Skip to content
Search

Latest Stories

NatSecEDGE

Welcome! Log in to stay connected and make the most of your experience.

Input clean

[rebelmouse-image 60323886 expand=1 dam=1 alt="OSR banner" site_id=26883708 is_animated_gif="false" original_size="1000x220" crop_info="%7B%22image%22%3A%20%22https%3A//assets.rbl.ms/60323886/origin.png%22%2C%20%22thumbnails%22%3A%20%7B%22origin%22%3A%20%22https%3A//assets.rbl.ms/60323886/origin.png%22%2C%20%22700x1245%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg4Ni9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTgwNzYxNDQ4OX0.1gEV77I0VNIGhfMuzIWULyPcbwHRsD2wYLxm6pOF4pA/image.png%3Fwidth%3D700%26height%3D1245%26coordinates%3D438%252C0%252C438%252C0%22%2C%20%221000x750%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg4Ni9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTgwNzYxNDQ4OX0.1gEV77I0VNIGhfMuzIWULyPcbwHRsD2wYLxm6pOF4pA/image.png%3Fwidth%3D1000%26height%3D750%26coordinates%3D353%252C0%252C353%252C0%22%2C%20%221200x400%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg4Ni9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTgwNzYxNDQ4OX0.1gEV77I0VNIGhfMuzIWULyPcbwHRsD2wYLxm6pOF4pA/image.png%3Fwidth%3D1200%26height%3D400%26coordinates%3D170%252C0%252C170%252C0%22%2C%20%22210x%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg4Ni9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTgwNzYxNDQ4OX0.1gEV77I0VNIGhfMuzIWULyPcbwHRsD2wYLxm6pOF4pA/image.png%3Fwidth%3D210%22%2C%20%221200x600%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg4Ni9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTgwNzYxNDQ4OX0.1gEV77I0VNIGhfMuzIWULyPcbwHRsD2wYLxm6pOF4pA/image.png%3Fwidth%3D1200%26height%3D600%26coordinates%3D280%252C0%252C280%252C0%22%2C%20%221200x800%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg4Ni9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTgwNzYxNDQ4OX0.1gEV77I0VNIGhfMuzIWULyPcbwHRsD2wYLxm6pOF4pA/image.png%3Fwidth%3D1200%26height%3D800%26coordinates%3D335%252C0%252C335%252C0%22%2C%20%22300x300%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg4Ni9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTgwNzYxNDQ4OX0.1gEV77I0VNIGhfMuzIWULyPcbwHRsD2wYLxm6pOF4pA/image.png%3Fwidth%3D300%26height%3D300%26coordinates%3D390%252C0%252C390%252C0%22%2C%20%22600x300%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg4Ni9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTgwNzYxNDQ4OX0.1gEV77I0VNIGhfMuzIWULyPcbwHRsD2wYLxm6pOF4pA/image.png%3Fwidth%3D600%26height%3D300%26coordinates%3D280%252C0%252C280%252C0%22%2C%20%22600x%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg4Ni9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTgwNzYxNDQ4OX0.1gEV77I0VNIGhfMuzIWULyPcbwHRsD2wYLxm6pOF4pA/image.png%3Fwidth%3D600%22%2C%20%22600x400%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg4Ni9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTgwNzYxNDQ4OX0.1gEV77I0VNIGhfMuzIWULyPcbwHRsD2wYLxm6pOF4pA/image.png%3Fwidth%3D600%26height%3D400%26coordinates%3D335%252C0%252C335%252C0%22%2C%20%2235x35%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg4Ni9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTgwNzYxNDQ4OX0.1gEV77I0VNIGhfMuzIWULyPcbwHRsD2wYLxm6pOF4pA/image.png%3Fwidth%3D35%26height%3D35%22%2C%20%22750x1000%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg4Ni9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTgwNzYxNDQ4OX0.1gEV77I0VNIGhfMuzIWULyPcbwHRsD2wYLxm6pOF4pA/image.png%3Fwidth%3D750%26height%3D1000%26coordinates%3D417%252C0%252C418%252C0%22%2C%20%22600x600%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg4Ni9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTgwNzYxNDQ4OX0.1gEV77I0VNIGhfMuzIWULyPcbwHRsD2wYLxm6pOF4pA/image.png%3Fwidth%3D600%26height%3D600%26coordinates%3D390%252C0%252C390%252C0%22%2C%20%22980x%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg4Ni9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTgwNzYxNDQ4OX0.1gEV77I0VNIGhfMuzIWULyPcbwHRsD2wYLxm6pOF4pA/image.png%3Fwidth%3D980%22%2C%20%22600x200%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg4Ni9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTgwNzYxNDQ4OX0.1gEV77I0VNIGhfMuzIWULyPcbwHRsD2wYLxm6pOF4pA/image.png%3Fwidth%3D600%26height%3D200%26coordinates%3D170%252C0%252C170%252C0%22%2C%20%221245x700%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg4Ni9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTgwNzYxNDQ4OX0.1gEV77I0VNIGhfMuzIWULyPcbwHRsD2wYLxm6pOF4pA/image.png%3Fwidth%3D1245%26height%3D700%26coordinates%3D304%252C0%252C304%252C0%22%2C%20%221500x2000%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg4Ni9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTgwNzYxNDQ4OX0.1gEV77I0VNIGhfMuzIWULyPcbwHRsD2wYLxm6pOF4pA/image.png%3Fwidth%3D1500%26height%3D2000%26coordinates%3D417%252C0%252C418%252C0%22%2C%20%22300x%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg4Ni9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTgwNzYxNDQ4OX0.1gEV77I0VNIGhfMuzIWULyPcbwHRsD2wYLxm6pOF4pA/image.png%3Fwidth%3D300%22%2C%20%222000x1500%22%3A%20%22https%3A//rebelmouse.thecipherbrief.com/media-library/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy82MDMyMzg4Ni9vcmlnaW4ucG5nIiwiZXhwaXJlc19hdCI6MTgwNzYxNDQ4OX0.1gEV77I0VNIGhfMuzIWULyPcbwHRsD2wYLxm6pOF4pA/image.png%3Fwidth%3D2000%26height%3D1500%26coordinates%3D353%252C0%252C353%252C0%22%7D%2C%20%22manual_image_crops%22%3A%20%7B%229x16%22%3A%20%7B%22sizes%22%3A%20%5B%22700x1245%22%5D%2C%20%22top%22%3A%200%2C%20%22height%22%3A%20220%2C%20%22width%22%3A%20124%2C%20%22left%22%3A%20438%7D%2C%20%22600x300%22%3A%20%7B%22sizes%22%3A%20%5B%22600x300%22%5D%2C%20%22top%22%3A%200%2C%20%22height%22%3A%20220%2C%20%22width%22%3A%20440%2C%20%22left%22%3A%20280%7D%2C%20%223x1%22%3A%20%7B%22sizes%22%3A%20%5B%221200x400%22%2C%20%22600x200%22%5D%2C%20%22top%22%3A%200%2C%20%22height%22%3A%20220%2C%20%22width%22%3A%20660%2C%20%22left%22%3A%20170%7D%2C%20%223x2%22%3A%20%7B%22sizes%22%3A%20%5B%221200x800%22%2C%20%22600x400%22%5D%2C%20%22top%22%3A%200%2C%20%22height%22%3A%20220%2C%20%22width%22%3A%20330%2C%20%22left%22%3A%20335%7D%2C%20%221x1%22%3A%20%7B%22sizes%22%3A%20%5B%22600x600%22%2C%20%22300x300%22%5D%2C%20%22top%22%3A%200%2C%20%22height%22%3A%20220%2C%20%22width%22%3A%20220%2C%20%22left%22%3A%20390%7D%2C%20%223x4%22%3A%20%7B%22sizes%22%3A%20%5B%221500x2000%22%2C%20%22750x1000%22%5D%2C%20%22top%22%3A%200%2C%20%22height%22%3A%20220%2C%20%22width%22%3A%20165%2C%20%22left%22%3A%20417%7D%2C%20%2216x9%22%3A%20%7B%22sizes%22%3A%20%5B%221245x700%22%5D%2C%20%22top%22%3A%200%2C%20%22height%22%3A%20220%2C%20%22width%22%3A%20392%2C%20%22left%22%3A%20304%7D%2C%20%224x3%22%3A%20%7B%22sizes%22%3A%20%5B%222000x1500%22%2C%20%221000x750%22%5D%2C%20%22top%22%3A%200%2C%20%22height%22%3A%20220%2C%20%22width%22%3A%20294%2C%20%22left%22%3A%20353%7D%2C%20%222x1%22%3A%20%7B%22sizes%22%3A%20%5B%221200x600%22%2C%20%22600x300%22%5D%2C%20%22top%22%3A%200%2C%20%22height%22%3A%20220%2C%20%22width%22%3A%20440%2C%20%22left%22%3A%20280%7D%7D%7D" caption="" photo_credit="" title=""]

Friday, June 16, 2023

The Cipher Brief curates open source information from around the world that impacts national security. Here's a look at today's headlines, broken down by region of the world:  

In the Americas

U.S. Government Agencies Hit in Global MOVEit Cyberattack.  US officials say several federal government agencies have been hit by a wave of cyberattacks from Russia-linked hackers exploiting vulnerabilities in the MOVEit file transfer tool.  Eric Goldstein, CISA Executive Assistant Director for Cybersecurity, told reporters on Thursday that several US federal government agencies have “experienced intrusions” and that officials are working to understand the impact of the breaches.  The Department of Energy (DOE) confirmed one of its research centers and a contractor were compromised. CISA Director Jen Easterly told reporters that so far the hacks have not had “significant impacts” on federal civilian agencies.  The Clop ransomware group, which has claimed responsibility for the MOVEit breaches, has begun to publicly identify targeted organizations on its dark web leak site.  Notably, as of Thursday, it did not list any US federal agencies and said that it had deleted data stolen from government, city or police service victims, saying “we have no interest to expose such information.”  The list of victims did include U.S-based financial institutions and investment firms as well as Britain’s Shell energy conglomerate.  A variety of education-related organizations were also listed, ranging from the nonprofit National Student Clearinghouse to the University System of Georgia.  John Hopkins University, the UK agency Transport for London, and the Ernst & Young consultancy firm also reported compromises of MOVEit tools on their systems.  Clop, which is linked to Russia, has been exploiting the MOVEit vulnerability since late May.  More victims of the Clop hacks are anticipated as thousands of MOVEit servers – the majority in the U.S. – are still discoverable on the Internet.  Moreover, Progress Software, the US firm that made MOVEit, said it discovered a second vulnerability in the tool’s code, though it is unclear if Clop has exploited it.  Bloomberg CNN Reuters TechCrunch TheRecord 

U.S. Sanctions North Korean Individuals After Missile Launches.  The U.S. imposed further sanctions on North Korea on Thursday after it launched two short-range missiles off its east coast.  The U.S. Treasury Department said the new sanctions target two North Koreans — a Beijing-based representative of a research body the U.S. says is linked to North Korea’s weapons development and his wife, who works at North Korea’s embassy in China — who it accused of procuring equipment used to support North Korea’s ballistic missile program.  The missile launches were an apparent protest of joint live-fire drills between U.S. and South Korean forces.  Reuters U.S Department of the Treasury

Discord Leak Suspect Indicted by Federal Grand Jury.  A federal grand jury has indicted former U.S. Air National Guardsman Jack Douglas Teixeria for leaking top-secret military intelligence documents online. The indictment consists of six counts of willful retention and transmission of classified information relating to national defense. Each count carries a sentence of up to 10 years in prison, up to three years of supervised release, and a fine of up to $250,000. The leaked documents constitute one of the largest and most serious security breaches since the WikiLeaks breach.  The leak released highly classified information concerning allies and adversaries and details such as Ukrainian air defenses and information on Mossad, Israel’s foreign intelligence agency.  Teixeria was arrested in April and initially faced two charges, which he pleaded not guilty.  It is unknown when Teixeria’s next court date will be, where he is expected to enter a plea on the newer additional charges.  NPR Reuters Washington Post

Iranian President Visits Cuba in Final Leg of Latin America Tour.  Iranian President Ebrahim Raisi landed in Cuba on Thursday as part of his last stop of his three-nation tour of Latin America. During the visit, Raisi met with his Cuban counterpart Miguel Diaz-Canel. The two leaders reportedly discussed trade, and collaboration on issues including electricity, biotechnology, and mining and signed administrative agreements that would support boosting collaboration between their countries’ ministries of justice, customs agencies and telecommunications bodies.  Diaz-Canel added in talks that Raisi’s Latin America tour underscores Iran’s role in “heroically” challenging “Yankee imperialism” in the region.  Reuters 

Canada to Organize Haiti Support from Dominican Republic, Imposes Sanctions.  Canadian Foreign Minister Melanie Joly said Thursday that Canada will launch an aid program in Haiti this summer that will operate from both the Dominican Republic and the Haitian capital Port-au-Prince. The operation aims to coordinate international aid, including financial support, equipment, and technical assistance. Haitian authorities are struggling to control extensive security issues and armed gangs who control much of the country. Joly said that “the situation on the ground is extremely fragile and the needs are immense - they go beyond Canada's or any other country's capacity to address them alone.” Canada, which will donate $13 million to UN anti-corruption and security projects, also imposed new sanctions on two individuals; Prophane Victor, a former deputy, and Gracia Delva, a former senator and well-known musician. Canada has sanctioned 21 members of Haiti’s corrupt political and business elite.  Reuters 

(Editor’s Note: Read about U.S. cyber authorities’ warnings about the LockBit ransomware group, congressional efforts to protect U.S. data from foreign actors and more in the Cyber and Tech section below.)

Western Europe

Zelensky Urges Switzerland to Allow Re-Export of Weapons to Ukraine.  Ukrainian President Volodymyr Zelensky on Thursday called on Switzerland to approve the re-export of weapons and military equipment to Ukraine, saying it would be “vital” in countering Russian forces.  Switzerland bars countries that purchase Swiss arms from re-exporting them to parties actively involved in a conflict.  Switzerland applied this embargo on arms for either Russia or Ukraine in November and has since denied requests by Germany, Denmark and Spain to re-export Swiss weapons materiel to Ukraine.  Reuters RFE/RL

NATO Moving Towards Agreement on Ukraine's Path to Membership.  German Defense Minister Boris Pistorius stated Friday that NATO allies may be poised to remove some obstacles from Ukraine’s path to becoming a member of the alliance. Pistorius told reporters in Brussels that "there are increasing signs that everyone will be able to agree” on possibly forgoing the formal candidacy process for Ukraine.  His comments come weeks ahead of a NATO summit that will answer questions about Ukraine’s accession, for which a timeline has not yet been set.  The Washington Post reports that the US is tentatively in support of a fast-track for Ukraine as well, quoting a senior U.S. official who said Washington is “comfortable” with NATO Secretary-General Jens Stoltenberg’s bid to permit Kyiv to bypass the normal Membership Action Plan (MAP).  For 24 years, most nations seeking accession have had to meet military, economic, and political criteria set out by the MAP to join NATO.  The official said that the U.S. is open to shortening the process for Ukraine to overcome divisions between alliance members on the timing of Kyiv’s accession.  NATO agreed in 2008 at its Bucharest summit to eventually admit Ukraine.  Reuters Washington Post

Stoltenberg Does Not Deny Possibility of Extending Term as NATO Chief.  NATO Secretary-General Jens Stoltenberg on Thursday did not refute the possibility of prolonging his term as head of the alliance after serving nine years as chief. Stoltenberg, who is due to leave the position in September, has been endorsed by potential successors and top officials to stay on as NATO head due to the difficulty in securing consensus among all 31 allied members on his successor. His term has been extended three times already. Though Stoltenberg insisted that he does not seek another extension, he told reporters, "I am responsible for all decisions that this alliance has to take except for one. And that is about my future. That is for the 31 allies to decide," suggesting that if NATO asks him to continue to serve, he will do so.  German Defense Minister Boris Pistorius backed this, saying "if we don't agree on a candidate for the succession, NATO will not be able to make do without a secretary general. So I am naturally in favor of an extension.”  Danish Prime Minister Mette Frederiksen, a frontrunner for the position, who also maintains she is not a candidate, echoed this, saying that Stoltenberg staying NATO head would be “a really good solution.”  Financial Times Reuters 

Italy's Meloni Meets Tesla CEO Musk.  Italian Prime Minister Giorgia Meloni met with Tesla CEO Elon Musk in Rome on Thursday.  Sources say the two discussed EU deregulation and artificial intelligence (AI) risks.  Musk also reportedly met with Italian Foreign Minister Antonio Tajani earlier to discuss the automotive and space sectors and cybersecurity issues.  Musk is reportedly headed to France to meet with French President Emmanuel Macron next on issues like tech regulation and electric vehicle production.  CNBC Reuters

(Editor’s Note: Read about GRU-linked cyberattacks against NATO, French artificial intelligence regulation and more in the Cyber and Tech section below.)

Central and Eastern Europe

Top U.S. Military Officials Say Ukraine Counteroffensive Will Be Difficult.  U.S. Chairman of the Joint Chiefs of Staff General Mark Milley and Defense Secretary Lloyd Austin warned on Thursday that Ukraine faces a tough fight to achieve a successful counteroffensive.  Milley said that the counteroffensive will “likely take a considerable amount of time at a high cost” and that it is too early to make any predictions about its outcome.  Austin echoed this, saying that the counteroffensive is a “marathon, not a sprint.”  Austin also said that while Ukraine still has “a lot of combat capability,” it will need its allies to “dig deep” and continue providing military support to sustain the counteroffensive.  Their comments came at a meeting of the Ukraine Defense Contact Group in Brussels, the 13th such meeting of the body since the start of the Ukraine war.  Al Jazeera Politico Reuters 

Ukraine Reports Advances in Counteroffensive, Strong Russian Defenses.  Ukraine’s military said on Thursday that it has advanced in key areas of the front line and regained 100 square kilometers (38 square miles) of territory from Russian forces in its counteroffensive.  Brigadier-General Oleksii Hromov said Ukrainian forces have so far liberated seven settlements in the Donetsk and Zaporizhzhia regions and have made advances around Bakhmut and the southern city of Vuhledar.  Deputy Defense Minister Hanna Maliar added that Ukrainian troops have advanced towards the southern port cities of Berdyansk and Mariupol.  Despite this progress, Kyiv reports Russia is putting up intense resistance to the counteroffensive.  Maliar said attacking Ukrainian troops are facing Russian anti-tank guided missiles, airborne loitering munitions and mines in Russian-occupied areas and a senior Ukrainian military official  said that Russia was moving some of its best military units to reinforce the Bakhmut region.  Reuters Wall Street Journal

IAEA Chief Visits Zaporizhzhia Nuclear Power Plant After Kakhovka Dam Collapse.  IAEA Director General Rafael Grossi arrived at the Zaporizhzhia nuclear power plant in Ukraine on Thursday to assess impacts of the Kakhovka dam breach on the facility.  The collapse of the dam sparked safety concerns at the plant since it pulls water for cooling from the dam’s reservoir, which is now rapidly draining.  Russian state media reported that Grossi said that while the situation at the plant is “serious,” it still has sufficient amounts of cooling water and that “a number of measures” have been taken to stabilize the facility, including switching to other water sources like deep underground wells to replenish cooling water reserves.  He added that it remains “unrealistic” that Ukraine and Russia will agree to a deal on the plant’s security amid ongoing fighting.  Al Jazeera New York Times Reuters 

Chechen Military Unit Deploys to Russia’s Belgorod Region.  Ramzan Kadyrov, the Head of the Chechen Republic, on Thursday said his “Zapad-Akhmat” Chechen military unit has deployed to Russia’s Belgorod region to defend against “Ukrainian sabotage groups.”  Belgorod, which borders Ukraine, has been subject to cross-border incursions by pro-Ukraine Russian paramilitary groups in recent weeks.  The reported deployment came after Akhmat signed a contract with Russia’s defense ministry, which the Wagner mercenary group has refused to sign.  Reuters 

Russia Plans Elections in Occupied Ukraine in Bid to Signal Normalcy.  Russia’s central election commission on Thursday said regional elections will be held in Russia-occupied areas in Ukraine on September 10.  The votes will be held in Ukraine’s Donetsk, Luhansk, Zaporizhzhia and Kherson regions, which Russia annexed last September, though it does not fully control any of them.  Russian election officials say that both Russia’s Defense Ministry and the Federal Security Service (FSB) have concluded that it is possible to hold the elections.  Ukraine has said any elections held by Russia on Ukrainian territory are invalid and illegal.  Analysts say the elections are part of efforts by Russia to signal it will not give occupied territories back and to project normalcy in these areas amid Ukraine’s ongoing counteroffensive.  Politico Reuters

Asia and Oceania

Thailand Considering Chinese Engine for Chinese Submarine Purchase.  Thailand is reportedly considering a Chinese engine for a submarine it will purchase from China after Germany refused to give an engine.  Thailand agreed to buy the Chinese submarine in 2017 for $369 million following the Thai military junta’s 2014 coup, which soured Thailand’s relationship with the U.S.  The deal was disrupted last year after Germany refused to supply an engine for the submarine, saying it would not let its products be used for Chinese military exports.  China offered a Chinese engine at the time, but Thailand reportedly declined over quality concerns.   Sources say Thailand is asking Pakistan about its Chinese-made submarine fleet to assess the quality of their engines and is combing through the submarine deal’s contract for “loopholes” to address the engine problem.  Beijing is working to ensure the deal goes through as it will be an example for its dependability as an arms supplier.  Nikkei Asia

Japan Bolstering the Philippines’ Defense to Address China Tensions.  Japan is moving to increase military aid to the Philippines to address concerns over regional instability from Chinese aggression.  Analysts say Tokyo believes the Philippines would play a key role if China attacked Taiwan as it could plug defensive gaps in the region.  Retired admiral Katsutoshi Kawano told Reuters that possible aid for Manila could include radars that would be used to monitor the Bashi Channel — the waterway between Taiwan and the Philippines — as it is a choke point between the South China Sea and western Pacific.  Any aid from Japan will be limited by self-imposed restrictions on exports of lethal military aid, though export rules are expected to be loosened in the coming months.  Japanese officials have also indicated that the Philippines could give Japanese forces access to its military bases, as it does with U.S. troops, to help overcome export restrictions.  Experts add that Japan will likely have the most success in deepening security ties with the Philippines if it also focuses on economic issues and economic security.  Reuters

Shanghai Implementing High End Manufacturing Drive.  In the midst of an intense Chinese-U.S. technology rivalry, Shanghai has announced an ambitious plan to boost high end manufacturing in the city with a focus on the semiconductor and high-tech industry. The city published a three-year plan from 2023 to 2025 to “promote the high-quality development” of its manufacturing industry and lists preferred industries as semiconductors and artificial intelligence. By 2025, the city aims to have developed “world industry clusters” for integrated circuits, biomedicine, and artificial intelligence and increase the value output from 1.4 trillion Yuan in 2022 to 1.8 trillion yuan (US $251 billion) in 2025. This plan closely follows a decision by the central Chinese government to develop its own high-tech industry and become more self-reliant and shielded from U.S. sanctions in strategic technology sectors.  South China Morning Post 

Germany’s national security strategy ‘no surprise to China’ after Berlin echoes EU in warning of ‘systemic rivalry’.  Chinese analysts say that it is not surprising that Germany’s new National Security Strategy describes China as a “competitor and systemic rival,” but they say Beijing is concerned about how this may translate to actual China policy.  The strategy adds that economic reliance on key areas could “quickly evolve into significant security risks,” suggesting that dependence on China could cause similar problems that Berlin’s reliance on Russian energy posed at the beginning of the Ukraine war.  The language is similar to how the EU has used to describe China in its “de-risking” campaign.  Analysts say that while the strategy does not depict China as fully adversarial, it is unclear what German de-risking will look like, raising concerns that it may lead to overreaction or escalation.  South China Morning Post 

Part of Failed North Korean Rocket Recovered by South Korea.  South Korea’s military said on Friday that it recovered part of a North Korean rocket in waters west of the Korean peninsula on Thursday night, around two weeks after Pyongyang unsuccessfully attempted to launch the rocket to send its first spy satellite into orbit.  South Korea had already found smaller pieces of debris from the crashed rocket after deploying search teams, but faced difficulties due to poor visibility and strong tides.  South Korea’s Joint Chiefs of Staff said in a statement that the “salvaged object,” which may be part of a fuel tank, “will be thoroughly analyzed in cooperation with the United States.” Searches continue for the third stage of the rocket and its payload. The recovered debris could help scientists discover more features of the North Korean rocket, reveal how far the country has progressed with its intercontinental ballistic missile (ICBM) capability, and tell whether or not it breached sanctions to obtain materials from overseas. South Korea reports that Chinese ships have also been searching waters around the failed launch for debris, though it is unclear if they will continue salvage operations.  Reuters  

U.S. Guided-Missile Submarine Deployed to South Korea.  The U.S. deployed the nuclear-powered submarine USS Michigan to South Korea on Friday, marking the first such deployment in six years.  South Korea’s Defense Ministry said the USS Michigan, which can be armed with 150 Tomahawk missiles, is in the southeastern port of Busan, though the ministry did not say how long it will be there.  Officials say the submarine is in South Korea for joint exercises and to fulfill an agreement to enhance “regular visibility” of U.S. strategic assets in South Korea to help counter and deter North Korea’s nuclear and missile programs.  The USS Michigan’s deployment comes after North Korea launched two missiles in response to the joint U.S.-South Korean drills.  Associated Press

(Editor’s Note: Read more on a China-backed global hacking campaign, China’s new thorium nuclear reactor, Japan’s next supercomputer and the latest on E.U. restrictions on Huawei technology in the Cyber and Tech section below.)

Middle East and Northern Africa

Iran Tests Suicide Drones in Gulf.  Iran's military tested a suicide drone against a practice barge in Iran’s territorial waters in the Gulf of Oman according to a US official.  The official added that the test was essentially aimed at practicing targeting merchant vessels, which the U.S. has accused Iran of doing so on multiple occasions, namely following Iran’s recent seizures of tankers in Gulf waters. Iranian officials did not comment on the claims.  Reuters

Saudi Arabia Foreign Minister to Visit Iran.  Saudi Arabia’s Foreign Minister, Prince Faisal bin Frahn, will visit Tehran on Saturday to meet Iranian officials, according to Iran’s semi-official Tasnim news agency.  His visit comes after Saudi Arabia and Iran re-established diplomatic relations under a China-brokered deal.  Reuters

Palestine Increasingly Concerned Over Israeli Settlements.  Among escalating tensions and violence, Palestinians are growing increasingly concerned due to an increase in Israeli settler related tensions and violence in the West Bank.  U.S. and European officials have long expressed concerns that the settlements undermine efforts for a two-state solution.. Since taking power, Netanyahu’s government has supported the expansion of Israeli settlements in the West Bank and has allowed the return of settlers to four different settlements evacuated in 2005. Palestinians state that these actions have put their lives and property at risk. As expansion has continued, the United Nations has recorded 475 settler related incidents leading to casualties or property damage, the highest daily average since 2006. Netanyahu said last week the West Bank settlements were not an obstacle to peace despite them being one of the most contentious issues between Israel, the international community, and the Palestinians who say they undermine the possibility for a Palestinian state.  Reuters

Sub Saharan Africa

African Leaders Headed to Ukraine, Russia to Propose ‘Confidence Building Measures.’  A group of African leaders are meeting Ukrainian President Volodymyr Zelensky and Russian President Vladimir Putin in Kyiv and Moscow, respectively, on Friday and Saturday in an effort to mediate the conflict between Russia and Ukraine.  Senegal President Macky Sall and South African President Cyril Ramaphosa are leading the delegation, which also includes leaders from Zambia, the Comoros, and Egypt's prime minister.  A framework document of the group’s proposals seen by Reuters lists a number of “confidence-building measures” the group may suggest to encourage a ceasefire and wider negotiations.  The measures include a pull-back of Russian forces, the removal of Russian tactical nuclear weapons in Belarus, the suspension of the International Criminal Court warrant for Putin’s arrest, a long-term grain and fertilizer deal, and sanctions relief for Russia.  The framework document adds that Africa has an interest in ending the Ukraine war since resulting trade disruptions from the conflict have adversely impacted the continent.  The African peace effort adds to a number of Ukraine peace plans, including Kyiv’s own plan, which includes the full withdrawal of Russian forces from all Ukrainian territories.  Associated Press Reuters 

Cyber and Tech

Mandiant Reports China-Backed Hacking Campaign Exploiting Email Security Tool.  Cybersecurity researchers at Mandiant on Thursday said they have “high confidence” that suspected China-backed hackers were behind a campaign that exploited vulnerabilities in Barracuda Networks’ email security appliance to target public and private sector organizations globally.  The researchers said the hackers compromised the appliance to send malicious file attachments to gain access to targeted organizations’ networks.  Over half of the organizations were from the Americas and over 20 percent from Asia Pacific, including foreign ministries in Southeast Asia and foreign trade offices and academic organizations in Taiwan and Hong Kong.  Barracuda had said on June 6 that its email security appliance had been hacked as early as October and recommended organizations using the tool to fully replace their devices.  Mandiant’s report on the suspected Chinese hacking campaign comes ahead of U.S. Secretary of State Antony Blinken’s visit to Beijing.  A spokesperson for China’s Embassy in Washington rejected the report as “completely distorting the truth,” saying that China has “always firmly opposed and cracked down on all forms of cyber hacking.”  The spokesperson also accused the U.S. of conducting such cyber espionage operations, but without providing evidence.  Associated Press TechCrunch Mandiant

Microsoft Identifies GRU-Linked Hackers Behind Cyberattacks in Ukraine, NATO States.  Microsoft reports that a threat group linked to the GRU, Russia’s military intelligence agency, is responsible for multiple cyberattacks directed at systems of the Ukrainian government and private sector IT firms.  “Cadet Blizzard” has been identified as the group conducting the latest attacks; it previously was connected to data-wiping campaigns against Ukrainian targets leading up to Russia’s invasion in February 2022.  According to Microsoft, Cadet Blizzard also has been targeting NATO member states providing military assistance to Ukraine.  The Microsoft blog post pointed to the significance of this development, observing that “the emergence of a novel GRU affiliated actor, particularly one which has conducted destructive cyber operations likely supporting broader military objectives in Ukraine, is a notable development in the Russian cyber threat landscape.”  Notably, Cadet Blizzard is reported to operate independently of other GRU-affiliated hacking groups in carrying out destructive attacks, cyber espionage, hack-and-leak operations, and website defacement attacks.  C4ISRNet CyberScoop TheRecord BleepingComputer

Ukraine Military, Intelligence Targeted by Russian Group Employing ‘Backdoor’ Malware.  A Russian hacking group, Gamaredon, continues to conduct cyberattacks on Ukrainian military and intelligence organizations, according to the Symantec threat research team.  The group, also known as Armageddon and Shuckworm, is reported to be deploying “a refreshed toolset and new infection tactics.”  These include the use of USB malware capable of spreading to additional systems inside infected networks.  Symantec researchers report that the threat group continues to employ phishing emails for initial compromise of government, military, security, and research organizations, focusing on their human resources departments.  Symantec cited one instance in which a targeted device was compromised after an infected USB key was plugged in. However, it is unclear how the USB drive became infected in the first place.  Symantec warned that USB drives “are likely used by the attackers for lateral movement across victim networks and may be used to help the attackers reach air-gapped machines within targeted organizations."  Gamaredon has been linked to Russia’s foreign intelligence arm, the FSB.  BleepingComputer

European Commission Expected To Ban Huawei, ZTE Equipment from Internal Networks.  The European Commission is expected to include a ban on equipment from Chinese telecommunications vendors Huawei and ZTE in its new 5G network guidance, according to “people familiar with the matter.”  Under a new EU plan concerning 5G mobile networks, Community members reportedly will be under increased pressure to phase out equipment from the Chinese vendors.  For the first time, the EU guidance is expected to identify the companies by name.  While most EU member states have not taken action to ban the Chinese vendors’ equipment, some EU member states like Sweden have done so.  It has been reported that the Commission has become increasingly frustrated by EU countries that rely heavily on Huawei equipment, including Germany.  Representatives for the Commission as well as Huawei and ZTE did not immediately respond to requests for comment.  Bloomberg

CISA, FBI, Global Cybersecurity Agencies Issue Report on Prolific LockBit Threat Actor.  An international analysis of the LockBit ransomware gang has concluded that the threat actor was responsible for “one in every six” ransomware attacks on U.S. government organizations in 2022.  The report issued by CISA, the FBI and cybersecurity agencies of Australia, Canada, Britain, Germany, France and New Zealand highlighted that the Russia-linked group is “one of the biggest cybersecurity threats” to government and private sector organizations around the world. Based on victim lists posted to its leak site, LockBit is responsible for at least 1,653 ransomware attacks, which has earned the group about $91 million from U.S ransom payments alone.  The multinational report contained statistics from each country indicating Lockbit’s attack frequency.  Australia reported that the gang was responsible for 18 percent of total ransomware incidents while Canada and New Zealand documented LockBit involvement in just over 1 in 5 attacks in 2022.  U.S. statistics showed the threat group conducted 16 percent of attacks on the public sector, including local governments, public higher education and K-12 schools, as well as on law enforcement agencies.  Tom Kellermann, a cybersecurity official in the Obama administration, noted that the increasing number of LockBit attacks has helped Russia offset Western sanctions by affiliating itself “with cybercrime cartels that enjoy a pax mafiosa with the Russian government.”  TheRecord BleepingComputer

French President Urges European Surge in AI Development, Forward-Looking Rules.  French President Emmanuel Macron struck a note of urgency Wednesday in comments at the Vivatech tech exhibition in Paris, warning that Europe is ““too far behind in terms of innovation and we’re regulating too slowly.”  Macron called for accelerating AI development on the continent at the same time as creating “smart” regulations that do not get in the way of company innovation.  Regarding the AI “trilogue” taking place among the EU member states, the European Parliament, and the European Commission, Macron described it as a “good debate,” but predicted that by the time an AI Act is approved and implemented, “we’ll have regulated on presuppositions and knowledge that are almost already obsolete.”  He noted that French institutional investors have committed $7.6 billion to Tibi 2, a national initiative to support tech innovation.  Macron also touted French AI research while appealing for more local startups in the technology.  In terms of competition, Macron said “we’re leaders in continental Europe.  We’re being slightly outdone by the British, who have created champions, but it’s not impossible to catch up.”  Macron conceded that U.S. and Chinese AI R&D initiatives are well ahead of European counterparts.  He also mentioned that he will meet with Tesla and SpaceX chief Elon Musk on Friday to discuss AI and social media regulation along with “promoting France and Europe’s attractiveness.”  Associated Press Bloomberg

Bipartisan Senate Bill Seeks Protections for U.S. Data from Foreign Exploitation.  A bipartisan Senate bill introduced on Wednesday by Sens. Ron Wyden and Cynthia Lummis calls for restrictions on the export of U.S. citizens’ personal data to “hostile nations” and limits foreign-owned companies from accessing U.S. data from abroad.  Wyden said in a statement that the proposed export changes would “turn off the tap” of data flowing to adversaries, noting that “massive pools of Americans’ sensitive information — everything from where we go, to what we buy and what kind of health care services we receive — are for sale to buyers in China, Russia and nearly anyone with a credit card.”  The new legislation, known as Protecting Americans’ Data from Foreign Surveillance Act is also co-sponsored by Sens. Bill Hagerty, Martin Heinrich, Marco Rubio, and Sheldon Whitehouse.  The bill would require the Commerce Department, working with other agencies, to identify “categories of personal data that, if exported, could harm U.S. national security.”  The department also would identify low-risk countries — “where data can be shared without restrictions” — and high-risk countries — ”where exports of sensitive data will be blocked.”  TheRecord South China Morning Post FCW

Japan Covering Half of Costs for $100 Million Generative AI Supercomputer.  Japan’s Ministry of Economy, Trade and Industry (METI) has agreed to pay for half the cost of a new Japanese supercomputer being built in Hokkaido.  METI said it will subsidize 6.8 billion yen ($48.2 million) of the 13.5 billion yen costs to build the machine.  The supercomputer is being built by Saukra Internet and is expected to become operational as soon as next year.  It will specialize in providing large language model training for generative artificial intelligence (AI) development.  In return for METI’s support, Sakura Internet will allow startups and other users to use the supercomputer’s processing capabilities at inexpensive rates.  The Sakura Internet supercomputer is set to triple Japan’s processing capabilities.  Nikkei Asia

China Approves Nuclear Reactor Run on Thorium — Which Could Generate Power for 20,000 Years.  China’s National Nuclear Safety Administration issued an operational permit for China’s first thorium reactor.  The permit allows the Shanghai Institute of Applied Physics of the Chinese Academy of Sciences to operate the reactor — a two-megawatt liquid-fuelled thorium molten salt reactor (MSR) — for 10 years in the Gobi Desert city of Wuwei in Gansu province.   Thorium MSRs use liquid fuels as both a fuel and a coolant.  They are safer, more efficient and produce less waste than traditional uranium reactors.  Uranium is also scarcer than thorium, which China has significant reserves of.  Other countries, like the U.S. and India, have built thorium reactors, but these past efforts have only been experimental and have not progressed to commercial use.  If the Wuwei reactor is successful, it will mark a significant leap forward for China’s nuclear technology development.  South China Morning Post

Read deeply-experienced, expert-driven national security news, analysis and opinion inThe Cipher Brief

Report for Friday, June 16, 2023

OSR banner

Friday, June 16, 2023

The Cipher Brief curates open source information from around the world that impacts national security. Here's a look at today's headlines, broken down by region of the world:  

In the Americas

U.S. Government Agencies Hit in Global MOVEit Cyberattack.  US officials say several federal government agencies have been hit by a wave of cyberattacks from Russia-linked hackers exploiting vulnerabilities in the MOVEit file transfer tool.  Eric Goldstein, CISA Executive Assistant Director for Cybersecurity, told reporters on Thursday that several US federal government agencies have “experienced intrusions” and that officials are working to understand the impact of the breaches.  The Department of Energy (DOE) confirmed one of its research centers and a contractor were compromised. CISA Director Jen Easterly told reporters that so far the hacks have not had “significant impacts” on federal civilian agencies.  The Clop ransomware group, which has claimed responsibility for the MOVEit breaches, has begun to publicly identify targeted organizations on its dark web leak site.  Notably, as of Thursday, it did not list any US federal agencies and said that it had deleted data stolen from government, city or police service victims, saying “we have no interest to expose such information.”  The list of victims did include U.S-based financial institutions and investment firms as well as Britain’s Shell energy conglomerate.  A variety of education-related organizations were also listed, ranging from the nonprofit National Student Clearinghouse to the University System of Georgia.  John Hopkins University, the UK agency Transport for London, and the Ernst & Young consultancy firm also reported compromises of MOVEit tools on their systems.  Clop, which is linked to Russia, has been exploiting the MOVEit vulnerability since late May.  More victims of the Clop hacks are anticipated as thousands of MOVEit servers – the majority in the U.S. – are still discoverable on the Internet.  Moreover, Progress Software, the US firm that made MOVEit, said it discovered a second vulnerability in the tool’s code, though it is unclear if Clop has exploited it.  Bloomberg CNN Reuters TechCrunch TheRecord 

U.S. Sanctions North Korean Individuals After Missile Launches.  The U.S. imposed further sanctions on North Korea on Thursday after it launched two short-range missiles off its east coast.  The U.S. Treasury Department said the new sanctions target two North Koreans — a Beijing-based representative of a research body the U.S. says is linked to North Korea’s weapons development and his wife, who works at North Korea’s embassy in China — who it accused of procuring equipment used to support North Korea’s ballistic missile program.  The missile launches were an apparent protest of joint live-fire drills between U.S. and South Korean forces.  Reuters U.S Department of the Treasury

Discord Leak Suspect Indicted by Federal Grand Jury.  A federal grand jury has indicted former U.S. Air National Guardsman Jack Douglas Teixeria for leaking top-secret military intelligence documents online. The indictment consists of six counts of willful retention and transmission of classified information relating to national defense. Each count carries a sentence of up to 10 years in prison, up to three years of supervised release, and a fine of up to $250,000. The leaked documents constitute one of the largest and most serious security breaches since the WikiLeaks breach.  The leak released highly classified information concerning allies and adversaries and details such as Ukrainian air defenses and information on Mossad, Israel’s foreign intelligence agency.  Teixeria was arrested in April and initially faced two charges, which he pleaded not guilty.  It is unknown when Teixeria’s next court date will be, where he is expected to enter a plea on the newer additional charges.  NPR Reuters Washington Post

Iranian President Visits Cuba in Final Leg of Latin America Tour.  Iranian President Ebrahim Raisi landed in Cuba on Thursday as part of his last stop of his three-nation tour of Latin America. During the visit, Raisi met with his Cuban counterpart Miguel Diaz-Canel. The two leaders reportedly discussed trade, and collaboration on issues including electricity, biotechnology, and mining and signed administrative agreements that would support boosting collaboration between their countries’ ministries of justice, customs agencies and telecommunications bodies.  Diaz-Canel added in talks that Raisi’s Latin America tour underscores Iran’s role in “heroically” challenging “Yankee imperialism” in the region.  Reuters 

Canada to Organize Haiti Support from Dominican Republic, Imposes Sanctions.  Canadian Foreign Minister Melanie Joly said Thursday that Canada will launch an aid program in Haiti this summer that will operate from both the Dominican Republic and the Haitian capital Port-au-Prince. The operation aims to coordinate international aid, including financial support, equipment, and technical assistance. Haitian authorities are struggling to control extensive security issues and armed gangs who control much of the country. Joly said that “the situation on the ground is extremely fragile and the needs are immense - they go beyond Canada's or any other country's capacity to address them alone.” Canada, which will donate $13 million to UN anti-corruption and security projects, also imposed new sanctions on two individuals; Prophane Victor, a former deputy, and Gracia Delva, a former senator and well-known musician. Canada has sanctioned 21 members of Haiti’s corrupt political and business elite.  Reuters 

(Editor’s Note: Read about U.S. cyber authorities’ warnings about the LockBit ransomware group, congressional efforts to protect U.S. data from foreign actors and more in the Cyber and Tech section below.)

Western Europe

Zelensky Urges Switzerland to Allow Re-Export of Weapons to Ukraine.  Ukrainian President Volodymyr Zelensky on Thursday called on Switzerland to approve the re-export of weapons and military equipment to Ukraine, saying it would be “vital” in countering Russian forces.  Switzerland bars countries that purchase Swiss arms from re-exporting them to parties actively involved in a conflict.  Switzerland applied this embargo on arms for either Russia or Ukraine in November and has since denied requests by Germany, Denmark and Spain to re-export Swiss weapons materiel to Ukraine.  Reuters RFE/RL

NATO Moving Towards Agreement on Ukraine's Path to Membership.  German Defense Minister Boris Pistorius stated Friday that NATO allies may be poised to remove some obstacles from Ukraine’s path to becoming a member of the alliance. Pistorius told reporters in Brussels that "there are increasing signs that everyone will be able to agree” on possibly forgoing the formal candidacy process for Ukraine.  His comments come weeks ahead of a NATO summit that will answer questions about Ukraine’s accession, for which a timeline has not yet been set.  The Washington Post reports that the US is tentatively in support of a fast-track for Ukraine as well, quoting a senior U.S. official who said Washington is “comfortable” with NATO Secretary-General Jens Stoltenberg’s bid to permit Kyiv to bypass the normal Membership Action Plan (MAP).  For 24 years, most nations seeking accession have had to meet military, economic, and political criteria set out by the MAP to join NATO.  The official said that the U.S. is open to shortening the process for Ukraine to overcome divisions between alliance members on the timing of Kyiv’s accession.  NATO agreed in 2008 at its Bucharest summit to eventually admit Ukraine.  Reuters Washington Post

Stoltenberg Does Not Deny Possibility of Extending Term as NATO Chief.  NATO Secretary-General Jens Stoltenberg on Thursday did not refute the possibility of prolonging his term as head of the alliance after serving nine years as chief. Stoltenberg, who is due to leave the position in September, has been endorsed by potential successors and top officials to stay on as NATO head due to the difficulty in securing consensus among all 31 allied members on his successor. His term has been extended three times already. Though Stoltenberg insisted that he does not seek another extension, he told reporters, "I am responsible for all decisions that this alliance has to take except for one. And that is about my future. That is for the 31 allies to decide," suggesting that if NATO asks him to continue to serve, he will do so.  German Defense Minister Boris Pistorius backed this, saying "if we don't agree on a candidate for the succession, NATO will not be able to make do without a secretary general. So I am naturally in favor of an extension.”  Danish Prime Minister Mette Frederiksen, a frontrunner for the position, who also maintains she is not a candidate, echoed this, saying that Stoltenberg staying NATO head would be “a really good solution.”  Financial Times Reuters 

Italy's Meloni Meets Tesla CEO Musk.  Italian Prime Minister Giorgia Meloni met with Tesla CEO Elon Musk in Rome on Thursday.  Sources say the two discussed EU deregulation and artificial intelligence (AI) risks.  Musk also reportedly met with Italian Foreign Minister Antonio Tajani earlier to discuss the automotive and space sectors and cybersecurity issues.  Musk is reportedly headed to France to meet with French President Emmanuel Macron next on issues like tech regulation and electric vehicle production.  CNBC Reuters

(Editor’s Note: Read about GRU-linked cyberattacks against NATO, French artificial intelligence regulation and more in the Cyber and Tech section below.)

Central and Eastern Europe

Top U.S. Military Officials Say Ukraine Counteroffensive Will Be Difficult.  U.S. Chairman of the Joint Chiefs of Staff General Mark Milley and Defense Secretary Lloyd Austin warned on Thursday that Ukraine faces a tough fight to achieve a successful counteroffensive.  Milley said that the counteroffensive will “likely take a considerable amount of time at a high cost” and that it is too early to make any predictions about its outcome.  Austin echoed this, saying that the counteroffensive is a “marathon, not a sprint.”  Austin also said that while Ukraine still has “a lot of combat capability,” it will need its allies to “dig deep” and continue providing military support to sustain the counteroffensive.  Their comments came at a meeting of the Ukraine Defense Contact Group in Brussels, the 13th such meeting of the body since the start of the Ukraine war.  Al Jazeera Politico Reuters 

Ukraine Reports Advances in Counteroffensive, Strong Russian Defenses.  Ukraine’s military said on Thursday that it has advanced in key areas of the front line and regained 100 square kilometers (38 square miles) of territory from Russian forces in its counteroffensive.  Brigadier-General Oleksii Hromov said Ukrainian forces have so far liberated seven settlements in the Donetsk and Zaporizhzhia regions and have made advances around Bakhmut and the southern city of Vuhledar.  Deputy Defense Minister Hanna Maliar added that Ukrainian troops have advanced towards the southern port cities of Berdyansk and Mariupol.  Despite this progress, Kyiv reports Russia is putting up intense resistance to the counteroffensive.  Maliar said attacking Ukrainian troops are facing Russian anti-tank guided missiles, airborne loitering munitions and mines in Russian-occupied areas and a senior Ukrainian military official  said that Russia was moving some of its best military units to reinforce the Bakhmut region.  Reuters Wall Street Journal

IAEA Chief Visits Zaporizhzhia Nuclear Power Plant After Kakhovka Dam Collapse.  IAEA Director General Rafael Grossi arrived at the Zaporizhzhia nuclear power plant in Ukraine on Thursday to assess impacts of the Kakhovka dam breach on the facility.  The collapse of the dam sparked safety concerns at the plant since it pulls water for cooling from the dam’s reservoir, which is now rapidly draining.  Russian state media reported that Grossi said that while the situation at the plant is “serious,” it still has sufficient amounts of cooling water and that “a number of measures” have been taken to stabilize the facility, including switching to other water sources like deep underground wells to replenish cooling water reserves.  He added that it remains “unrealistic” that Ukraine and Russia will agree to a deal on the plant’s security amid ongoing fighting.  Al Jazeera New York Times Reuters 

Chechen Military Unit Deploys to Russia’s Belgorod Region.  Ramzan Kadyrov, the Head of the Chechen Republic, on Thursday said his “Zapad-Akhmat” Chechen military unit has deployed to Russia’s Belgorod region to defend against “Ukrainian sabotage groups.”  Belgorod, which borders Ukraine, has been subject to cross-border incursions by pro-Ukraine Russian paramilitary groups in recent weeks.  The reported deployment came after Akhmat signed a contract with Russia’s defense ministry, which the Wagner mercenary group has refused to sign.  Reuters 

Russia Plans Elections in Occupied Ukraine in Bid to Signal Normalcy.  Russia’s central election commission on Thursday said regional elections will be held in Russia-occupied areas in Ukraine on September 10.  The votes will be held in Ukraine’s Donetsk, Luhansk, Zaporizhzhia and Kherson regions, which Russia annexed last September, though it does not fully control any of them.  Russian election officials say that both Russia’s Defense Ministry and the Federal Security Service (FSB) have concluded that it is possible to hold the elections.  Ukraine has said any elections held by Russia on Ukrainian territory are invalid and illegal.  Analysts say the elections are part of efforts by Russia to signal it will not give occupied territories back and to project normalcy in these areas amid Ukraine’s ongoing counteroffensive.  Politico Reuters

Asia and Oceania

Thailand Considering Chinese Engine for Chinese Submarine Purchase.  Thailand is reportedly considering a Chinese engine for a submarine it will purchase from China after Germany refused to give an engine.  Thailand agreed to buy the Chinese submarine in 2017 for $369 million following the Thai military junta’s 2014 coup, which soured Thailand’s relationship with the U.S.  The deal was disrupted last year after Germany refused to supply an engine for the submarine, saying it would not let its products be used for Chinese military exports.  China offered a Chinese engine at the time, but Thailand reportedly declined over quality concerns.   Sources say Thailand is asking Pakistan about its Chinese-made submarine fleet to assess the quality of their engines and is combing through the submarine deal’s contract for “loopholes” to address the engine problem.  Beijing is working to ensure the deal goes through as it will be an example for its dependability as an arms supplier.  Nikkei Asia

Japan Bolstering the Philippines’ Defense to Address China Tensions.  Japan is moving to increase military aid to the Philippines to address concerns over regional instability from Chinese aggression.  Analysts say Tokyo believes the Philippines would play a key role if China attacked Taiwan as it could plug defensive gaps in the region.  Retired admiral Katsutoshi Kawano told Reuters that possible aid for Manila could include radars that would be used to monitor the Bashi Channel — the waterway between Taiwan and the Philippines — as it is a choke point between the South China Sea and western Pacific.  Any aid from Japan will be limited by self-imposed restrictions on exports of lethal military aid, though export rules are expected to be loosened in the coming months.  Japanese officials have also indicated that the Philippines could give Japanese forces access to its military bases, as it does with U.S. troops, to help overcome export restrictions.  Experts add that Japan will likely have the most success in deepening security ties with the Philippines if it also focuses on economic issues and economic security.  Reuters

Shanghai Implementing High End Manufacturing Drive.  In the midst of an intense Chinese-U.S. technology rivalry, Shanghai has announced an ambitious plan to boost high end manufacturing in the city with a focus on the semiconductor and high-tech industry. The city published a three-year plan from 2023 to 2025 to “promote the high-quality development” of its manufacturing industry and lists preferred industries as semiconductors and artificial intelligence. By 2025, the city aims to have developed “world industry clusters” for integrated circuits, biomedicine, and artificial intelligence and increase the value output from 1.4 trillion Yuan in 2022 to 1.8 trillion yuan (US $251 billion) in 2025. This plan closely follows a decision by the central Chinese government to develop its own high-tech industry and become more self-reliant and shielded from U.S. sanctions in strategic technology sectors.  South China Morning Post 

Germany’s national security strategy ‘no surprise to China’ after Berlin echoes EU in warning of ‘systemic rivalry’.  Chinese analysts say that it is not surprising that Germany’s new National Security Strategy describes China as a “competitor and systemic rival,” but they say Beijing is concerned about how this may translate to actual China policy.  The strategy adds that economic reliance on key areas could “quickly evolve into significant security risks,” suggesting that dependence on China could cause similar problems that Berlin’s reliance on Russian energy posed at the beginning of the Ukraine war.  The language is similar to how the EU has used to describe China in its “de-risking” campaign.  Analysts say that while the strategy does not depict China as fully adversarial, it is unclear what German de-risking will look like, raising concerns that it may lead to overreaction or escalation.  South China Morning Post 

Part of Failed North Korean Rocket Recovered by South Korea.  South Korea’s military said on Friday that it recovered part of a North Korean rocket in waters west of the Korean peninsula on Thursday night, around two weeks after Pyongyang unsuccessfully attempted to launch the rocket to send its first spy satellite into orbit.  South Korea had already found smaller pieces of debris from the crashed rocket after deploying search teams, but faced difficulties due to poor visibility and strong tides.  South Korea’s Joint Chiefs of Staff said in a statement that the “salvaged object,” which may be part of a fuel tank, “will be thoroughly analyzed in cooperation with the United States.” Searches continue for the third stage of the rocket and its payload. The recovered debris could help scientists discover more features of the North Korean rocket, reveal how far the country has progressed with its intercontinental ballistic missile (ICBM) capability, and tell whether or not it breached sanctions to obtain materials from overseas. South Korea reports that Chinese ships have also been searching waters around the failed launch for debris, though it is unclear if they will continue salvage operations.  Reuters  

U.S. Guided-Missile Submarine Deployed to South Korea.  The U.S. deployed the nuclear-powered submarine USS Michigan to South Korea on Friday, marking the first such deployment in six years.  South Korea’s Defense Ministry said the USS Michigan, which can be armed with 150 Tomahawk missiles, is in the southeastern port of Busan, though the ministry did not say how long it will be there.  Officials say the submarine is in South Korea for joint exercises and to fulfill an agreement to enhance “regular visibility” of U.S. strategic assets in South Korea to help counter and deter North Korea’s nuclear and missile programs.  The USS Michigan’s deployment comes after North Korea launched two missiles in response to the joint U.S.-South Korean drills.  Associated Press

(Editor’s Note: Read more on a China-backed global hacking campaign, China’s new thorium nuclear reactor, Japan’s next supercomputer and the latest on E.U. restrictions on Huawei technology in the Cyber and Tech section below.)

Middle East and Northern Africa

Iran Tests Suicide Drones in Gulf.  Iran's military tested a suicide drone against a practice barge in Iran’s territorial waters in the Gulf of Oman according to a US official.  The official added that the test was essentially aimed at practicing targeting merchant vessels, which the U.S. has accused Iran of doing so on multiple occasions, namely following Iran’s recent seizures of tankers in Gulf waters. Iranian officials did not comment on the claims.  Reuters

Saudi Arabia Foreign Minister to Visit Iran.  Saudi Arabia’s Foreign Minister, Prince Faisal bin Frahn, will visit Tehran on Saturday to meet Iranian officials, according to Iran’s semi-official Tasnim news agency.  His visit comes after Saudi Arabia and Iran re-established diplomatic relations under a China-brokered deal.  Reuters

Palestine Increasingly Concerned Over Israeli Settlements.  Among escalating tensions and violence, Palestinians are growing increasingly concerned due to an increase in Israeli settler related tensions and violence in the West Bank.  U.S. and European officials have long expressed concerns that the settlements undermine efforts for a two-state solution.. Since taking power, Netanyahu’s government has supported the expansion of Israeli settlements in the West Bank and has allowed the return of settlers to four different settlements evacuated in 2005. Palestinians state that these actions have put their lives and property at risk. As expansion has continued, the United Nations has recorded 475 settler related incidents leading to casualties or property damage, the highest daily average since 2006. Netanyahu said last week the West Bank settlements were not an obstacle to peace despite them being one of the most contentious issues between Israel, the international community, and the Palestinians who say they undermine the possibility for a Palestinian state.  Reuters

Sub Saharan Africa

African Leaders Headed to Ukraine, Russia to Propose ‘Confidence Building Measures.’  A group of African leaders are meeting Ukrainian President Volodymyr Zelensky and Russian President Vladimir Putin in Kyiv and Moscow, respectively, on Friday and Saturday in an effort to mediate the conflict between Russia and Ukraine.  Senegal President Macky Sall and South African President Cyril Ramaphosa are leading the delegation, which also includes leaders from Zambia, the Comoros, and Egypt's prime minister.  A framework document of the group’s proposals seen by Reuters lists a number of “confidence-building measures” the group may suggest to encourage a ceasefire and wider negotiations.  The measures include a pull-back of Russian forces, the removal of Russian tactical nuclear weapons in Belarus, the suspension of the International Criminal Court warrant for Putin’s arrest, a long-term grain and fertilizer deal, and sanctions relief for Russia.  The framework document adds that Africa has an interest in ending the Ukraine war since resulting trade disruptions from the conflict have adversely impacted the continent.  The African peace effort adds to a number of Ukraine peace plans, including Kyiv’s own plan, which includes the full withdrawal of Russian forces from all Ukrainian territories.  Associated Press Reuters 

Cyber and Tech

Mandiant Reports China-Backed Hacking Campaign Exploiting Email Security Tool.  Cybersecurity researchers at Mandiant on Thursday said they have “high confidence” that suspected China-backed hackers were behind a campaign that exploited vulnerabilities in Barracuda Networks’ email security appliance to target public and private sector organizations globally.  The researchers said the hackers compromised the appliance to send malicious file attachments to gain access to targeted organizations’ networks.  Over half of the organizations were from the Americas and over 20 percent from Asia Pacific, including foreign ministries in Southeast Asia and foreign trade offices and academic organizations in Taiwan and Hong Kong.  Barracuda had said on June 6 that its email security appliance had been hacked as early as October and recommended organizations using the tool to fully replace their devices.  Mandiant’s report on the suspected Chinese hacking campaign comes ahead of U.S. Secretary of State Antony Blinken’s visit to Beijing.  A spokesperson for China’s Embassy in Washington rejected the report as “completely distorting the truth,” saying that China has “always firmly opposed and cracked down on all forms of cyber hacking.”  The spokesperson also accused the U.S. of conducting such cyber espionage operations, but without providing evidence.  Associated Press TechCrunch Mandiant

Microsoft Identifies GRU-Linked Hackers Behind Cyberattacks in Ukraine, NATO States.  Microsoft reports that a threat group linked to the GRU, Russia’s military intelligence agency, is responsible for multiple cyberattacks directed at systems of the Ukrainian government and private sector IT firms.  “Cadet Blizzard” has been identified as the group conducting the latest attacks; it previously was connected to data-wiping campaigns against Ukrainian targets leading up to Russia’s invasion in February 2022.  According to Microsoft, Cadet Blizzard also has been targeting NATO member states providing military assistance to Ukraine.  The Microsoft blog post pointed to the significance of this development, observing that “the emergence of a novel GRU affiliated actor, particularly one which has conducted destructive cyber operations likely supporting broader military objectives in Ukraine, is a notable development in the Russian cyber threat landscape.”  Notably, Cadet Blizzard is reported to operate independently of other GRU-affiliated hacking groups in carrying out destructive attacks, cyber espionage, hack-and-leak operations, and website defacement attacks.  C4ISRNet CyberScoop TheRecord BleepingComputer

Ukraine Military, Intelligence Targeted by Russian Group Employing ‘Backdoor’ Malware.  A Russian hacking group, Gamaredon, continues to conduct cyberattacks on Ukrainian military and intelligence organizations, according to the Symantec threat research team.  The group, also known as Armageddon and Shuckworm, is reported to be deploying “a refreshed toolset and new infection tactics.”  These include the use of USB malware capable of spreading to additional systems inside infected networks.  Symantec researchers report that the threat group continues to employ phishing emails for initial compromise of government, military, security, and research organizations, focusing on their human resources departments.  Symantec cited one instance in which a targeted device was compromised after an infected USB key was plugged in. However, it is unclear how the USB drive became infected in the first place.  Symantec warned that USB drives “are likely used by the attackers for lateral movement across victim networks and may be used to help the attackers reach air-gapped machines within targeted organizations."  Gamaredon has been linked to Russia’s foreign intelligence arm, the FSB.  BleepingComputer

European Commission Expected To Ban Huawei, ZTE Equipment from Internal Networks.  The European Commission is expected to include a ban on equipment from Chinese telecommunications vendors Huawei and ZTE in its new 5G network guidance, according to “people familiar with the matter.”  Under a new EU plan concerning 5G mobile networks, Community members reportedly will be under increased pressure to phase out equipment from the Chinese vendors.  For the first time, the EU guidance is expected to identify the companies by name.  While most EU member states have not taken action to ban the Chinese vendors’ equipment, some EU member states like Sweden have done so.  It has been reported that the Commission has become increasingly frustrated by EU countries that rely heavily on Huawei equipment, including Germany.  Representatives for the Commission as well as Huawei and ZTE did not immediately respond to requests for comment.  Bloomberg

CISA, FBI, Global Cybersecurity Agencies Issue Report on Prolific LockBit Threat Actor.  An international analysis of the LockBit ransomware gang has concluded that the threat actor was responsible for “one in every six” ransomware attacks on U.S. government organizations in 2022.  The report issued by CISA, the FBI and cybersecurity agencies of Australia, Canada, Britain, Germany, France and New Zealand highlighted that the Russia-linked group is “one of the biggest cybersecurity threats” to government and private sector organizations around the world. Based on victim lists posted to its leak site, LockBit is responsible for at least 1,653 ransomware attacks, which has earned the group about $91 million from U.S ransom payments alone.  The multinational report contained statistics from each country indicating Lockbit’s attack frequency.  Australia reported that the gang was responsible for 18 percent of total ransomware incidents while Canada and New Zealand documented LockBit involvement in just over 1 in 5 attacks in 2022.  U.S. statistics showed the threat group conducted 16 percent of attacks on the public sector, including local governments, public higher education and K-12 schools, as well as on law enforcement agencies.  Tom Kellermann, a cybersecurity official in the Obama administration, noted that the increasing number of LockBit attacks has helped Russia offset Western sanctions by affiliating itself “with cybercrime cartels that enjoy a pax mafiosa with the Russian government.”  TheRecord BleepingComputer

French President Urges European Surge in AI Development, Forward-Looking Rules.  French President Emmanuel Macron struck a note of urgency Wednesday in comments at the Vivatech tech exhibition in Paris, warning that Europe is ““too far behind in terms of innovation and we’re regulating too slowly.”  Macron called for accelerating AI development on the continent at the same time as creating “smart” regulations that do not get in the way of company innovation.  Regarding the AI “trilogue” taking place among the EU member states, the European Parliament, and the European Commission, Macron described it as a “good debate,” but predicted that by the time an AI Act is approved and implemented, “we’ll have regulated on presuppositions and knowledge that are almost already obsolete.”  He noted that French institutional investors have committed $7.6 billion to Tibi 2, a national initiative to support tech innovation.  Macron also touted French AI research while appealing for more local startups in the technology.  In terms of competition, Macron said “we’re leaders in continental Europe.  We’re being slightly outdone by the British, who have created champions, but it’s not impossible to catch up.”  Macron conceded that U.S. and Chinese AI R&D initiatives are well ahead of European counterparts.  He also mentioned that he will meet with Tesla and SpaceX chief Elon Musk on Friday to discuss AI and social media regulation along with “promoting France and Europe’s attractiveness.”  Associated Press Bloomberg

Bipartisan Senate Bill Seeks Protections for U.S. Data from Foreign Exploitation.  A bipartisan Senate bill introduced on Wednesday by Sens. Ron Wyden and Cynthia Lummis calls for restrictions on the export of U.S. citizens’ personal data to “hostile nations” and limits foreign-owned companies from accessing U.S. data from abroad.  Wyden said in a statement that the proposed export changes would “turn off the tap” of data flowing to adversaries, noting that “massive pools of Americans’ sensitive information — everything from where we go, to what we buy and what kind of health care services we receive — are for sale to buyers in China, Russia and nearly anyone with a credit card.”  The new legislation, known as Protecting Americans’ Data from Foreign Surveillance Act is also co-sponsored by Sens. Bill Hagerty, Martin Heinrich, Marco Rubio, and Sheldon Whitehouse.  The bill would require the Commerce Department, working with other agencies, to identify “categories of personal data that, if exported, could harm U.S. national security.”  The department also would identify low-risk countries — “where data can be shared without restrictions” — and high-risk countries — ”where exports of sensitive data will be blocked.”  TheRecord South China Morning Post FCW

Japan Covering Half of Costs for $100 Million Generative AI Supercomputer.  Japan’s Ministry of Economy, Trade and Industry (METI) has agreed to pay for half the cost of a new Japanese supercomputer being built in Hokkaido.  METI said it will subsidize 6.8 billion yen ($48.2 million) of the 13.5 billion yen costs to build the machine.  The supercomputer is being built by Saukra Internet and is expected to become operational as soon as next year.  It will specialize in providing large language model training for generative artificial intelligence (AI) development.  In return for METI’s support, Sakura Internet will allow startups and other users to use the supercomputer’s processing capabilities at inexpensive rates.  The Sakura Internet supercomputer is set to triple Japan’s processing capabilities.  Nikkei Asia

China Approves Nuclear Reactor Run on Thorium — Which Could Generate Power for 20,000 Years.  China’s National Nuclear Safety Administration issued an operational permit for China’s first thorium reactor.  The permit allows the Shanghai Institute of Applied Physics of the Chinese Academy of Sciences to operate the reactor — a two-megawatt liquid-fuelled thorium molten salt reactor (MSR) — for 10 years in the Gobi Desert city of Wuwei in Gansu province.   Thorium MSRs use liquid fuels as both a fuel and a coolant.  They are safer, more efficient and produce less waste than traditional uranium reactors.  Uranium is also scarcer than thorium, which China has significant reserves of.  Other countries, like the U.S. and India, have built thorium reactors, but these past efforts have only been experimental and have not progressed to commercial use.  If the Wuwei reactor is successful, it will mark a significant leap forward for China’s nuclear technology development.  South China Morning Post

Read deeply-experienced, expert-driven national security news, analysis and opinion inThe Cipher Brief