10:00 AM ET, Monday, July 24, 2023
The Cipher Brief curates open source information from around the world that impacts national security. Here's a look at today's headlines, broken down by region of the world:
In the Americas
Blinken Says Ukraine Liberated 50% of Territory Occupied by Russia. U.S. Secretary of State Anthony Blinken said on Sunday that Ukraine has “already taken back about 50% of what was initially seized” by Russian forces. Blinken made the claim during a CNN interview, projecting confidence in the counteroffensive, especially with support from “more than 50 countries” and the training and drive of Ukrainian troops. However, he added that the counteroffensive is still in “relatively early days” and that it will not be played out in the coming weeks but over the next “several months.” Blinken’s comments come amid observations by both Kyiv and the West that the counteroffensive is moving relatively slow, which Ukrainian President Volodymyr Zelensky acknowledged last month, saying that it is progressing “slower than desired.” Axios Reuters The Hill U.S. Department of State
Blinken Says U.S. Will Take Action on North Korea if China Doesn’t. U.S. Secretary of State Anthony Blinken on Friday warned that if China does not intervene to counter North Korea's nuclear and weapons development programs, then the U.S. will be forced to take action. Speaking at the Aspen Security Forum, Blinken said that while Washington wants Beijing’s help to denuclearize the Korean peninsula and reign in Pyongyang’s military programs, the U.S. will act on its own with “steps that aren’t directed at China but that China probably won’t like,” namely through the bolstering of both U.S. defenses and trilateral defense cooperation between with South Korea and Japan. China has criticized U.S. efforts to deepen military ties with Seoul and Tokyo, saying that they are aimed at monitoring and containing China’s military. Separately, the Group of Seven, EU and three other countries sent a letter to China’s UN Ambassador Zhang Jun urging Beijing to help stop North Korean sanctions evasion activities in China’s territorial waters, citing reported tankers in Sansha Bay which reportedly conduct illicit oil smuggling to support the trade of sanctioned petroleum products to North Korea. South China Morning Post Reuters
Western Europe
UK Foreign Secretary James Cleverly Delays Trip to Beijing. British Foreign Secretary James Cleverly has postponed a visit to Beijing planned for this month. Bloomberg reports that the cancellation was caused due to several factors, but mainly because of the disappearance of Chinese Foreign Minister Qin Gang, who has not been seen in public since June 25. Sources say London and Beijing are looking at alternative dates for Cleverly’s visit. His trip was intended to reduce tensions amid strained relations between China and Western countries. The UK foreign ministry did not comment on the matter. Reuters Bloomberg
Italian PM Says U.S. Has Not Raised Issue With Belt and Road Initiative. Italian Prime Minister Giorgia Meloni stated that U.S. President Joe Biden has never raised any issues in regard to her country being a part of China’s Belt and Road initiative (BRI). Italy is the only Western country to have joined the China-led global infrastructure scheme. Italy joined in 2019 under former Italian Prime Minister Giuseppe Conte, despite pushback from Washington and Brussels. Experts say Italy is highly unlikely to renew participation in the BRI when its participation deal expires early next year since it has not been productive for Italy, with exports to China totaling 16.4 billion euros last year from 13 billion euros in 2019. Reuters
EU President Hails Tunisia Migration Deal. European Union Commission President Ursula von der Leyen praised a new pact between the EU and Tunisia aimed at stemming illegal migration in the region, calling the deal a model for other countries and future agreements in the region geared towards addressing unauthorized flows of migrants across the Mediterranean into Europe. The EU and Tunisia last week signed their “strategic partnership” deal, which includes provisions to help crack down on human traffickers and tighten borders and boost economic aid to Tunisia. Reuters
Central and Eastern Europe
Russian Strikes on Odesa Kill One and Damage Historic Cathedral. Ukrainian officials report that a Russian missile attack on the Black Sea port of Odesa on killed one person, wounded 20 others, and caused severe damage to an historic UNESCO-listed Orthodox cathedral. Odesa governor Oleh Kiper said the attack destroyed six homes and apartment buildings, and Ukrainian President Volodymyr Zelensky added that nearly 50 buildings, 25 of them architectural monuments, were damaged, including the Greek consulate. Zelensky said the cathedral was hit by Kh-22 missile, which was designed in the Cold War to target American aircraft carriers. The Russian defense ministry said in a statement that it struck targets in Odesa "where terrorist attacks were being prepared," adding that all targets were destroyed. The ministry also denied assaulting the cathedral and blamed damage to the building on Ukrainian anti-aircraft missiles. Odesa’s military administration said that nine of the 19 missiles fired in the attack were intercepted by air defense systems. The strike on Odesa was the latest in series of attacks since Monday, when Russia withdrew from the Black Sea grain deal. Reuters CNN BBC Al Jazeera
Drone Fragments Found Near Russia's Defense Ministry Building in Moscow. The Russian Defense Ministry on Monday accused Ukraine of an attempted “terrorist” drone assault on Moscow, claiming that two Ukrainian drones hit buildings in the Russian capital, including one near the ministry’s headquarters. Moscow Mayor Sergei Sobyanin said that two non-residential buildings were struck in the alleged attack, and Russian state media reported that drone debris was discovered close to the defense ministry’s buildings on Komsomolsky Avenue in central Moscow. Photos show windows of a high-rise building in the area were blown out in the attack. Sobyanin said there was no "serious damage or casualties.” The defense ministry added that the drones "were suppressed and crashed" with radio-electronic equipment. It is unclear where the drones were intercepted and if the buildings they damaged were the intended targets. Kyiv has not commented on the situation. Reuters BBC CNN
Drone Assault on Crimean Ammunition Depot Closes Bridge, Forces Evacuation. A drone attack on an ammunition depot in Russian-occupied Crimea forced Moscow-installed officials to evacuate areas within three miles of the attack and briefly close the strategic Kerch Bridge on Saturday. The attack on the depot caused an explosion and reportedly injured 12 people. Ukraine said its army destroyed an oil depot and Russian warehouses in the central Crimean district of Oktiabrske, which Kyiv called “temporarily occupied.” The reported attack and temporary suspension of traffic on the Kerch Bridge came five days after an explosion on the bridge damaged a section of roadway. In response to the attack, Oleg Kryuchkov, an advisor to the Moscow-installed governor of Crimea, urged people not to post footage or images of critical infrastructure in Russian or Russian-occupied territory on the internet, saying that doing so “is work for the enemy.” Reuters Moscow Times
Putin Hosts Belarusian Leader Lukashenko, Calls Ukrainian Counter-Offensive a Failure. Russian President Vladimir Putin said Sunday that Ukraine’s counter-offensive is a failure as he hosted Belarus’s Alexander Lukashenko, his close ally, in St. Petersburg. Russian media quoted Lukashenko as saying, “There is no counteroffensive," to which Putin replied, “It exists, but it has failed." Lukashenko also reportedly joked that Wagner Group forces training Belarusian soldiers at a military base want to invade NATO member Poland, saying in jest that "the Wagner guys have started to stress us - they want to go west. 'Let's go on a trip to Warsaw and Rzeszow.’” Tensions between Poland and Russia continue to escalate, as Warsaw deployed security forces close to its east in response to the presence of Wagner mercenaries in Belarus. Putin in turn warned that any Polish provocation against Minsk would be seen as an attack on Moscow. Putin said he and Lukashenko are meeting through Monday to discuss security and other issues "in great detail and in depth.” Reuters Al Jazeera
Putin Calls Black Sea Grain Deal Meaningless. In an article published on the Kremlin’s website on Monday, Russian President Vladimir Putin said that the reason that Russia withdrew from the Black Sea grain deal is because the deal had “lost its meaning.” He said that Moscow left the deal, which ensured the safe export of Ukrainian grains, last week because its conditions to extend the deal had been ignored. Putin added reassurances that Russia will be able to provide substitutes for Ukrainian grain that is no longer guaranteed to be safely transported through the Black Sea, saying that Russia can provide grain “both commercially and free of charge” because the country is expecting a “record harvest this year.” Reuters
Asia and Oceania
UN Command, North Korea Talking About American Soldier. The UN Command has started talking with North Korea about Travis King, an American soldier who crossed into North Korea while on a civilian tour at the inter-Korean border. The deputy commander of the UN Command, British Army Lieutenant General Andrew Harrison, told reporters on Monday that conversations have started through a communication line established under the Korean War armistice agreement. Harrison said that “the private concern for us is Private King’s welfare” and did not elaborate further on discussions so far. King was reportedly set to face disciplinary action when he returned to the U.S. Reuters Wall Street Journal
U.S. Nuclear-Powered Submarine Arrives in South Korea. A U.S. nuclear-powered submarine, the USS Annapolis, arrived at a naval base on South Korea’s southern island of Jeju on Monday. The South Korean navy said the submarine docked at the base to load military supplies during an unspecified operational mission. The navy added that the U.S. and South Korean navies seek to “strengthen the combined defense posture” with the arrival of the submarine. The visit is the latest in a series of deployments of U.S. strategic assets to the region, including the port call by the U.S. ballistic missile submarine USS Kentucky in South Korea last Tuesday and earlier participation of B-52 bombers in joint drills with South Korea. Deutsche Welle Reuters
Top Chinese Diplomat Proposes High-Level Meeting Between China, Japan, South Korea. China’s top diplomat Wang Yi has reportedly proposed talks between the leaders of China, Japan, and South Korea. Japanese media reports that Wang made the proposal while meeting with his Japanese counterpart on the sidelines of an ASEAN summit in Indonesia earlier this month. Sources said that Tokyo is seeking to hold the trilateral talks by the end of the year. The meeting would signal intentions for greater dialogue between the three East Asian countries, despite tensions over issues like Japan’s plans to release treated radioactive water from the destroyed Fukushima nuclear power plant. The Japanese and Chinese foreign ministries did not respond to requests for comment on the matter. Japan Times Reuters
Australia Buying 20 Hercules Military Transport Planes. Australia said on Monday that it is buying 20 new Super Hercules military transport aircraft for A$9.8 billion ($6.6 billion). Australian Defense Minister Richard Marles said the planes will help replace Australia’s aging fleet and that the first Hercules aircraft are expected to be delivered by 2027. The U.S. State Department approved the potential sale of the planes in November. Reports on the deal come amid the biennial joint Australian-U.S. Talisman Sabre war games. Reuters
Cambodian Ruling Party Claims Landslide Election Victory. Cambodian Prime Minister Hun Sen claimed a landslide victory in Sunday’s general election, touting on his Telegram that his Cambodian People’s Party has won 120 of 125 parliamentary seats. The EU, U.S. and other Western countries claim that the elections lacked conditions to be considered free and fair. China, Russia, and Guinea-Bissau sent representatives to observe the election. Experts say that Prime Minister Hun Sen may be planning a transition of power to his eldest son, Hun Manet, as early as the first month after the elections. Associated Press Reuters
Middle East and Northern Africa
Israel Passes Controversial Judicial Reform Law. The Israeli parliament on Monday voted to pass the first major bill of a judicial reform plan that will limit the power of Israel’s judiciary. The measure prevents the courts from reviewing the reasonableness of government decisions. Last minute efforts in the Knesset to find a compromise failed to stop Israeli Prime Minister Benjamin Netanyahu’s ruling far-right government from approving the legislation. Thousands continue to protest the judicial overhaul. Al Jazeera Times of Israel
Denmark Koran Burning Prompts Attempted Storming of Baghdad’s Green Zone. Demonstrators burned a copy of the Koran in front of the Iraqi embassy in the Danish capital of Copenhagen on Monday. The incident came after nearly 1,000 protesters in Baghdad attempted to storm the Iraqi capital’s Green Zone on Saturday in response to earlier demonstrations in Denmark and Sweden that also included Koran burnings. Iraqi security forces were able to push back protestors, preventing them from reaching the Danish embassy. However, separate protesters were able to set fire to the headquarters of the humanitarian organization Danish Refugee Council in the Basra governorate of Iraq. The Iraqi government called on Western countries to stop allowing acts of “incitement and hate practices,” while also warning Iraqis against being drawn into a “plot of sedition” to show the country is not safe for foreign missions. Monday’s demonstration is set to further inflame tensions. German Defense Minister Boris Pistorius on Sunday canceled a planned trip to Jordan and Iraq over the unrest caused by the Koran burnings. Al Jazeera Associated Press NPR Reuters
Sub Saharan Africa
Mogadishu Suicide Bombing Kills 13 Soldiers. A suicide bombing at a military academy in the Somalian capital of Mogadishu killed at least 13 soldiers and injured at least 20 others on Monday. The al Qaeda-linked al Shabaab militant group claimed responsibility for the attack. Somalia and allied militiamen forced al Shabaab out of areas in southern Somalia, but the militant group continue to conduct raids and attacks. Reuters
Cyber and Tech
Clop Estimated To Rake In $75-100 Million from MOVEit Ransom Payments. The massive Clop ransomware campaign against the MOVEit file transfer tool is estimated to generate $75-100 million in ransom payments. The Coveware cybersecurity firm has reported that ransom payoffs have dropped to 34 percent, a record low that has forced ransomware gangs to modify strategies. According to Coveware’s analysis, more complicated and time-consuming attacks generate far greater ransom demands, usually in the millions, because of the high impacts on targets. The firm’s security researchers believe Clop has changed its extortion strategy by demanding far more significant ransom demands than previously seen in data exfiltration attacks, hoping that a few large payments will overcome the overall decline in payoffs from victims. Coveware assesses that relatively few of Clop’s MOVEit targets will pay ransoms, but those that do will result in substantial payoffs for the gang. Coveware CEO Bill Siegel told BleepingComputer that Clop has achieved a much higher rate of success with the MOVEit campaign than the preceding “GoAnywhere” data theft operations which resulted in “only a few ransom payments.” This is in contrast to Clop’s 2021’s Accellion FTA data-theft campaign that was successful because victims were not as well educated on the pros and cons of paying to prevent data leaks. Siegel noted that currently "victims are much better educated on the pros and cons of these situations (with the cons very clearly outweighing the pros in most situations)." The MOVEit attacks, Siegel said, had at least 10 times more direct targets than both the GoAnywhere and Accellion attacks. Consequently, "CloP was able to focus on just the very largest and most likely to consider paying, even with well over 90 percent of victims not even bothering to engage in a negotiation, let alone paying." BleepingComputer
Post-Attack Analysis of Microsoft Email Service Points to Possible Broader Breach. The recent breach of Microsoft Outlook email accounts by China-linked hackers could have resulted in access to additional Microsoft services, including Teams and OneDrive, according to the Wiz cloud security firm. Wiz researchers say the compromised key that allowed access to multiple government and other organizations’ emails could be used to create access tokens to other Microsoft platforms since, as Wiz chief technology officer Ami Luttwak explained, “all of Microsoft, all of Microsoft Office 365, all of Azure relies on authentication tokens.” Hacking expert Jake Williams, who teaches at Boston’s Institute for Applied Network Security, said that Wiz’s analysis of where the compromised key could grant access “looks very technically solid. The research highlights that the scope of the compromised key is far broader than originally reported.” A Microsoft spokesperson told WIRED that “many of the claims made in this blog are speculative and not evidence based.” The Wiz report noted that while the Microsoft attack appears to have broader implications than first thought, “this isn't a Microsoft-specific issue—if a signing key for Google, Facebook, Okta, or any other major identity provider leaks, the implications are hard to comprehend.” Zane Bond, head of product for Keeper Security, noted that “the cloud is a double-edged sword and this event highlights some of both the advantages and disadvantages. He said that while cloud services providers most of the time can detect intrusions and protect customers, “a single breach can lead to multiple organizations being compromised, and the threat actor can pick and choose the most valuable targets and data once they are in.” Wired The Record
German Study, Experts Find Serious Vulnerabilities in Satellite, Space Systems. A German research study underscores the multiple vulnerabilities in the systems that operate the vast but delicate web of orbiting satellites. According to researchers from the Ruhr University Bochum and the CISPA Helmholtz Center for Information Security, satellite firmware flaws show that “little security research from the last decade has reached the space domain.” Communications links with some satellite systems lack encryption, which leads the researchers to propose a theoretical possibility that a threat actor could gain control of a satellite and cause a collision with other objects. The research team lamented the lack of cooperation in their study by most satellite system operators. Of the three systems that participated, researchers said six kinds of security vulnerabilities were discovered across all three satellites, and a total of 13 vulnerabilities. Team leader Johannes Willbold of Ruhr University said satellite operators on the ground “oftentimes lack access protection in the first place. They’re essentially not checking anything.” Juliana Suess, a research analyst with the Royal United Services Institute, noted that in addition to software and firmware vulnerabilities, jamming and spoofing can interfere with satellite communications traffic. “You don't need to be a space power to do it,” she said. Gregory Falco, an assistant professor at Cornell University who focuses on space cybersecurity, echoes some of the concerns of the German study. He said space firmware and software development is a “nightmare” because legacy software is often used in development and is rarely updated. A second reason is that “space systems are not built by software developers. They are built by aerospace engineers, for the most part.” Falco’s thoughts extend beyond satellites to the rapid growth of the commercial space sector and the companies that are driving that growth: “They absolutely are not prioritizing security,” Falco says. “They probably don’t have any people who know anything about it on their staff.” Wired
Read deeply-experienced, expert-driven national security news, analysis and opinion inThe Cipher Brief
