Friday, January 27, 2023
The Cipher Brief curates open source information from around the world that impacts national security and delivers it to your inbox M–F. Here's a look at today's headlines, broken down by region of the world:
In the Americas...
Past US Presidents, VP’s Asked to Recheck for Classified Docs. The National Archives has asked all former US presidents and vice presidents to check their personal records for any classified documents following the discovery of classified materials at the homes of President Joe Biden and former Vice President Mike Pence. The Associated Press says the Archives sent letters with the request to presidents and vice presidents stretching back to the Ronald Reagan administration, reminding them to comply with the Presidential Records Act, which makes all presidential documents the property of the Archives after the end of their administrations. Associated Press
US Imposes New Sanctions on Russia’s Wagner Group. The US Treasury Department designated Russia’s Wagner Group as a “significant transnational criminal organization” on Thursday. The department also designated various entities it accuses of supporting Wagner, including China-based Spacety China, which has allegedly provided Wagner with radar satellite imagery of locations in Ukraine. Reuters
How the Ukraine War Has Changed Russia’s Global Oil Trade. The Wall Street Journal is out with a new report on the global oil trade and the impact that Russia’s war in Ukraine has had. The report uses data from ship tracking firm Spire Global to visually represent the changes in global shipping routes before and after Russia invaded Ukraine. Data shows that the war has forced a re-routing of global oil routes, with Moscow forced to find new buyers for its oil following western sanctions. Location data from Spire Global demonstrates that Moscow has been forced to reroute its oil to a smaller group of customers, mainly China, India and Turkey using a smaller fleet of cargo ships which are forced to travel longer distances. Despite having found customers for much of its oil, Russia has been forced to sell at deeply discounted prices compared to global averages, a trend that analysts say will create even more disruption to global energy markets next month when a US-led price cap on Russian oil goes into effect. Wall Street Journal
US to Send M1A2 Variant of Abrams Tank to Ukraine. The Pentagon says the US is sending its M1A2 Abrams tanks to. A pentagon official says the US will send the M1A2 Abrams tank to Ukraine. The A2 is a more advanced version than the A1 variant, with the main difference being that the A2 runs on a digital system. Former Army General Robert Abrams likened the difference between the A2 and A1 as similar to having a iPhone versus a rotary phone. CNN
US Extends ‘Safe Haven’ Status for Hong Kong Refugees in US. President Joe Biden extended the temporary “safe haven” status for Hong Kong refugees by two years on Thursday. The move maintains the ‘deferred enforced departure’ (DED) designation for Hong Kongers fleeing China’s ongoing crackdown on their city’s democracy and autonomy. The designation was set to expire on February 5. The Chinese embassy did not immediately respond to the extension. Politico South China Morning Post
Man Convicted Over 2017 Manhattan Bike Path Terror Attack. A US jury on Thursday charged Sayfullo Saipov for using a truck to kill eight people on a Manhattan bike path in 2017. The jury convicted Saipov on murder and terrorism charges, including attempted murder to gain entrance to Islamic State. Saipov pleaded not guilty to all charges. The jury will reconvene on February 6 to decide whether to sentence Saipov to death for the attack. New York Times Reuters
Haiti Protests Over Police Killings. Armed demonstrators are protesting in Haiti over a series of killings of police officers by gangs over the last week. The protesters are reportedly members of Fantom 509, an armed group of current and former Haitian police officers that have violently demanded better conditions for Haitian police and a tougher response to gang violence. Haiti has requested an international armed force to counter gangs, but the effort has stalled over disagreement about who would lead such a force. Al Jazeera
Western Europe
UK to Send Challenger Tanks to Ukraine by End of March. The UK said Thursday that it will send 14 Challenger 2 tanks to Ukraine at the end of March. Additionally, Ukrainian forces will start training on the British tanks next week. Britain was the first Western country to promise heavy assault vehicles for Kyiv and was later joined by Germany and the US. France 24
UN Warns of More Ukrainian Refugees Fleeing to Europe. UN High Commissioner for Refugees Filippo Grandi told AFP on Thursday that Ukraine and European governments should prepare for a possible new wave of Ukrainian refugees amid Russia’s continued offensives in eastern Ukraine. During a visit to Kyiv, Grandi said that while he cannot make predictions about military movements, he is sure that escalating fighting in the Donbas will cause more displacement. He also raised concern that the UNHCR has received limited requests to access and support Ukrainian refugees in Russia. Al Jazeera France 24
Central and Eastern Europe
French Foreign Minister Visits Odesa. French Foreign Minister Catherine Colonna visited the Ukrainian port Odesa on Thursday. Colonna said her trip aimed to show France’s continued support of Ukraine against Russia. She visited the port despite Russian strikes across Ukraine, which killed at least 11 people and hit power infrastructure facilities outside of Odesa, causing blackouts in the city. Colonna was still due to meet her Ukrainian counterpart Dmytro Kuleba despite the attacks to discuss what further aid Ukraine needs. Diplomatic sources say Russia will continue to target Odesa to cut off Ukraine’s maritime access. Separately, the sources add that France is not planning to send its Leclerc tanks to Ukraine, possibly to avoid overwhelming Ukrainian forces with too many different systems. France 24 Reuters
Ukraine Detains Alleged Russian Spy in Security Service. Ukrainian investigators detained a security official – a lieutenant colonel in the Security Service of Ukraine (SBU) – on suspicion of spying for Russia. The State Bureau of Investigation (SBI) says the official provided Moscow with the location of military checkpoints and other secret information. The official allegedly sent the data to Russia via email and a messaging app. His arrest comes amid an escalating anti-corruption campaign in Ukraine. France 24 Reuters
Former Wagner Group Officer in Norway Says Comrades Shot for Fleeing. The lawyer for Andrei Medvedev, a former commander in Russia’s Wagner Group who fled to Norway earlier this month to seek asylum, said that he experienced “horrible” situations while fighting in Ukraine. The lawyer claims that Medvedev watched the mistreatment of Russian prisoners recruited by Wagner, some of whom were shot for trying to flee from the front line. Norwegian police have released Medvedev in the Oslo area, where he is living in a secret location while undergoing further questioning by authorities. Reuters
Ukraine Says Fighting Intensifying in Southeastern Donetsk. Fighting is reportedly intensifying around the southeastern Donetsk region according to a regional Ukrainian official who says the fighting there has become almost as fierce as Bakmut. Analysts say the region is viewed as strategically vital for Moscow as key territory to prevent a Ukrainian attempt to retake Crimea. A Ukrainian military spokesman says that Moscow is relying on similar strategies as it used in the Bakmut campaign with significant use of artillery and large numbers of troops on ‘doomed offensives’. CNN
Asia
Chinese Engineers Claim Successful Hypersonic Missile Defense Simulation. A team of Chinese engineers say they have developed a reusable air defense system that can accurately defend against hypersonic missiles. The team cites a successful computer simulation that accurately predicted the trajectory of an incoming hypersonic missile to deploy a reusable aircraft to get close enough to the missile to deploy a ‘kinetic energy’ weapon to neutralize the threat. Researchers working for the Shanghai Institute of Mechanical and Electrical Engineering claim to have developed a new, more sophisticated algorithm, based in part on research by former MIT student David Benson and NASA to run the simulation. Critics of the research say that a real situation would be more complex due to weather conditions, energy requirements to power the weapons and the need to deploy multiple aircraft to destroy a single threat. South China Morning Post
Middle East and Northern Africa
Israel Strikes Gaza After Militants Fire Rockets. Media reports say that Palestinian militants fired two rockets from Gaza into Israel on Friday. Israeli fighter jets then conducted airstrikes on Gaza in retaliation. The cross-border exchange comes after an Israeli raid in the West Bank city of Jenin killed nine Palestinians yesterday. The Palestinian Authority suspended a security cooperation agreement with Israel shortly after the raid. The US State Department said it is “deeply concerned” about the new violence and tensions and is urging both sides to avoid further escalation. Al Jazeera Deutsche Welle Reuters
Blinken to Visit Middle East. US Secretary of State Antony Blinken is planning to visit Egypt, Israel and the West Bank in a three-day visit to the Middle East starting on Sunday. The US State Department says it is concerned that the Israeli-Palestinian security situation will worsen ahead of Blinken’s visit due to fighting following the Jenin raid. The department says Blinken plans to discuss the importance of a two-state solution and upholding the status quo at the Al Aqsa mosque in Jerusalem with top Israeli and Palestinian officials. Al Jazeera Reuters
Morocco Becomes First African Country to Pledge Tanks to Ukraine. Morocco is sending 20 renovated T-72B main battle tanks to Ukraine, making it the first African country to promise heavy weaponry to Kyiv. While the planned delivery was only announced this week, Algerian media reports that Morocco already agreed to send the talks in April last year. Analysts say the move, which significantly shifts Morocco away from a neutral position on the Ukraine war, is motivated by desires to counterbalance Algeria’s ties with Europe amid European criticism of Morocco over media freedom and its role in the European Parliament bribery scandal. Deutsche Welle
Sub Saharan Africa
US Special Operations Raid Kills IS Leader in Somalia. US Defense Secretary Lloyd Austin announced Thursday that US special operations forces killed the regional leader of Islamic State in Somalia, Bilal al-Sudani. Austin said al-Sudani was killed in a raid in northern Somalia that killed another 10 IS fighters. He added that no civilians or US military personnel were killed in the operation. Austin described al-Sudani as a “key facilitator” for Islamic State as he managed the group’s funding for operations in Africa and Afghanistan. Associated Press Deutsche Welle France 24
Russia’s Lavrov Makes Surprise Visit to Eritrea. Russian Foreign Minister Sergei Lavrov made a surprise trip to Eritrea on Thursday as part of his Africa tour. An Eritrean official says Lavrov met with Eritrean President Isais Afwerki to discuss ways to boost cooperation on energy, mining, information technology, education and health. Lavrov is in Africa for international support for Moscow amid its invasion of Ukraine. He visited Angola and Eswatini before his surprise visit to Eritrea and then moved down to South Africa. Al Jazeera Reuters
Cyber & Tech
FBI, Europol Seize Hive Ransomware Group Infrastructure. The FBI, US Department of Justice and Europol announced Thursday that an international law enforcement operation has seized the website and various servers used by the Hive ransomware group. The operation first infiltrated the group’s network in July 2022, allowing authorities to warn targets before attacks occurred. The infiltration also allowed authorities to steal and distribute decryption keys to victims, preventing the ransomware group from collecting $130 million in ransom payments from over 300 victims. US Attorney General Liza Monaco described the operation as a successful, lawful effort to “hack the hackers.” BleepingComputer CNN CyberNews CyberScoop Reuters Wall Street Journal
Pentagon Updates Guidance for Autonomous Weapons Development. The Pentagon updated its “Autonomy in Weapon Systems” policy directive to include considerations about the expanding use of advanced artificial intelligence in autonomous weaponry. The update to the directive, which was originally issued in 2012, includes changes that facilitate transparency and the ethical use of artificial intelligence for autonomy. The update also establishes an autonomous weapons system working group to advise the Department of Defense on these issues. BreakingDefense C4ISRNET DefenseScoop
IARPA Studying Psychology Behind Cyberattacks. IARPA scientists say they are studying how to use psychology to understand and predict behaviors of hackers to help preemptively thwart cyberattacks. Scientists say they plan to design systems that rely on theories about human biases and decision-making to predict hackers’ movements. The effort relies on cyber psychology, which has been used to understand online activities like bullying, dating and gambling, but has not been applied to cybersecurity. Wall Street Journal
DISA Adds Generative AI to Technology ‘Watch List.’ The Defense Informations Systems Agency added generative artificial intelligence to its mid-year 2023 technology watch list. The watch list includes technologies DISA seeks to monitor for possible disruptions and consider for use in DISA and Department of Defense missions. DISA’s chief technology officer Stephen Wallace said generative AI fits on the list as it can potentially be used for queries and assistant applications. DefenseScoop
CISA Says Federal Agencies Hacked with Remote Desktop Management Tools. CISA, the NSA and MS-ISAC released a joint advisory warning that hackers are increasingly using remote monitoring and management (RMM) software for attacks. CISA added that threat actors targeted at least two federal civilian executive branch (FCEB) agencies with RMM software in a refund scam campaign. The particular phishing attacks using RMM software that CISA found were financially motivated, but cyber authorities warn the method can be used for deeper exploitation and infiltration of systems. BleepingComputer The Record
Hacker Thought to Have Stolen Virtually All Austrians’ Personal Data Arrested. Austrian authorities say that a Dutch hacker arrested in November has stolen and offered so-called registration data – including full names, address and date of birth – of virtually every citizen in Austria. The hacker posted the data for sale in an online forum in May 2020. His offering included nearly nine million sets of data, which is close to Austria's population of 9.1 million. The hacker also reportedly posted “similar data sets” from Italy, the Netherlands and Colombia. Reuters
Chinese Influence Operations Weakened Over ‘Low Engagement.’ Google’s Threat Analysis Group released a report saying that Chinese influence operations have limited impact due to low engagement. The report looked at activity from the Dragonbridge network, which has targeted rare earth mining companies and attempted to discredit US midterm results last year. Google says engagement with Dragonbridge’s internet presence is almost non-existent. For example, most of its YouTube channels have zero subscribers. Researchers did say Dragonbridge is still a threat to watch as it may start producing smaller, higher-quality content to attract attention. CyberScoop
Pro-Iran Hackers Pose as Hezbollah Website for Anti-Saudi Campaign. Researchers at Secureworks Counter Threat Unit Research Team say they have found no link between Lebanon’s Hezbollah and a website called Abraham’s Ax, which claims to be affiliated with Hezbollah and focuses on anti-Saudi Arabia operations. Researchers say Abraham’s Ax is likely operated by the same entity behind the Iran-linked hacktivist group Moses Staff, which has attacked Israeli targets. The connections between the groups suggest that pro-Iranian hackers are turning attention towards Saudi Arabia amid warming Saudi-Israeli relations. CyberScoop
Read deeply-experienced, expert-driven national security news, analysis and opinion in The Cipher Brief
