10:00 AM ET, Friday, November 10, 2023
The Cipher Brief curates open source information from around the world that impacts national security. Here's a look at today's headlines:
THE TOP STORIES
Pentagon Running Out of Funds to Provide Aid to Ukraine. Deputy Pentagon spokeswoman Sabrina Singh said on Thursday that the Pentagon has only $1 billion left to provide military assistance to Ukraine. She said that the U.S. used around 95% of previous funding for Ukraine, totaling to around $60 billion, and that the remaining $1 billion in aid allows for U.S. stocks to be sent to Ukraine and replaced with new orders. Singh said the Pentagon continues to support Ukraine but that the aid packages are shrinking. She urged Congress to approve the Biden administration’s $106 billion emergency aid request that includes $61.4 billion in assistance for Kyiv. She also said the Administration has the option of sending $4.9 billion worth of weapons to Ukraine granted under other congressional authorities. Bloomberg Kyiv Independent
Houthis Attempted to Recover U.S. Drone they Downed. Deputy Pentagon spokesperson Sabrina Singh revealed on Thursday that Yemen’s Iran-backed Houthis tried to recover a U.S. MQ-9 drone that they had downed and that crashed into the Red Sea, though it is not likely that they will be able to retrieve anything of importance. Both U.S. officials and the Houthis said on Wednesday that a drone had been intercepted and shot down off the coast of Yemen. Singh noted that Washington was not interested in recovering the drone. Houthis shot down American drones two different times in 2019, but the latest incident comes amid heightened tensions over the Israel-Hamas conflict. Reuters New York Times
Philippines Condemns Chinese Harassment in South China Sea. The Philippines on Friday condemned China’s coast guard for “unprovoked acts of coercion and dangerous maneuvers” in disputed waters in the South China Sea, including the firing of a water cannon to disrupt a Philippine resupply mission. Manila said the supply mission to Filipino troops stationed on a grounded warship in the Second Thomas Shoal was completed despite the “dangerous harassment” from a Chinese coast guard vessel. China said it “took control measures” against two Philippine resupply boats and three coast guard vessels that it insisted entered the area without China’s permission. China’s coast guard claimed it has made “temporary special arrangements” for such resupply missions and that the latest mission made an “unapproved entry” into disputed waters. China’s foreign ministry said it lodged solemn representations with the Philippine embassy over the incident, saying that it undermined China’s sovereignty and interests in the region. Tensions between the Philippines and China over maritime confrontations in the area have increased in recent weeks. In late October, Chinese and Philippine vessels collided during another resupply mission for the Second Thomas Shoal, with both sides trading blame. The Philippines has been bolstering ties and military cooperation with allies, such as Japan and the U.S., in response. France 24 Reuters South China Morning Post
ISRAEL AND HAMAS WAR
Hamas Fires Rockets at Tel Aviv. Hamas fired rockets at Tel Aviv and surrounding areas on Friday in what the militant group said was a response to civilian casualties from Israeli attacks in Gaza. Medics reported two women in Tel Aviv were injured in the attack. Israel’s military said around 9,500 missiles, rockets, and drones have been fired from Gaza at Israel since the Hamas attacks on October 7. The military added that 2,000 of the projectiles were intercepted by air defenses, which ignore projectiles set to land harmlessly in open areas. The military also said around 12% of the rockets fired from Gaza have failed and fallen into Palestinian territory. Reuters
Three Gaza Hospitals Hit in Israeli Attacks. Palestinian officials said Israeli air strikes hit three hospitals in Gaza, including two children’s facilities, al-Rantisi and al-Nasr, and the al-Shifa Hospital complex, where thousands of displaced Palestinians have been taking refuge. The U.N. and World Health Organization confirmed bombardments at Gaza hospitals. The director general of al-Shifa Hospital, Mohammad Abu Salmiya, said the assault injured four people. Israel’s military has claimed that Hamas runs a command center at the hospital and that there are tunnels used by the militant group under the facility. Palestinian health officials and Hamas have denied this. Gaza’s Health Ministry added that Israeli tanks surrounded four hospitals in northern Gaza: al-Rantisi, al-Nasr, the Government Eyes Hospital and the Psychiatric Hospital. Three hospitals — al-Rantisi, al-Nasr, and the Eye Hospital — were evacuated after Israeli warnings calling for people to leave the facilities. The ministry added that all communication with the al-Shifa and al-Quds hospitals has been cut off. Al Jazeera Reuters Reuters Washington Post
Netanyahu Says Israel does not Seek Occupation of Gaza, but Requires 'Credible Force' to Counter Threats. Israeli Prime Minister Benjamin Netanyahu said on Thursday that Israel does not seek to “conquer,” “occupy,” or “govern” Gaza after the war, but requires a "credible force" to be able to enter the area and stave off militant threats. He said that a civilian government would be necessary in Gaza, but maintained that Israel should have a force to penetrate the Palestinian enclave, “kill the killers,” and prevent “the reemergence of a Hamas-like entity.” He added that Israel would like to see Gaza “demilitarized, deradicalized and rebuilt." U.S. officials have said that the Palestinian Authority (PA) should govern Gaza after the war, though Palestinian Prime Minister Mohammad Shtayyeh this week asserted that the PA would not go back to Gaza "on the back of an Israeli tank.” The PA, which still has limited control in the Israeli-occupied West Bank, was forced out of Gaza by Hamas in 2007. Reuters The Hill
U.S. Officials Express Concern Over Gaza Civilian Casualties. U.S. Secretary of State Antony Blinken said on Friday that “far too many Palestinians have been killed” in Israeli attacks in Gaza. He said that he appreciated Israel’s agreement to observe four-hour daily pauses in its military operations to allow for the movement of people and delivery of aid in Gaza, but Blinken said “much more needs to be done to protect civilians” and get them needed humanitarian assistance. Barbara Leaf, the top U.S. diplomat for the Middle East, said on Wednesday that the death toll in Gaza is likely higher than the 10,000 reported by Gaza’s Health Ministry. The ministry has now reported on Friday that the death toll has surpassed 11,000. Leaf’s comments came after President Joe Biden cast doubt on the reliability of the ministry’s reporting, saying he had “no confidence in the number that the Palestinians are using.” Associated Press CNN Washington Post
Israel says 80,000 Palestinians Flee Northern Gaza on Thursday. Israel says 80,000 Palestinians fled south from northern Gaza through an evacuation corridor on Thursday. Israel said it was the largest movement of people in the five days since the corridor was opened, up from the 50,000 Gazans who traveled through it on Wednesday. The Israel Defense Forces on Friday announced a six-hour long window for an evacuation corridor out of northern Gaza along Salah Al-Deen street, identical in length and location to the previous corridors. CNN Wall Street Journal
U.S. Warns of Negative Impact from Prolonged Israeli Offensive in Gaza. U.S. officials say Israel has only a limited time to perform its operations in Gaza before anger from Arabs in the region and frustration in the U.S. and other countries over civilian deaths hamper Israel’s effort to eliminate Hamas. Chairman of the Joint Chiefs General Charles Brown expressed concern on Wednesday that each civilian killed in Gaza could generate future members of Hamas, though he did not call for a ceasefire. U.N. Secretary General Antonio Guterres said the civilian death toll shows there is something “clearly wrong” with Israel’s military operations there. In almost daily phone calls, senior U.S. military officials are urging their Israeli counterparts to be “more calculating and precise” in their targeting. Some U.S. officials are encouraging Israel to use 250-pound satellite-guided bombs instead of 1,000-2,000 pound bombs on military targets. Officials say Israel’s decision to hold off on a full-scale invasion in favor of a phased ground offensive was in line with Defense Secretary Lloyd Austin’s advice to the Israeli military. Retired U.S. Central Command chief Gen. Kenneth McKenzie said the Israeli campaign “has been very deliberate,” but he added that time “is not necessarily on Israel’s side.” New York Times
Israel Attacks Syrian Organization after Eilat School Drone Strike. The Israeli military said it struck an organization in Syria in retaliation for a drone attack on a school in the Red Sea city of Eilat on Thursday. Though the military did not provide information about what organization launched the drone strike, it said that it holds the Syrian government responsible for “any terror activity emanating from its territory.” There were no reports of injuries from the drone assault, but it caused light damage. An analyst with the British maritime security company Ambrey, Daniel Mueller, said that the drone strike on Thursday "would be the first confirmed damage within the city of Eilat” since Hamas attacked Israel on October 7. Reuters Times of Israel Bloomberg
Israel’s Arrow 3 Air Defense System Makes First Interception. Yemen’s Iran-backed Houthis said it launched missiles at Israeli military targets on Thursday. The Israel Defense Forces and Israel’s Defense Minister said its most advanced air defense system, the Arrow 3, successfully intercepted a missile for the first time. The projectile was a surface-to-surface missile fired from Yemen and was intercepted over the Red Sea. The launch came after Yemen’s Houthis said it fired missiles at Israeli military targets on Thursday. While the Arrow 3, which is designed to down ballistic missiles, was first deployed in 2017, previous interceptions with the Arrow system have used older Arrow 2 missiles. Times of Israel Breaking Defense Israel Ministry of Foreign Affairs
THE UKRAINE UPDATE
Ukraine Says Avdiivka Defenses Holding Against Intensifying Russian Attacks. Ukraine’s military reports that Russia continues to intensify its offensive on the embattled eastern town of Avdiivka. The town, which has become a symbol of Ukrainian resistance, is reportedly the focus of Russia’s forces in the region. Ukraine’s third separate assault brigade said Russia is launching major infantry attacks, supported with artillery, drones, and aviation. A press officer for the brigade noted that Russian forces in the area are unable to resupply quickly and maintained that Ukrainian defenses remain strong. He also suggested that Russia may be escalating its attacks in response to shifting attention to the Israel-Hamas conflict. Ukraine’s military regards Avdiivka as a gateway for future operations to recapture territory lost to Russia. Reuters Kyiv Independent
Ukraine says it Damaged Russian Landing Boats in Crimea. Ukraine’s military intelligence agency reports that Ukrainian sea drones damaged two small Russian landing boats in Crimea in an overnight attack. The intelligence agency said the amphibious ships were crewed and loaded with armored vehicles. The report could not immediately be independently confirmed, and Russia did not comment on the matter. The report came as Russian media said Russian air defenses intercepted two Ukrainian drones over Crimea and one over the Tula region south of Moscow on Friday. Reuters
Russia Likely Struggling to Counter Ukrainian Troops in Kherson Region. The Institute for the Study of War reports that Russia’s military command will likely struggle to counter Ukrainian counter offensive operations in the eastern Kherson region. Russian military bloggers and sources claimed that Ukrainian forces have recently made advances in several settlements across the region. A Ukrainian military observer added that Ukrainian troops have taken positions along key railways and roads. ISW said Russia will likely face challenges if it needs to redeploy units from other areas to Kherson if the relatively combat-ineffective and currently uncommitted Russian forces there cannot respond to Ukrainian troops on the east bank of the Dnipro. Kyiv Independent Institute for the Study of War
Putin Meets Top Military Leaders at Southern Military Headquarters. Russian President Vladimir Putin met his top military brass — including Defense Minister Sergei Shoigu, Chief of Russia’s general staff General Valery Gerasimov, and General Sergei Rudskoy, head of the General Staff's Main Operational Directorate — at Russia’s southern military headquarters in Rostov. The Kremlin said Putin received reports on Moscow’s invasion of Ukraine and was shown new military equipment. Reuters NBC News
Ukraine Extends Martial Law for Ninth Time. Ukrainian President Volodymyr Zelensky on Thursday signed legislation extending martial law and general mobilization until February 24th, 2024. Martial law was first put in place in February of 2022 when Russia invaded Ukraine. This is the ninth extension of both martial law and general mobilization, which requires men aged 18-60, with some exceptions, to remain in the country, as they could be called up for military service. Mykhailo Fedorov, the Digital Transformation Ministry's head, said in October that the ministry was engaged in developing a "smart mobilization" project that would recruit military specialists on a voluntary basis. He said it would first center on locating and recruiting drone operators for Ukraine's Armed Forces. Kyiv Independent RFERL Ukrinform
Ukraine Seeking Conference on Joint U.S.-Ukraine Weapons Production. Andriy Yermak, Head of the Office of the President of Ukraine, said on Friday that he hopes the U.S. will hold a conference on joint U.S.-Ukraine weapons production in December. Ukraine is seeking to bolster its domestic defense industry, in part by joint ventures with international arms makers, amid concerns about continued Western support. Last month, Ukraine set up a joint venture with German arms maker Rheinmetall to repair and service Western weapons. Ukraine also hosted an international defense industry forum in September. Reuters
Ukraine to Hold Global ‘Peace Summit’ Next Year. Ihor Zhovkva, Ukrainian President Volodymyr Zelensky’s top diplomatic advisor, said on Thursday that Ukraine is seeking to hold a global “peace summit” for Ukraine in February 2024. He asserted that the summit will mark “the symbolic beginning and practical implementation” of Ukraine’s 10-point peace plan. Zhovka added that Ukraine will arrange a fourth meeting of national security advisors in late November or early December. His comments on the peace summit come amid shifting attention to the Israel-Hamas conflict. Zhovka acknowledged changing agenda priorities for Middle Eastern countries, but remained confident about participation in the summit, noting that Saudi Arabia, Bahrain and Qatar attended last month’s Ukraine-backed peace talks in Malta. Reuters
E.U. Considers Alternate Ukraine Aid Plan in Case of Hungary Veto. The E.U. is reportedly considering an alternative plan to provide aid to Ukraine in case Hungary vetoes a current proposal for a $53 billion assistance package. Hungarian Prime Minister Viktor Orban has said he opposes including the package in the E.U.’s budget, which must be unanimously approved by all 27 member nations. Sources say the alternative plan will have E.U. members commit to bilateral national guarantees of aid. Orban, who has previously called against military aid for Kyiv and said Ukraine’s counteroffensive would fail, is notably seeking the release of over $30 billion in E.U. funds for Hungary that were frozen last year over concerns about democratic backsliding. Officials from Spain, which currently holds the rotating E.U. presidency, and European Commission are reportedly still hopeful about reaching a consensus on the long-term budget by the end of the year. Bloomberg Kyiv Independent Reuters
THE CYBER AND TECH RUNDOWN
China’s ICBC Reportedly Victim of Ransomware Attack. News media on Thursday yesterday that China’s state-owned Industrial and Commercial Bank of China (ICBC), the country’s biggest bank with revenues of $214.7 billion last year, was the victim of a ransomware attack this week. Sources told The Financial Times that the ransomware gang LockBit was responsible for Wednesday’s attack. LockBit has carried out several large-scale attacks on governments, companies and other organizations this year, far outpacing any other ransomware gang. The trade group Securities Industry and Financial Markets Association reportedly sent a message to its members about the incident after some trades on the U.S. Treasury market did not clear. Bloomberg reported the bank told several clients that a cybersecurity issue would require them to reroute some trades, and the bank reportedly sent out an emergency notice saying that has put a temporary hold on accepting new orders. Halcyon CEO Jon Miller told Recorded Future News that the alleged attack on ICBC has the potential for “serious impact on worldwide financial markets,” as U.S. Treasuries are “central to the global banking and finance system.” The Record Bloomberg
Iranian Hackers Target Israeli Infrastructure. The cybersecurity company Crowdstrike said in a report published on Thursday that Iranian hackers targeted Israel’s transportation, logistics and technology sectors last month amid an uptick in Iranian cyber activity since the war between Hamas and Israel began. Crowdstrike’s Counter Adversary Operations said an Iranian advanced persistent threat (APT) group called Charming Kitten, linked to Iran’s Revolutionary Guards, was responsible. Charming Kitten is said to have introduced a variety of malware strains. Iranian hacker group activity has made headlines over the past month, but Microsoft researchers said yesterday that these operations may not be as coordinated or impactful as they claim. The Record
Russian-Sponsored Hackers Target Ukraine. The cybersecurity firm Mandiant said on Thursday that Russian state-sponsored hackers launched a sophisticated attack on a Ukrainian energy facility in October of last year, causing a temporary power outage before widespread missile strikes on critical infrastructure around the country. Mandiant said the attack by the Sandworm group was a rare example of a cyber incident disrupting operation of a targeted facility. Mandiant did not reveal the location of the facility, the length of the outage, or the number of people affected. Companies and government officials typically refrain from disclosing such information because it could provide Russia with details and encourage future attacks. Mandiant’s Nathan Brubaker said it is difficult to determine the impact of specific incidents during a time of war. Mandiant chief analyst John Hultquist told Recorded Future News that Russian groups “are absolutely persistent at targeting Ukraine,” but that it is a “testament to the Ukrainian defenders that this cyber incident was so isolated.” The Record
Russian Ransomware Gang Clop Targets SysAid IT Software. Microsoft security officials reported on Thursday that the Russian ransomware gang Clop – also called Lance Tempest — which has been behind several popular file transfer tools, is exploiting a new vulnerability in SysAid IT support software. SaysAid said it has provided a patch and advised organizations to look for any signs of exploitation that occurred before the patch was issued. In the attacks tracked by Microsoft, hackers delivered Graceware malware and followed up with attempts to steal data and deploy ransomware. SysAid said the company was informed of the issue on November 2 and hired security company Profero to investigate. According to SysAid’s website, the company has more than 5,000 customers, including governments, large companies, hospitals and universities. Clop’s attacks on MOVEit file transfer software earlier this year caused security problems for these institutions around the world. The Record
Microsoft Temporarily Blocks Employees’ Access to ChatGPT Over Security Concerns. Microsoft temporarily blocked employee access to ChatGPT on company devices on Thursday, notifying employees of security concerns. Access was restored after more than an hour, people familiar with the matter said. Microsoft said the brief denial of access was ordered in error. Other companies have restricted the use of ChatGBT and other external AI tools previously this year. Wall Street Journal
ELSEWHERE IN THE WORLD
Asia and Oceania
Top Chinese Envoy Says Sino-US Relations Face ‘Severe’ Challenges, But Show Positive Signs of Improving. Chinese ambassador to the U.S. Xie Feng said on Thursday that Sino-U.S. relations still face “severe” difficulties, but have shown signs of stabilizing under the leadership of U.S. President Joe Biden and Chinese President Xi Jinping. Speaking virtually at the Forum on U.S.-China Relations in Hong Kong, Xie said it was crucial for Beijing and Washington to cooperate, maintain communications, and improve relations. He said both powers have agreed to make progress towards these goals at the Asia-Pacific Economic Cooperation (APEC) forum in San Francisco, where Xi and Biden are expected to meet. Reuters
Taiwan to Stress Importance of Peace at APEC Summit. Taiwanese President Tsai Ing-wen said on Friday that Taiwan will stress the importance of peace in the region at the APEC summit in San Francisco, one of the few international forums where both Chinese and Taiwanese officials will be present. Taiwan has faced increased military pressure from Beijing over the past year and a half. Tsai told reporters she wants her representative at the San Francisco summit, chip manufacturer TSMC founder Morris Chang, to promote peace and prosperity. She said “we must work together to reduce conflicts in the region” and called Taiwan “a reliable, safe and trustworthy partner in the international community.” Reuters
Australia, Tuvalu Sign Security, Migration Treaty. Australia and Tuvalu signed a wide ranging agreement on security, climate, and migration on Friday. Under the treaty, Australia is providing a security guarantee to Tuvalu to protect the Pacific Island nation from any aggression. Australia will also vet Tuvalu’s security-related arrangements with other countries, including police, port, telecommunications, energy or cyber security deals. Australia will also allow 280 people a year to migrate from Tuvalu, in part to provide climate refuge to Tuvaluans. The annual cap will ensure migration does not cause a “brain drain” from the island country. Australia will also provide funding for land reclamation in Tuvalu’s capital Funafuti. Australian Prime Minister Anthony Albanese called the treaty Canberra’s most significant agreement with a Pacific Island nation. The signing of the pact comes amid heightened competition with China in the Pacific. Reuters South China Morning Post BBC Straits Times
Europe
U.S. Approves Potential Sale of Abrams Tanks to Romania. The Pentagon says the U.S. State Department has approved the potential sale of M1A2 Abrams Main Battle Tanks to Romania for $2.53 billion. Romania is seeking 54 M1A2 SEPv3 Abrams tanks, 54 M1A1 structures, four M88A2 Hercules Combat Recovery Vehicles, four M1110 Joint Assault Bridges, four M1150 Assault Breacher Vehicles and four Heavy Assault Scissor Bridges. The sale would also include 54 M240C 7.62mm machine guns, 5,940 120mm M1147 High Explosive, Multipurpose, Tracer (HEMP-T) cartridges, 4,230 120mm M1002 Target Practice Multipurpose, and Tracer (TPMP-T) cartridges. In May, Romanian lawmakers approved the National Defnese Ministry’s request to buy 54 used M1A2 Abrams tanks from the U.S. Reuters Defense News US DoD DSCA
France Accuses Russia of ‘Online Meddling’ Over Stars of David Graffiti. France’s Foreign Ministry said a Russian disinformation campaign has been boosting social media posts about graffiti Stars of David that have been appearing in Paris. The ministry specifically accused Recent Reliable News/Doppleganger of being a Russian propaganda network that “artificially inflated” social media coverage of the graffiti. The ministry said the “online meddling” is part a “persisting opportunistic and irresponsible strategy” of trying to cause unrest and tensions in France and the rest of Europe. French authorities said earlier this week whether two Moldovans who admitted to putting up the graffiti were directed to do so by an actor abroad. The Russian embassy in Paris said it strongly condemns France’s “groundless attempts” to establish a “Russian connection” to the matter. Reuters France 24
The Americas
U.S. Election Offices Receive Suspicious Letters Filled with Fentanyl, Other Substances. U.S. authorities on Thursday reported that suspicious letters, including some filled with fentanyl and other substances, were sent to local election offices across multiple states. Officials said offices in at least five states — Georgia, Oregon, Washington, Nevada and California — received the letters. In Georgia, an office in Fulton County, which covers most of Atlanta and is the largest voting jurisdiction in the key presidential swing state, received one of the letters. Authorities were working to intercept the letter and sent the overdose-reversal drug naloxone to the office as a precaution. In Oregon, an office in Lane County, which includes the University of Oregon, received a suspicious piece of mail. Officials said no one came into contact with the mail or was reporting negative health effects, but the office was closed and an afternoon pickup of ballots was delayed as a precaution. In Washington state, four county election offices were evacuated after receiving letters containing powders. One letter field-tested positive for fentanyl, while at least one letter contained baking soda. A message in at least one of the envelopes called for “something to the effect of stopping the election.” The incidents come amid heightened concerns over threats against election workers and risk of domestic terrorism around elections. Associated Press Washington Post
The data cutoff for this product was 8:00a.m. E.T.
Ethan Masucol, Bruce Wilmot, and Katharine Campbell contributed to this report.
Read deeply-experienced, expert-driven national security news, analysis and opinion inThe Cipher Brief
