe made his first known trip to Moscow this week, and next to the mystery of what was discussed – was the question of how he got there. Press accounts say he arrived aboard a U.S. Air Force C-17 Globemaster III, a 282,500-pound cargo hauler built for tanks and troops, not exactly the diplomatic equivalent of a black sedan. The Washington Post reports the aircraft flew from Joint Base Andrews to Riga, Latvia, then on to Moscow, where it sat for about eight hours. The plane was also stripped of its usual markings under a 2023 Air Force policy meant to keep high-priority flights (relatively) inconspicuous. But some reports say there was also a C-40B, landing beside it in Riga. Public tracking data never shows that plane continuing to Moscow, though The Aviationist notes that is a more comfortable type of aircraft used to move senior officials — suggesting Ratcliffe swapped planes in Riga rather than riding the cargo hauler the whole way. (No word on whether Ratcliffe might have transferred between planes via a catering truck - sorry, our naughty side couldn’t help but say it.) Another hint though - Washington also reportedly asked Ukraine to hold off on drone strikes against Moscow and St. Petersburg while Ratcliffe was in the country, according to the Kyiv Independent. Kremlin spokesman Dmitry Peskov later told CBS News that Ratcliffe met with Russian intelligence officials, but not Vladimir Putin. Whatever the agenda, it just goes to show how hard it can be to fly low-profile anymore.
GERMANY'S SPY AGENCY LEVELS UP ITS RECRUITING GAME: Forget trench coats: Germany's foreign intelligence service wants gamers. The BND is heading to Gamescom, the world's largest video game expo, opening this week in Cologne, to hunt for "technically skilled secret agents," according to The Telegraph. The pitch: a stealth-and-hacking title the agency built in-house, "BND Legenden: Operation Blackbox," meant to lure players sharp enough to survive a five-stage vetting process testing real cybersecurity and hacking skills. BND spokesperson Julia Linner made the sales pitch plain: "We see significant overlap between gamers and the key specialists we seek: they understand technology, enjoy taking on different roles..." The playful pitch masks a serious mission: the BND wants more cyber muscle to counter Russian hackers accused of probing German critical infrastructure. As previously mentioned in the Dead Drop, Germany's intelligence services recently won cabinet approval for a "security revolution" expanding their hacking and disruption powers. Fair warning to applicants: the BND's version of the game does not come with a pause button.
CALL AN EXPERT -- it seems like everyone needs good advice these days when it comes to understanding and navigating the complex global environment and rumor has it that former Commander of U.S. Cyber Command, Gen. Paul Nakasone (Ret.) (who also served as NSA Director) is launching his own consulting firm along with former director of the Pentagon’s Defense Digital Service, Brett Goldstein. Aptly named The Nakasone Group, the boutique firm will focus on cyber defense, cyber-enabled fraud and understanding the risks associated with today’s fast-paced world. For a fantastic overview of what that world looks like, check out The Cipher Brief’s State Secrets Podcast with Gen. Nakasone when host Suzanne Kelly asked if the general thinks the U.S. is ready for AI-Enabled Warfare. His answer may surprise you. You can find the State Secrets Podcast wherever you listen to podcasts or watch the conversation on The Cipher Brief’s YouTube Channel.
VANDENBERG NOT QUITE READY FOR THE MOMENT: Last week, base security at Vandenberg Space Force Base in California invited members of the press to attend a golden shovel groundbreaking for a new 160,000 square foot missile training facility. The down side of the gala came when base security officers mistook the invited media convoy for a group of gate runners and pulling weapons them and their two military escorts. It’s a little hard to understand the confusion because Stars and Stripes reported that the military escorts were handcuffed and placed in government vehicles, while reporters sat curbside contemplating the finer points of the base’s public relations strategy. Everyone was eventually released without charges, but the ceremony went on without them. A spokesperson described the episode as a coordination gap that resulted in a media convoy proceeding before the credentialing process was fully completed. The spokesperson (presumably not the one in handcuffs) added that the base takes installation security and its responsibility to media guests very seriously. Sentinel, the weapon system the visitors were there to celebrate, is itself famously behind schedule and over budget, so maybe base security was just staying on theme: at Vandenberg this week, nobody was quite ready for the moment.
WHAT A FEW MONTHS LOOKS LIKE IN PENTAGON YEARS - Army Secretary Dan Driscoll is expected to step down by the end of the year, The Hill reports, citing months of tension with Defense Secretary Pete Hegseth that appears to have boiled over into a slow motion purge of nearly everyone in Driscoll's orbit. Driscoll, a former Army Ranger and Iraq War veteran who took office in February 2025 and counts Vice President JD Vance as a longtime friend, was reportedly viewed by Hegseth as a rival for his own job, and administration officials tell reporters that Hegseth has been going after people perceived as close to Driscoll ever since. Now, this is a gossip column, so we can’t prove it but still, Exhibit A: the April firing of Army Chief of Staff Gen. Randy George, a Driscoll ally, reportedly after George and Driscoll refused to strip two Black officers and two female officers from a one star general promotion list. Worth remembering: back in April, Driscoll publicly insisted he wasn’t going anywhere despite the reported friction, but four months is an awfully long time in Pentagon years.
DEAD DROP IN DEUTSCHLAND: German authorities reportedly found two handguns and ammunition buried in a professionally concealed cache in a forest outside Berlin last October. Seems interesting enough. But Germany’s domestic intelligence service now believes the weapons may have been intended for Russian agents who were possibly awaiting orders from Moscow. After finding the guns, investigators did something straight out of a spy thriller. They rendered the weapons dysfunctional and fitted them with GPS trackers but left them in their hiding place and watched the site, hoping some nefarious agent would collect them. The case surfaced publicly on Friday when Interior Minister Alexander Dobrindt confirmed that federal prosecutors are investigating a suspect who is now being held in Romania. Officials say the man is suspected of espionage and preparing a serious crime threatening national security. Dobrindt called him a “low-level agent” and said the case showed Germany was operating under a “high threat level.” German officials have not publicly identified a target or confirmed that Russia ordered the operation. But German media report that the domestic intelligence service believes the cache was connected to Russian intelligence and possible assassination operations. Moscow denies such allegations.
EUROPE’S GREAT MUSEUM GIVEAWAY: Two men reportedly bought tickets to Vienna’s Museum of Applied Arts Thursday, smashed a display case in broad daylight and walked off with a platinum necklace featuring more than 600 diamonds—apparently proving that even multimillion-dollar heists now come with general admission. The $4 million piece, once worn by Egyptian Queen Nazli, joins a growing haul of treasures recently lifted from museums in Paris, Parma, Sicily and Spain, raising uncomfortable questions about Europe’s ability to protect its cultural crown jewels. Europol says museum thefts are becoming more aggressive and may involve new criminal networks. The Dead Drop wonders whether European security officials should spend less time reviewing their carefully prepared protocols—and more time watching Ocean’s Eleven and The Italian Job. The thieves certainly appear to have.
Got news to share? Drop us a note: Editor@thecipherbrief.com
Read more expert-driven national security insights exclusively in www.thecipherbrief.com.
