[rebelmouse-image 60323897 expand=1 dam=1 alt="OSR Full Logo Header 2.0" site_id=26883708 is_animated_gif="false" original_size="500x200" crop_info="%7B%22image%22%3A%20%22https%3A//assets.rbl.ms/60323897/origin.png%22%2C%20%22thumbnails%22%3A%20%7B%22origin%22%3A%20%22https%3A//assets.rbl.ms/60323897/origin.png%22%2C%20%22300x%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg5Ny9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTc3NjU3MDYxMX0.ArCiKF74VYJw-LAnvo3nzjJsGsjrz-Fcx0h5SaMLFd0/image.png%3Fwidth%3D300%22%2C%20%221000x750%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg5Ny9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTc3NjU3MDYxMX0.ArCiKF74VYJw-LAnvo3nzjJsGsjrz-Fcx0h5SaMLFd0/image.png%3Fwidth%3D1000%26height%3D750%26coordinates%3D116%252C0%252C117%252C0%22%2C%20%22600x600%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg5Ny9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTc3NjU3MDYxMX0.ArCiKF74VYJw-LAnvo3nzjJsGsjrz-Fcx0h5SaMLFd0/image.png%3Fwidth%3D600%26height%3D600%26coordinates%3D150%252C0%252C150%252C0%22%2C%20%222000x1500%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg5Ny9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTc3NjU3MDYxMX0.ArCiKF74VYJw-LAnvo3nzjJsGsjrz-Fcx0h5SaMLFd0/image.png%3Fwidth%3D2000%26height%3D1500%26coordinates%3D116%252C0%252C117%252C0%22%2C%20%221200x400%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg5Ny9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTc3NjU3MDYxMX0.ArCiKF74VYJw-LAnvo3nzjJsGsjrz-Fcx0h5SaMLFd0/image.png%3Fwidth%3D1200%26height%3D400%26coordinates%3D0%252C17%252C0%252C17%22%2C%20%22600x200%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg5Ny9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTc3NjU3MDYxMX0.ArCiKF74VYJw-LAnvo3nzjJsGsjrz-Fcx0h5SaMLFd0/image.png%3Fwidth%3D600%26height%3D200%26coordinates%3D0%252C17%252C0%252C17%22%2C%20%22750x1000%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg5Ny9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTc3NjU3MDYxMX0.ArCiKF74VYJw-LAnvo3nzjJsGsjrz-Fcx0h5SaMLFd0/image.png%3Fwidth%3D750%26height%3D1000%26coordinates%3D175%252C0%252C175%252C0%22%2C%20%221500x2000%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg5Ny9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTc3NjU3MDYxMX0.ArCiKF74VYJw-LAnvo3nzjJsGsjrz-Fcx0h5SaMLFd0/image.png%3Fwidth%3D1500%26height%3D2000%26coordinates%3D175%252C0%252C175%252C0%22%2C%20%221245x700%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg5Ny9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTc3NjU3MDYxMX0.ArCiKF74VYJw-LAnvo3nzjJsGsjrz-Fcx0h5SaMLFd0/image.png%3Fwidth%3D1245%26height%3D700%26coordinates%3D72%252C0%252C72%252C0%22%2C%20%22600x400%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg5Ny9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTc3NjU3MDYxMX0.ArCiKF74VYJw-LAnvo3nzjJsGsjrz-Fcx0h5SaMLFd0/image.png%3Fwidth%3D600%26height%3D400%26coordinates%3D100%252C0%252C100%252C0%22%2C%20%221200x800%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg5Ny9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTc3NjU3MDYxMX0.ArCiKF74VYJw-LAnvo3nzjJsGsjrz-Fcx0h5SaMLFd0/image.png%3Fwidth%3D1200%26height%3D800%26coordinates%3D100%252C0%252C100%252C0%22%2C%20%221200x600%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg5Ny9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTc3NjU3MDYxMX0.ArCiKF74VYJw-LAnvo3nzjJsGsjrz-Fcx0h5SaMLFd0/image.png%3Fwidth%3D1200%26height%3D600%26coordinates%3D50%252C0%252C50%252C0%22%2C%20%22700x1245%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg5Ny9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTc3NjU3MDYxMX0.ArCiKF74VYJw-LAnvo3nzjJsGsjrz-Fcx0h5SaMLFd0/image.png%3Fwidth%3D700%26height%3D1245%26coordinates%3D193%252C0%252C194%252C0%22%2C%20%2235x35%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg5Ny9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTc3NjU3MDYxMX0.ArCiKF74VYJw-LAnvo3nzjJsGsjrz-Fcx0h5SaMLFd0/image.png%3Fwidth%3D35%26height%3D35%22%2C%20%22600x%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg5Ny9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTc3NjU3MDYxMX0.ArCiKF74VYJw-LAnvo3nzjJsGsjrz-Fcx0h5SaMLFd0/image.png%3Fwidth%3D600%22%2C%20%22300x300%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg5Ny9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTc3NjU3MDYxMX0.ArCiKF74VYJw-LAnvo3nzjJsGsjrz-Fcx0h5SaMLFd0/image.png%3Fwidth%3D300%26height%3D300%26coordinates%3D150%252C0%252C150%252C0%22%2C%20%22600x300%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg5Ny9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTc3NjU3MDYxMX0.ArCiKF74VYJw-LAnvo3nzjJsGsjrz-Fcx0h5SaMLFd0/image.png%3Fwidth%3D600%26height%3D300%26coordinates%3D50%252C0%252C50%252C0%22%2C%20%22980x%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg5Ny9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTc3NjU3MDYxMX0.ArCiKF74VYJw-LAnvo3nzjJsGsjrz-Fcx0h5SaMLFd0/image.png%3Fwidth%3D980%22%2C%20%22210x%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg5Ny9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTc3NjU3MDYxMX0.ArCiKF74VYJw-LAnvo3nzjJsGsjrz-Fcx0h5SaMLFd0/image.png%3Fwidth%3D210%22%7D%2C%20%22manual_image_crops%22%3A%20%7B%229x16%22%3A%20%7B%22sizes%22%3A%20%5B%22700x1245%22%5D%2C%20%22top%22%3A%200%2C%20%22height%22%3A%20200%2C%20%22width%22%3A%20113%2C%20%22left%22%3A%20193%7D%2C%20%22600x300%22%3A%20%7B%22sizes%22%3A%20%5B%22600x300%22%5D%2C%20%22top%22%3A%200%2C%20%22height%22%3A%20200%2C%20%22width%22%3A%20400%2C%20%22left%22%3A%2050%7D%2C%20%223x1%22%3A%20%7B%22sizes%22%3A%20%5B%221200x400%22%2C%20%22600x200%22%5D%2C%20%22top%22%3A%2017%2C%20%22height%22%3A%20166%2C%20%22width%22%3A%20500%2C%20%22left%22%3A%200%7D%2C%20%223x2%22%3A%20%7B%22sizes%22%3A%20%5B%221200x800%22%2C%20%22600x400%22%5D%2C%20%22top%22%3A%200%2C%20%22height%22%3A%20200%2C%20%22width%22%3A%20300%2C%20%22left%22%3A%20100%7D%2C%20%221x1%22%3A%20%7B%22sizes%22%3A%20%5B%22600x600%22%2C%20%22300x300%22%5D%2C%20%22top%22%3A%200%2C%20%22height%22%3A%20200%2C%20%22width%22%3A%20200%2C%20%22left%22%3A%20150%7D%2C%20%223x4%22%3A%20%7B%22sizes%22%3A%20%5B%221500x2000%22%2C%20%22750x1000%22%5D%2C%20%22top%22%3A%200%2C%20%22height%22%3A%20200%2C%20%22width%22%3A%20150%2C%20%22left%22%3A%20175%7D%2C%20%2216x9%22%3A%20%7B%22sizes%22%3A%20%5B%221245x700%22%5D%2C%20%22top%22%3A%200%2C%20%22height%22%3A%20200%2C%20%22width%22%3A%20356%2C%20%22left%22%3A%2072%7D%2C%20%224x3%22%3A%20%7B%22sizes%22%3A%20%5B%222000x1500%22%2C%20%221000x750%22%5D%2C%20%22top%22%3A%200%2C%20%22height%22%3A%20200%2C%20%22width%22%3A%20267%2C%20%22left%22%3A%20116%7D%2C%20%222x1%22%3A%20%7B%22sizes%22%3A%20%5B%221200x600%22%2C%20%22600x300%22%5D%2C%20%22top%22%3A%200%2C%20%22height%22%3A%20200%2C%20%22width%22%3A%20400%2C%20%22left%22%3A%2050%7D%7D%7D" caption="" photo_credit="" title=""]

10:00 AM ET, Tuesday, November 28, 2023

The Cipher Brief curates open source information from around the world that impacts national security. Here's a look at today's headlines:  

THE TOP STORIES

North Korea’s Kim Received Photos from Spy Satellite. North Korean leader Kim Jong Un has reportedly received satellite images of the United States following the successful launch of North Korea’s first reconnaissance satellite.  The mission which North Korea claims was successful reportedly put the satellite, designed to monitor U.S. and South Korean military movements, into orbit last week. Satellite images allegedly included the White House, Pentagon, Andersen Air Force Base in the U.S. territory of Guam, and U.S. naval base in Norfolk, Virginia. Pyongyang hasn’t yet released any images as proof of their claims, but analysts say that if the launch was indeed successful, that there is no reason to doubt the capability of the satellite.  The U.S. and South Korea have condemned this satellite launch as a violation of United Nations Security Council resolutions.  Reuters Bloomberg  

Ukrainian Spy Chief’s Wife Reportedly Poisoned.  A spokesperson for Ukraine’s military intelligence agency GUR said on Tuesday that Marianna Budanova, the wife of GUR Chief, General Kyrylo Budanov, has been poisoned with heavy metals and is undergoing medical treatment at a hospital.  If the poisoning is confirmed as deliberate, it would be the most serious targeting of a Ukrainian leadership figure’s family member. The agency and media outlets did not make suggestions as to who was behind the attacks or say when they occurred. One outlet cited a source as saying that the poison had likely been administered to Budanova’s food and that other members of GUR had also been poisoned.  The GUR has been predominantly involved in clandestine operations against Russian forces throughout the Ukraine war.  Reuters BBC

Blinken to Visit Israel and West Bank, Attend COP28 Summit in Dubai.  The U.S. State Department announced that Secretary of State Antony Blinken will visit Israel and the West Bank and will attend the COP28 summit in Dubai. He is set to discuss the future of Gaza and support for an independent Palestinian state during his trip. The department added that Blinken will also emphasize the need to maintain the flow of humanitarian assistance to Gaza, improve protections for civilians there, and secure the release of all hostages. Blinken is also set to attend a meeting of the Organization for Security and Cooperation in Europe, to be held in Skopje, North Macedonia.  Bloomberg 

ISRAEL AND HAMAS WAR

Israel, Hamas Extend Ceasefire by Two Days.  Qatar announced that Israel and Hamas have agreed to extend the ceasefire in Gaza for two days.  The head of Egypt’s State Information Service, Diaa Rashwan, later said that as part of the extension agreement Hamas will release 20 more hostages over the next two days in exchange for the freeing of 60 Palestinians held in Israeli prisons.  Multiple media reports say that both sides are observing the extension of the ceasefire.  Hamas official Khalil Al-Hayya claimed on Monday that the militant group is “seeking a new agreement” to release “other categories” of hostages, suggesting openness to release Israeli men being held hostage.  Israeli security cabinet minister Gideon Saar confirmed on Army Radio that the ceasefire was extended, and that Israel is willing to further extend it if more hostages are released, but vowed “renewed” fighting once hostage releases stop.  Hamas has released 69 hostages, including both Israelis and non-Israelis, since Friday.  Israel has released over 100 Palestinian prisoners from Israeli jails in the exchange.  Reuters Wall Street Journal CNN NPR

U.S. Cautions Israel to Limit Civilian Displacement in Renewed Military Action in Southern Gaza.  Senior U.S. officials say the Biden administration has told Israel it must try to avoid “significant further displacement” of Palestinians in southern Gaza if it renews its ground campaign there. The officials reportedly told Israel that it must conduct operations in southern Gaza with more precision than it did in the north to avoid a repeat of large-scale civilian casualties and mass displacement.  The administration also has told the Israelis that it expects military operations to be conducted in a way that will be “maximally de-conflicted” with humanitarian aid operations, U.N.-supported shelters, and core infrastructure including electricity and water.  The officials noted that the Israelis have been receptive when Washington has raised such concerns.  The officials added that the U.S. on Tuesday will send the first of three American military humanitarian aid flights to northern Egypt carrying medical supplies, food, and winter items to be delivered to Gazans by the U.N. U.S. officials believe approximately 2 million Palestinians are now in south and central Gaza.  Associated Press 

Qatar is Key Mediator Amid Renewed Middle East Tensions.  Qatar is playing a major role as a mediator in the Hamas-Israeli conflict. Yoel Guzansky, a senior fellow at the Institute for National Security Studies in Tel Aviv, says the presence of Qataris in Israel is something that has not been seen before. He added that Qatar is the only country in the world with “that much leverage on Hamas” because of its years of support for the organization. Qatar says Hamas’ political office in Doha was created at the request of U.S. officials seeking to establish a channel of communications.  Qatar also has close ties to the U.S. and has communicated with Israel since 1995, making it uniquely positioned for its role as mediator. Qatari mediation helped extend the cease-fire agreement now in place until Wednesday. Qatari Foreign Ministry spokesperson Majed al-Ansari, noting that hostages are being released and there are pauses in the fighting, said “we might be able to find a solution” to the conflict.  Associated Press 

THE UKRAINE UPDATE

Ukraine says Russian Forces Escalating Offensive on Avdiivka.  Vitaliy Barabash, chief of the Avdiivka military administration, said on Monday that Russian forces are intensifying offensives against the eastern Ukrainian town and are attempting to make advancements on all sides with air and land-based assaults.  Barabash said that the situation in and around Avdiivka has “become even tougher,” with Moscow increasing “the intensity of clashes” and opening “two more sectors” with the goal of storming Avdiivka “from all directions." Officials say that most of the battles have been centered on the city’s coking plant and industrial zone. Earlier, Barabash asserted that Kyiv had managed to repel Russian soldiers near a rail line in Stepove, a village located northwest of Avdiivka. Oleksandr Shtupun, a Ukrainian military spokesperson, added that high winds and winter weather were impacting the use of drones for both sides. He also said that Ukraine’s “defenders are holding their ground” and that Russian forces are suffering steep losses close to Avdiivka and at the nearby settlement of Maryinka.  Reuters

U.K. Reports that Russia Suffers High Casualties in Ukraine Over Past Six Weeks.  The U.K. Defense Ministry reports that Russian troops in Ukraine have suffered “some of the highest '' casualties in the past six weeks.  The ministry cited data from the Ukrainian Armed Forces general staff, saying Russia’s average daily losses could be as high as 931 troops. This number possibly combines both those killed and injured in recent weeks. If true, these figures would make November the deadliest month for Russian forces this year.  The ministry added that most Russian casualties are reportedly due to Russian offensive operations in the Donetsk region.  UK Defense Ministry X  Kyiv Independent Ukrinform 

Top E.U. Official Hails Ukraine’s Anti-Corruption Efforts But Says More Work Needed for E.U. Membership.  The European Commission’s Vice President Vera Jourova praised Ukraine’s anti-corruption efforts, but stated there is still additional work that needs to be done before Ukraine can join the E.U. Jourova said that Ukraine’s anti-corruption progress so far has demonstrated that “Ukrainians are fed up with old Ukraine” and want to see the prosecution of “organized crime corruption at all levels.”  However, she said there are still areas for improvement, such as legislation on lobbying.  Meanwhile, Ukrainian President Volodymyr Zelensky told European Commission President Ursula von der Leyen that Ukraine will fulfill all E.U. recommendations on anti-corruption before December, such as pledges on minority rights and the strengthening of anti-corruption bodies.  Reuters

Russian Forces Shell Sumy Region, Strike Four Communities.  The local military administration of Sumy Oblast reported on Monday that Russia shelled four communities in the region, attacking the settlements at least 45 times over 24 hours. Khotin, Krasnopillia, Nova Sloboda, and Velyka Pysarivka were targeted with intense mortar shelling, though officials did not report any casualties or damage to civilian infrastructure. The settlement of Khotin, which is located around 26 kilometers west and 10 kilometers south of the border shared between Russia and Ukraine, was struck with at least 22 explosions. Shelling continues to be a daily event for communities close to the border. Kyiv Independent Ukrinform

Putin Boosts Military Spending in Russia’s Budget.  Russian President Vladimir Putin on Monday formally approved and signed Russia’s national budget for the next three years, increasing spending by about 25%. The budget plans for spending next year to reach 36.6 trillion rubles ($415 billion), with an expected deficit of 1.595 trillion rubles ($9.5 billion).  Around 30% of the budget is directed towards the armed forces, with around 40% of spending on defense and security combined.  This marks an increase on defense spending by nearly 70% in 2024 from 2023. Russian House Speaker Vyacheslav Volodin said that the budget was developed specifically to finance Russia’s military and to alleviate pressures from international sanctions, which were imposed after Moscow’s invasion of Ukraine.  Associated Press Reuters RFE/RL

Chechen Leader says Ready to Deploy 3,000 More Fighters to Ukraine.  Chechen leader Ramzan Kadyrov said on Monday that Chechnya is prepared to send an additional 3,000 fighters to Ukraine as part of new Russian Defense Ministry and Russian National Guard forces. He added that his fighters are highly combative and very motivated to achieve results. In May, Kadryov said that Chechnya had sent more than 26,000 fighters to Ukraine, with 12,000 of them being volunteers. His claims could not be verified and estimates for Chechen fighters in Ukraine vary. There have also been several groups of Chechen fighters fighting on the side of Ukraine since the war began in February of 2022. Kadyrov, who has described himself as Russian President Vladimir Putin’s “foot soldier,” has said that the war in Ukraine is necessary to rebuff Western aggression.  Reuters

Winter Storms in Black Sea, Southern Ukraine Damage Infrastructure, Slow Fighting.  Intense winter storms have struck Eastern Europe, severely impacting Ukraine, Russia, and Moldova.  A cyclone in the Black Sea and southern Ukraine has damaged civilian and transportation infrastructure in coastal southern Russia and occupied Ukraine.  Hundreds of towns and villages in occupied Crimea, occupied areas of the Kherson region, and the Odesa region have been left with electricity.  Rail lines in coastal areas are also reportedly damaged, which could impact logistics for Russian forces in Crimea and southern Ukraine.  The Ukrainian Navy and Ukraine’s Southern Operational Command said that the weather in the Black Sea has forced Russia to return all naval vessels to their base points.  A Russian military blogger said that there will be heightened threats from mines that have been dispersed in the storm in the northwestern Black Sea.  Fighting throughout Ukraine is continuing despite the weather, though at a slower pace due to reduced visibility and difficulties in deploying drones and artillery correction.  Russian milbloggers say that Ukrainian troops have taken advantage of the low visibility conditions to consolidate positions on the eastern bank of the Dnipro River.  Oleksandr Shtupun, spokesperson for Ukraine’s Tavriisk Group of Forces, said that Russian forces from Avdiivka through the western Zaporizhzhia region have reduced artillery and drone attacks because of the weather, but continue to launch air attacks in the Avdiivka direction.  ISW Reuters BBC France 24 Associated Press 

THE CYBER AND TECH RUNDOWN

NY Times Reports Sensitive U.S. Conversations Over Emirati AI Firm Ties to China.  In a series of interactions between Biden administration officials and counterparts from the United Arab Emirates (UAE), a delicate issue has been raised concerning G42, the AI firm controlled by Sheikh Tahnoon bin Zayed, the UAE national security adviser.  G42 has secured multimillion dollar deals with Silicon Valley and European pharmaceutical companies and last month announced a partnership with OpenAI.  However, U.S. intelligence has raised questions about G42’s ties with Chinese technology firms like Huawei and others under U.S. sanctions.  U.S. officials are concerned that G42 could be a pathway through which advanced U.S. technology could be redirected to Chinese firms or government departments.  The intelligence community also has warned that G42 could funnel genetic data about U.S. citizens to Chinese government entities.  U.S. officials have declined to discuss their contacts with the UAE on the G42 matter, which have taken place over months in Washington and Abu Dhabi, and have included CIA Director William Burns and Commerce Secretary Gina Raimondo during different trips this year.  New York Times

Group Targeting Israeli Organizations Shows Advanced Capabilities, Tradecraft.  A little-known threat actor named “WildCard” has been observed deploying very sophisticated techniques in cyberattacks against Israeli targets.   According to Nicole Fishbein, an Intezer researcher, in the context of cyber operations following Hamas’ October assault on Israel, WildCard has distinguished itself through its advanced tradecraft and capabilities.  Several years ago, WildCard was linked to a months-long campaign against the Israel Electric Corporation, the country’s largest electrical supplier.  In January 2022, Intezer observed malware called “SysJoker” that impressed the researchers by its quality development, which Fishbein explained is “highly unusual for threat actors in the Middle East scene, especially the kinds of actors we normally see attacking Israel.”  But Intezer revealed Monday that over the course of 2022 and 2023 WildCard deployed a new strain similar to SysJoker along with a version in the Rust programming language, which experts say is more efficient, can be deployed across platforms, and is designed to avoid detection.  Fishbein said that these findings demonstrate that the group has “pushed these development capabilities even further, adopting Rust as their new programming language, and re-implementing previously reported functionalities.”  CyberScoop

Global Power Grid Cyberattacks Doubled Last Year; Europe Struggles with Defenses.  A recent International Energy Agency report has raised an alarm about the doubling of weekly cyberattacks against power utilities around the world from 2020 to 2022.  The tally of attempted intrusions against power facilities in 2022 exceeded 1,000 each week, with the IEA report noting that power utilities, in particular, “are favored targets for malicious cyber activity.”  The report also pointed out the utilities in EU countries were unprepared for the surge in activity following Russia’s invasion of Ukraine.  Leonhard Birnbaum, the chief executive of E.ON, one of Europe’s largest utilities, told Politico that “the crooks are becoming better by the day, so we need to become better by the day,“ adding “I'm worried now and I will be even more worried in the future.”  Ireneusz Zyska, Poland’s deputy energy minister, also commented on a recent visit to Poland’s grid operations hub, where he witnessed “thousands of attacks on our energy grid taking place live.”  Zyska noted that the bulk of attacks originate in Russia and its allies which, he said, “have created special teams of people working on attacking the democratic states of the European Union cybernetically to cause havoc.”  Europe’s ENISA cybersecurity agency recently reported that the energy sector lags other critical infrastructure like transport, healthcare, and banking in cybersecurity investments.  The EU earlier this year issued its NIS2 Directivescheduled to be implemented in October 2024 that imposes new cybersecurity requirements on critical sector companies including the energy sector.  Europe also has established information-sharing networks involving private and public cybersecurity services in key sectors to improve cooperation between countries on large-scale digital assaults.  Politico Cybernews

Ukraine Acknowledges Successful Cyber Breach of Russian Civil Aviation Agency.  Ukraine’s defense intelligence department conducted a successful hack of systems operated by Russia’s civil aviation agency, Rosaviatsia.  According to the Main Directorate of Intelligence of Ukraine’s Ministry of Defense, the hack resulted in the acquisition of “a large volume of confidential documents” covering a year-and-a-half period.  Notably, the directorate says its analysis of leaked documents indicates that the civil aviation sector of Russia "is on the verge of collapse."   The directorate said trends in Russian civil aviation indicate “Russia is in a zone of serious turbulence with a high risk of a steep dive. This reality is a direct consequence of the sanctions, the most painful of which for the aggressor state of Russia was the imposed ban on the supply of aircraft and spare parts.”  Reportedly, this is the first time a Ukrainian government agency has taken responsibility for a cyber operation targeting Russia.    No information on the timing or technical details of the breach was given although the Ukrainian agency published screenshots of several extracted documents and descriptions of what it learned from them. The Record Cybernews

UK Chip Firm Slashes Staff, Operations in China Following New U.S. Export Controls.  Citing new U.S. restrictions on chip-related exports, the British semiconductor firm Graphcore will no longer sell its products in China and is dramatically reducing staff there.  Described as “struggling,” Graphcore at one point was described as a rival to industry leader Nvidia.  A company spokesperson told the South China Morning Postthat the scaling back of business operations was made necessary as all of its top-line products were impacted by the new export curbs.  The spokesperson added that elsewhere the company will continue to work with customers “to meet their demand for a powerful, cost-effective alternative to GPUs.”  South China Morning Post

Ardent Healthcare Network Facilities Experience Network Disruptions.  Network outages are impacting several U.S. hospital systems associated with the Ardent Health Services (AHS) healthcare provider.  Over the weekend, six facilities reported system disruptions, including the BSA Health Systems in Amarillo, Texas, which was forced to divert emergencies to nearby hospitals.  AHS-affiliated facilities in Kansas, Idaho, New Mexico, and New Jersey reported outages.  AHS said Monday that a ransomware attack caused the disruption and that its facilities were “diverting some emergency room patients to other area hospitals until systems are back online.”  CISA contacted AHS the day before Thanksgiving with a warning about malicious cyber activity affecting its computer systems.  The company acknowledged the warning, saying the agency reached out “to make us aware of information about suspicious activity in our system.”  Cybernews BleepingComputer CNN

CISA Director Warns of Threat from Rapid Development of AI.  CISA Director Jen Easterly on Monday warned that the potential threats from the rapid development of artificial intelligence (AI) mean that safeguards need to be built into new AI products before release.  She said that most technology products “come off the line full of vulnerabilities” which consumers are “expected to patch” afterwards.  Easterly asserted that this cannot continue with AI as the new technology is “too powerful” and “moving too fast.”  Her comments came as agencies from 18 countries, including the U.S., endorsed new British-developed guidelines on AI cybersecurity that deal with the design, development, and maintenance of the technology.  Reuters

E.U. Cyber Team Warns of ‘High’ Threat Level from Russian Hacking Group.  The European Union’s (E.U.) cyber emergency response team warns that the Russian intelligence-affiliated hacking group Fancy Bear is targeting European governments. At least seven European governments have been targeted by the hacking group’s phishing campaigns known to target government systems and critical industry organizations. Fancy Bear has been sanctioned by E.U. authorities for the 2015 hack of the German Bundestag and is said by the U.S. to have been behind the 2016 hacks of the Democratic National Committee. The Cyber Emergency Response Team for the EU (CERT-EU) asserts that the threat level posed by the group’s activity is “high.” This warning increases already growing concern that next year’s European election will be targeted by countries such as Russia and China that have a history of committing cyberattacks to disrupt E.U. domestic politics.  Politico

Slovenia’s Biggest Power Utility Hit by Cyberattack. The technology team at HSE, Slovenia’s largest power utility, reported an attempted cyberattack by unidentified individuals spanning multiple days last week. Beginning last Wednesday and worsening through Friday, the utility reported a “crypto-virus” that locked staff out of networks and encrypted files. The hackers reportedly penetrated control systems all the way down to facility fire alarms. The Slovenian Information Security Office reported that the attack caused no major damage to operating systems and Director Uroš Svete told reporters on Sunday that the situation is “under control.”  Fears still persist, though, as HSE plants account for around 60% of Slovenian energy production and little is known about what information was collected in the breach.  CyberNews

ELSEWHERE IN THE WORLD

Asia and Oceania

South Korea Delays Spy Satellite Launch.  South Korea has postponed its scheduled launch of a surveillance satellite, originally set for today, days after North Korea is thought to have successfully launched its own spy satellite. South Korea is expected to launch five spy satellites by 2025 in collaboration with SpaceX. The first launch using SpaceX’s Falcon 9 rocket was scheduled to take place at Vandenberg Air Force Base in California.  South Korea’s Defense Ministry said that the launch was delayed due to weather conditions and that it would be tentatively rescheduled for this Saturday.  South Korea currently has no reconnaissance satellites of its own in orbit and is partially reliant on U.S. satellites to monitor North Korea.  Associated Press

North Korea, US Envoys Clash in Rare Public Engagement at U.N.   In a rare, direct public exchange, the U.N. ambassadors of the U.S. and North Korea sparred at a U.N. Security Council meeting on Monday. At the end of the  meeting, U.S. Ambassador Linda Thomas-Greenfield and North Korean Ambassador Kim Song made unscheduled remarks arguing that their respective countries are acting defensively. Kim told the council that “one belligerent party, the United States, is threatening us with a nuclear weapon” and that Pyongyang therefore has a right to develop nuclear and missile capabilities in response.  Since 2006, North Korea has been under U.N. sanctions for its ballistic missile and nuclear programs. Thomas-Greenfield said in response that the U.S. strongly rejects the “disingenuous” claim that Pyongyang’s missile launches are defensive in nature and reiterated concerns that North Korea is prepared to carry out its seventh nuclear test. For the past several years, the Security Council has been divided on how to handle North Korea.  Russia and China have said that more sanctions will not help and have argued that joint U.S.-South Korean military drills provoke Pyongyang.  Washington has accused Beijing and Moscow of emboldening the North and shielding it from sanctions.  Reuters

Europe

Russian Court Extends Detention of Gershkovich.  A Russian court said Tuesday that it is extending the pre-trial detention of Wall Street Journal reporter Evan Gershkovich. The ruling extends Gershkovich’s total detention for up to 10 months or until January 30, 2024. Gershkovich was detained by the Federal Security Service (FSB) on March 29 in the city of Yekaterinburg on espionage charges that carry up to a 20 year sentence.  He denies all charges.  Both the Wall Street Journal and U.S. government have denounced Gershkovich’s imprisonment and called for his return. The U.S. embassy in Moscow said it was deeply concerned about the court’s decision and reiterated its call for Gershkovich’s release. Russian officials say that there has been contact with Washington over the case but added that American public demands would not help the issue. Russia has also said that there would be no talks for a prisoner exchange until Gershkovich receives his verdict. No date has been set for his trial.  Reuters Associated Press

Central European Interior Ministers Agree to Curb Illegal Migration.  The interior ministers from the V4 group of Central European countries – Czech Republic, Hungary, Poland and Slovakia – and the ministers from Austria and Germany agreed on Monday to increase efforts to stem illegal immigration and target human smugglers.  The ministers met amid increasing concern in the E.U. about pressures from the Balkan migration route from Serbia into Hungary.  In addition to normal irregular migration, the bloc is also concerned about artificial crises blamed on Russia, such as the recent surge of asylum seekers seeking to enter Finland from Russia. Hungarian Interior Minister Sandor Pinter said he and his counterparts plan to discuss a common E.U. policy on immigration and asylum at a meeting in Brussels next week.  Associated Press 

Africa

Sierra Leone Attacks Kill 20, 2,000 Prisoners Escape.  The recent attacks in Sierra Leone’s capital of Freetown killed 20 people.  Army spokesman Colonel Issa Bangura reported that the violence killed “13 soldiers, three assailants, a police officer, a civilian, and someone working in private security.”  The government blamed “renegade soldiers” for the assaults.  About 1,890 inmates also escaped from Pademba Road Central Prison during the attacks.  Police are urging inmates to return to prison, but so far only 23 have. President Julius Maada Bio stated that most of the leaders of the attacks have already been arrested, while authorities are still searching for those who remain at large.  Reuters Associated Press

The Americas

Peru’s Top Prosecutor Blames President Boluarte for Deaths of Protesters as Political Crisis Deepens.  Peruvian Attorney General Patricia Benavides said yesterday that President Dina Boluarte and her prime minister are to blame for the deaths of “several” anti-government protesters earlier this year, and she charged them with murder in a procedure known as a constitutional complaint. A congressional committee will review the complaint, which if approved could result in a trial. Peru’s constitution protects the head of state from most criminal charges while they are still in office, meaning any trial most likely would occur after Boluarte leaves office. At least 49 people were killed in protests following the removal of former President Pedro Castillo after he attempted to dissolve congress by decree. Boluarte has blamed criminal groups involved in illegal mining and left-wing radicals for the violence, but human rights groups have accused Boluarte’s government of excessive violence against protesters. Critics also say the government has become increasingly authoritarian as it denies demands for early elections and works with members of congress to pass laws that threaten to undermine the independence of Peru’s judicial system. The charges against Boluarte were filed just hours after prosecutors accused Benavides of corruption in connection with a decision to drop investigations of members of congress who appointed some of her allies to positions in the judiciary. Associated Press

The data cutoff for this product was 8:00a.m. E.T.

Brad Christian, Ethan Masucol, Ken Hughes, Bruce Wilmot, Katharine Campbell, Leighton Durham, Emma Fisk, and Tiffany Krueger contributed to this report. 

Read deeply-experienced, expert-driven national security news, analysis and opinion in The Cipher Brief