6:00 PM ET, Thursday, September 14, 2023
The Cipher Brief curates open source information from around the world that impacts national security. Here's a look at today's headlines, broken down by region of the world:
The Americas
U.S. Sanctions Over 150 Entities, Individuals Linked to Russian Military. The U.S. Treasury Department sanctioned over 150 entities and individuals on Thursday to curb Russia’s access to technology and funds amid the Ukraine war. The sanctions focus on targets that play critical roles in Russian military supply chains and Russian oligarchs profiting from Moscow’s invasion of Ukraine. Among the sanctioned Russian elites are heads of Russian aerospace, mining, and manufacturing companies. The sanctions also cover top Russian construction, electronics and banking companies. The measures also target five Turkish companies and one Turkish national for shipping drone parts and other dual use goods to Russia, as well as a Finland-based network that sends foreign electronics to Russia-based end-users. The U.S. State Department also sanctioned over 70 entities, including Arctic natural gas developers, to hobble Russia’s energy sector, and thus limits future energy revenue. Reuters Kyiv Independent Associated Press CNN U.S. Department of State U.S. Department of the Treasury
U.S. Approves Sale of F-35A Jets to South Korea. The U.S. State Department approved the potential sale of 25 F-35A fighter jets to South Korea for $5.06 billion. The potential sale would also include Pratt & Whitney F135-PW-100 engines for the aircraft and electronic warfare support. The Pentagon said the proposed sale will help boost South Korea’s deterrence capabilities and interoperability with U.S. forces. South Korea is using the F-35 jets to replace its aging F-4E Phantom II jets. Defense News US DoD DSCA
Elon Musk to Meet Israel's Netanyahu in Silicon Valley. Israeli Prime Minister Benjamin Netanyahu will meet tech billionaire Elon Musk on Monday in Silicon Valley to discuss artificial intelligence technology, according to Netanyahu’s office. Netanyahu was already scheduled to visit California next week before traveling to New York for the U.N. General Assembly. Sources say Netanyahu may meet with Musk as part of wider meetings with other executives from the technology sector, which is a key driver for the Israeli economy. Netanyahu’s meeting with Musk will also come after rights groups reported an increase in anti-semitic language on X, formerly known as Twitter, following Musk’s decision to loosen content moderation on the platform. Separately, officials say Netanyahu is set to meet with President Joe Biden in New York. Biden has expressed concern about Netanyahu’s judicial overhaul plan and his government’s support of Jewish settlements in the occupied West Bank. Reuters
NASA Names New UFO Research Chief. NASA has a new director of research for “unidentified anomalous phenomenon” (UAP). NASA Administrator Bill Nelson made the announcement after an expert panel recommended that NASA increase its efforts to gather information on UAP and assist the Pentagon in detecting them. Although Nelson voiced his personal opinion that life exists beyond Earth, he noted that the expert panel found no evidence of extraterrestrial origin of the UAPs. For the past few years, the U.S. government has made several disclosures of information regarding UAPs including a 2021 report by the Office of the Director of National Intelligence. NASA said that the director of UAP research will handle “centralized communications, resources and data analytical capabilities to establish a robust database for the evaluation of future UAP”. Reuters
Western Europe
UK Warns Chinese Spies Headhunting British Officials. The British government said Thursday that Chinese spies are targeting British officials in sensitive positions in politics, defense, and business, as part of a large and increasingly sophisticated espionage operation to gain access to sensitive information. The British government’s statement on the “prolific” level of Chinese espionage came in response to a parliamentary report published in July that found the government’s approach to the threat was inadequate. Concerns over Chinese spy activity in Britain have been exacerbated by the recent revelation that a parliamentary researcher was arrested in March on suspicion of spying for Beijing, an accusation the researcher vehemently denies. The Chinese foreign ministry called the spying accusations “entirely groundless”. Reuters
Central and Eastern Europe
Ukraine Reports ‘Some Success’ Near Bakhmut, Heavy Fighting Near Andriivka. Ukrainian Deputy Defense Minister Hanna Maliar said on Thursday that Ukraine’s military has seen “some success” near Bakhmut but heavy fighting continues south of the city around Andriivka. Ukraine’s 3rd assault brigade, which has been fighting in the area, added that it is still “unsound and premature” to discuss victory around Andriivka. On the southern front, Maliar said there are “very active battles” and that the “situation is very dynamic,” adding that Russian troops refuse to leave areas that have been liberated and continue to resist. Maliar added that Ukrainian forces are “gradually advancing” towards Melitopol. CNN
Ukrainian Presidential Advisor Outlines Liberation of Crimea. Mykhailo Podolyak, advisor to the head of the Ukrainian Presidential Office, on Thursday detailed the three main “tasks'' Ukraine must perform in order to retake Crimea. First, Podolyak said Ukraine must destroy Russian anti-missile and air defense systems in Crimea to “open up the sky over the peninsula” to target other Russian military assets. Second, Ukraine must destroy “transport logistics, including illegal objects like bridges in Kerch Strait '' to cut off Russian supply lines to the peninsula. Third, Podolyak said Russia’s Black Sea Fleet must be driven from Crimea territorial waters, meaning Russian ship repair yards and vessels must be destroyed. His comments come after Ukrainian air assaults on Crimea, which damaged a ship repair base and two Russian warships in Sevastopol and air defense systems near the town of Yevpatoria. CNN
Russia Expels U.S. Diplomats for ‘Illegal Activity.’ Russia’s Foreign Ministry said on Thursday that it is expelling two U.S. diplomats — First Secretary Jeffrey Sillin and Second Secretary David Bernstein — from Russia and that they must leave within seven days. The ministry accused the two diplomats of “illegal activity,” claiming that they worked with a Russian national referred to as R. Shonov, who is charged with cooperating with a foreign state on actions that would damage Russian national security. The U.S. State Department said the expulsion was “unprovoked” and that the U.S. will “respond appropriately.” Russia’s FSB security service released a video in August purportedly showing Shonov, who worked at the U.S. Consulate General in Vladivostok for over 25 years, saying that Sillin and Bernstein asked him to gather “negative” information on Russia’s invasion of Ukraine, annexation of “new territories, military mobilization and the 2024 presidential election. Reuters Associated Press Forbes
Asia and Oceania
China Says Has Capacity to Build Railway to Taiwan. Cong Liang, deputy director of China’s National Development and Reform Commission, said on Thursday that China has the engineering ability to build a high-speed railway between Fujian province and Taiwan. The official from China’s state planner did not detail what the railway would look like, though he claimed people “on both sides” want a bullet train across the Taiwan Strait. Cong spoke about the railway during a press conference about a roadmap for the peaceful “integration” of Fujian and Taiwan through cross-strait energy and transport connections. Under the plan, China would build living circles between cities in Fujian and nearby Taiwan-controlled islands, connect Taiwan to European markets through the China-Europe Railway Express, and deliver green power from Fujian to Taiwan. Taipei has dismissed such plans as “wishful thinking” and said they are one-sided initiatives to use Taiwanese funds and talent to address China’s internal economic problems. South China Morning Post
Chinese Defense Minister Skipped Vietnam Meeting Amid Absence from Public View. Chinese defense minister Li Shangfu abruptly pulled out of an annual defense meeting hosted by Vietnam last week. Vietnamese officials said they were forced to postpone the meeting and that they were told Li could not attend due to a “health condition.” Li has not been seen in public for over two weeks. His withdrawal from public view follows the sudden replacement of Foreign Minister Qin Gang in July after a similar absence from public view, as well as a recent shake-up in the leadership of the Chinese military’s Rocket Force. Li’s disappearance adds to speculation and uncertainty about the current state of China’s elite politics. U.S.-China military communications have largely been stalled partially due to U.S. sanctions on Li for his purchase of Russian weapons in 2018. Reuters
Middle East and Northern Africa
U.S. Treasury Official Warns of Further Actions Against Iraqi Banks. A top U.S. Treasury official said Thursday that Iraq’s central bank must address risks of the misuse of U.S. dollars at Iraqi commercial banks to avoid further punitive measures targeting the country’s financial sector. The official cited ongoing issues at Iraqi banks such as fraud, money laundering, and Iran sanctions evasion. In July, the U.S. barred 14 Iraqi banks from conducting dollar transactions as part of a larger effort to crackdown on the illicit use of the dollar. Despite the previous measures, the Treasury official said that there were still other Iraqi banks operating with risks that “must be remediated”. Iraq’s central bank governor has previously said that the country is committed to implementing tighter financial regulations and combating the smuggling of U.S. dollars. The central bank did not respond to the official’s comments. Reuters
U.S. Approves Much of Military Aid to Egypt. The Biden administration has allowed most U.S. foreign military aid allocated for Egypt to be delivered due to its critical role in advancing U.S. national security interests despite critics flagging the country’s poor human rights record. The U.S. withheld $85 million of aid for Egypt’s failure to make progress on releasing political prisoners, but that tranche is only a small fraction of the $1.3 billion a year earmarked for Egypt. Another $235 million could have potentially been withheld since that portion is also conditional on democracy and human rights benchmarks, but officials said U.S. Secretary of State Antony Blinken is waiving those requirements. Officials say the move has not stopped U.S. commitment to pressing Egypt on human rights, but rights groups continue to say there has been no progress in Egypt’s human rights situation. Reuters Barron’s
Sub Saharan Africa
Sudan’s RSF Threatens to Form Governing Authority. The head of Sudan’s paramilitary Rapid Support Forces (RSF), commander Mohamed Hamdan Dagalo, has threatened to establish a governing authority in places the RSF controls if Sudan’s army moves to form its own government. His warning came after officials aligned with Sudan army chief General Abdel Fattah al-Burahn said last month that a caretaker government in Sudan is needed. Dagalo said that any army-led government will be met by a RSF government that would have Khartoum as its capital. He also warned that if the army forms a caretaker government in the eastern Red Sea port of Port Sudan, it will split the country. Reuters
Cyber and Tech
MGM Systems Still Hampered by Cyberattack; Caesars Reports Ransomware Demands. MGM Resorts continues efforts to recover from a cyberattack that shut down the company’s website and impacted casino and hotel systems involving slot machines and room keys. Although MGM has declined to provide details of the cyberattack, reports indicate it is a ransomware ploy possibly carried out by an affiliate of the Black Cat/AlphV ransomware gang. The affiliate known as Scattered Spider and Oktapus claimed in an online post that it gained access to MGM systems by spoofing the company’s IT help desk. The hackers exploited remote login software and leaked VPN account information from MGM employees allowing them to access multiple areas of the company network. Scattered Spider/Oktapus also has been connected to the ransomware attack on Caesars Entertainment weeks ago, although some hackers told media sources they did not participate in that operation. Caesars Entertainment informed the SEC last week that hackers gained copies of their loyalty program database, which includes driver’s license numbers and/or social security numbers, for a large number of members. Caesars said that it has taken steps for the stolen data to be deleted by the threat actors, noting that “we have not seen any evidence that the data has been further shared, published, or otherwise misused.” Some reports indicate the casino paid a $15 million ransom after being asked for $30 million. The Record Reuters Wall Street Journal Cybernews CyberScoop
Senate, Tech Sector Leaders Reach ‘Loose Consensus’ on Government AI Regulation. A loose consensus among tech executives in favor of some government role in regulating AI development was noted as an outcome of the forum organized Wednesday by Senate Majority Leader Chuck Schumer, which included about two dozen industry leaders, advocates, and critics. Schumer noted that every participant in the meeting, when asked about a government regulatory role, “raised their hands, even though they had diverse views.” Tesla and X CEO Elon Musk said, “the key point was really that it’s important for us to have a referee.” Musk and former Google CEO Eric Schmidt raised the issue of AI’s existential risks, with Musk observing that “the consequences of AI going wrong are severe so we have to be proactive rather than reactive.” On the topic of AI open-source systems, Tristan Harris, head of the Center for Humane Technology, argued that bad actors can abuse these models, including Meta’s recently released Llama 2. According to sources, Harris told the meeting his nonprofit was able to get the Llama 2 model to provide instructions on how to create dangerous biological compounds. Other executives attending the meeting included Meta’s Mark Zuckerberg, former Microsoft CEO Bill Gates and Google CEO Sundar Pichai. Associated Press NBCNews Wall Street Journal Bloomberg
Iran Threat Group Penetrates Systems in Defense, Satellite, Pharmaceutical Sectors. Microsoft threat researchers reported Thursday that an Iranian cyberespionage group it tracks as Peach Sandstorm (aka APT33) has compromised and exfiltrated data from dozens of organizations operating in satellite, defense, and pharmaceutical sectors. The group used “password spray” attacks against targeted systems in which a known password is linked to a list of usernames. Thousands of organizations have been hit in the campaign that began in February. Microsoft did not disclose the locations of the targeted entities but reported that once access to a system had been gained, the attackers sustained their presence in order to perform other types of activities. Although password spray attacks are easy to detect, according to Microsoft, once hackers gain access, they employ more sophisticated methods to avoid protective measures. Researchers detected two pathways into targeted organizations, first, by the password spray route, and, second, through a pair of vulnerabilities from 2022 affecting a subset of Zoho ManageEngine products and the Confluence Server and Data Center. CyberScoop
DHS Annual Threat Assessment Highlights AI Use in Critical Infrastructure Disruptions. The Department of Homeland Security’s (DHS) annual threat assessment report is warning that threat actors could use AI to disrupt critical infrastructure by conducting election influence campaigns or attacking industrial systems. The report highlights the prospects for attackers increasing their knowledge of AI’s use in exploiting infrastructure vulnerabilities related to the 2024 election, transportation, pipelines, and other critical sectors. DHS cited, in particular, state-backed hackers from China making use of AI for public influence campaigns and to deploy malware in large-scale attacks. A DHS official noted at a media briefing that U.S. adversaries “really kind of understand the interconnectedness of our critical infrastructure and the impacts it would have.” DHS also pointed to China’s interest in adapting AI to launch malware attacks that are “larger scale, faster, efficient, and more evasive.” The transportation sector, which includes rail systems and pipelines, is of particular concern in this connection. The report noted also that K-12 school districts have faced “near constant ransomware targeting” due to a lack of dedicated resources against malicious hackers. Disruptions of elections by ideological extremists is also covered in the report, compounded by state-backed hackers who will likely use AI to enhance the quality and breadth of disinformation campaigns. The media briefing heard the DHS assessment that “the 2024 election cycle will be a key event for possible violence and foreign influence targeting our election infrastructure processes and personnel.” CyberScoop
DoD Cyber Strategy Underscores China’s Ongoing Cyber Campaigns, Use in Wartime. A summary of the 2023 DoD Cyber Strategy released Tuesday describes China’s cyber operations as the “pacing challenge” facing the U.S. as it regularly deploys malicious cyber campaigns against American and allied targets. According to the strategy, China’s relentless cyber activity is integral to its “preparations for war,” which would include destructive cyberattacks against the U.S. should hostilities break out. Degrading American combat capability using cyber means is at the core of Beijing’s theory of victory and would include goals for hampering mobilizations, creating chaos, and causing distractions and diversion of resources. The strategy also notes that China would likely seek “to disrupt key networks which enable joint force power projection in combat.” At all times, the strategy points out, China represents a “pervasive cyberespionage threat.” Consequently, the U.S. must sustain a robust cyber arsenal that can respond across “the spectrum of conflict.” South China Morning Post
Read deeply-experienced, expert-driven national security news, analysis and opinion inThe Cipher Brief
