US government contractor pleads guilty to spying for Ethiopia

November 14, 2026 by Leave a comment

Tigray War EthiopiaA FORMER UNITED STATES government contractor has pled guilty to conspiring to transmit national defense information to Ethiopia, admitting he passed Top Secret material to senior Ethiopian officials during an armed conflict in the country. Abraham Teklu Lemma, a 53-year-old Ethiopian-born naturalized American citizen residing in Maryland, pled guilty earlier this month to conspiracy to transmit national defense information to a foreign government.

Lemma was arrested on 24 August 2023 following a Federal Bureau of Investigation (FBI) counterintelligence investigation into his activities and relationships with Ethiopian government officials. He previously worked as an information technology contractor for three US government agencies: the National Reconnaissance Office, the Department of State, and the Department of Justice (DoJ). At the time of his arrest, Lemma held concurrent positions as an information technology administrator at the Department of State and a management analyst at the DoJ, with access to classified government information under a Top Secret/Sensitive Compartmented Information (TS/SCI) security clearance.

According to the DoJ, from 2021 until his arrest in August 2023, Lemma conspired with senior Ethiopian government officials to collect and transmit a significant volume of classified documents, notes, photographs, and other materials, which were classified up to the Top Secret level. Lemma’s court indictment adds that unauthorized disclosure of material assigned as Top Secret could reasonably be expected to cause “exceptionally grave damage to the national security” of the US.

According to the DOJ, much of the classified material illegally shared by Lemma, including satellite imagery and details of military activities, centered on the armed conflict in Ethiopia. Though the release does not name the conflict or the groups involved in Lemma’s case, the period in question overlaps with the civil war between the Ethiopian federal government and the Tigray People’s Liberation Front (TPLF), which lasted from 2020 until 2022.

It is alleged that during this period Lemma took several steps to conceal his conduct and communications. He reportedly corresponded with his conspirators through encrypted messaging apps and handwritten notes containing classified information, which he had previously carried out of secure US government facilities. Court documents state Lemma also removed electronic versions of classified information from secure government repositories. Read more of this post

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , ,

Rare exposé examines secretive world of pro-Ukraine Russian intelligence operatives

November 7, 2026 by 1 Comment

Yelabuga RussiaLAST MONTH, A BBC World Service documentary provided a rare account of Russian citizens working for Ukrainian intelligence inside Russia. The documentary focused on two unnamed Russian men who claimed to be secretly operating for the Ukrainian Main Directorate of Intelligence (GUR) and to have successfully helped carry out kinetic operations against Russian military assets and personnel.

The BBC premiered the documentary, “Shadowmen: Russians Working With Ukraine” on 19 October. It was produced by veteran Polish journalist Marcin Mamon, who participated during the Cold War in opposition activities against Poland’s pro-Soviet communist government. Mamon claimed that the BBC independently confirmed both Russian men operated on behalf of the GUR, but added it was impossible to “know the full picture”.

Mamon also noted that both the GUR and the two Russian operatives were cautious about sharing details of their activities inside Russia, which made their claims impossible to verify. As a matter of policy, Ukraine never officially claims responsibility for targeted attacks. However, Ukrainian officials have spoken in the past about Ukraine’s strategy of carrying out coordinated drone strikes inside Russia and have acknowledged Kyiv’s use of clandestine agents on Russian soil.

‘IVAN’ AND ‘FOMA’

Those interviewed in the BBC documentary, using the pseudonyms ‘Ivan’ and ‘Foma’, claimed to have had roles in various operations targeting Russian military assets and personnel, which were carried out in coordination with the GUR. The operatives claimed to oppose both Russia’s invasion of Ukraine and the government of President Vladimir Putin. They maintained throughout the documentary that Putin’s political future depended on the outcome of the war, with Ivan adding “At the moment […] I think [Putin’s] regime might fall if they lose the war […]. Through our actions […] we are trying to speed this up”.

Mamon said he established and maintained contact over a period of two years with Ivan—a self-proclaimed Russian patriot and former member of the domestic political opposition to Putin’s government. Ivan allegedly operates inside Russia, where he claims to have surveilled Russian military sites and identified locations to conceal drone components in preparation for potential attacks on Russian assets. Ivan provided several videos to Mamon, including one of him appearing to hide explosives near a Russian military airfield. According to the other operative—alias Foma—who claimed to run a network of undercover operatives inside Russia, Ivan was involved in a June 2025 strike on Russia’s military drone plant in Yelabuga (pictured).

Foma, a Russian living in exile in Poland, said his network of volunteers inside Russia had surveilled the movements of senior military officers that the GUR was considering targeting. Foma contended he was formerly a part of the Russian elite and claimed to have a unique set of contacts and a steady flow of insider information from inside Russia. The documentary also identified Russian journalist and human rights activist Tatiana Kosinova, and anthropologist Denis Sokolov as working alongside Foma in Warsaw. Read more of this post

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , ,

OpenAI engineer accused of planting recording device remains in pre-trial detention

October 22, 2026 by 4 Comments

OpenAIA COURT IN THE United States has granted a request by government prosecutors to prolong the pre-trial detention of Abdulrahman Alfozan, an OpenAI employee, who was arrested by the Federal Bureau of Investigation (FBI) on 9 October 2026. The 35-year-old Saudi national has been charged with attempting to use a recording device to intercept oral communications at the headquarters of OpenAI, where he worked. According to the FBI, Alfozan was attempting to “secretly capture sensitive communications about [OpenAI’s] super intelligence technology”.

Concerns about the engineer’s behavior reportedly started when OpenAI staff discovered a listening device wrapped in toilet paper on 30 September. This prompted an internal investigation, in which OpenAI analyzed the device using its own artificial intelligence (AI) models. The investigation concluded that the device had been installed on or around 28 September. It also determined that the device was highly sophisticated and included advanced encryption, audio monitoring capabilities, as well as a means of transferring intercepted data whilst evading monitoring. Following this discovery, the company referred the case to the FBI.

The affidavit states that Alfozan appears on footage captured on October 5 by a hidden close-circuit surveillance camera at the company’s San Francisco headquarters. The footage shows Alfozan entering a conference room, which he had no authority to access. He then appears to check a device plugged into a television inside the room. The affidavit adds that OpenAI executives frequently use the room for internal leadership meetings, often involving “highly confidential, technical, commercial and strategic information, including proprietary research, product plans, and business development opportunities”.

The complaint also alleges that, prior to installing the device’s, Alfozan used an AI productivity tool to inquire about OpenAI’s buildings, meeting rooms, calendars, and executive locations. It also alleges that a chatbot associated with Alfozan’s spouse—who has not been charged in connection with this case—submitted prompts about building and encrypting an audio recording device.

Alfozan had worked as an engineer at OpenAI for 15 months prior to his termination. According to Al Jazeera, Alfozan’s LinkedIn profile lists earlier roles at Meta and Microsoft. Court filings allege Alfozan had booked one-way flight tickets to Saudi Arabia for himself, his wife, and another relative, scheduled for 12 October. The Saudi national’s connections to the Gulf State’s ruling family are not explicitly known; however, he is allegedly listed as a partner at Raed Ventures, a venture capital firm based in Riyadh. Prince Khalid bin Bader al Saud, a member of the Saudi Royal family, is also a Raed Ventures partner. Read more of this post

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , ,

US prosecutors drop case against ex-CIA analyst charged with spying for South Korea

October 19, 2026 by 5 Comments

NIS South Korea - MJUNITED STATES FEDERAL PROSECUTORS have agreed to defer the prosecution of Sue Mi Terry a former Central Intelligence Agency (CIA) analyst and White House National Security Council (NSC) official, who is accused of secretly acting as an unregistered agent of South Korea’s National Intelligence Service (NIS). The deal could terminate the case against Terry in 12 months.

The deferred prosecution agreement was /filed on 13 October. Prior to the deferment, Terry was set to stand trial in a Manhattan federal court on two felony charges of conspiracy to violate the Foreign Agents Registration Act (FARA) and failure to register under FARA.

Born in Seoul and raised in the US state of Virginia, Terry served as a senior CIA analyst during 2001-2008, and as the Director for Korean, Japan, and Oceanic Affairs at the NSC during 2008-2009 under Presidents George W. Bush and Barack Obama. At the time of the indictment, Terry worked as a senior fellow for Korea Studies at the Washington, DC-based Council on Foreign Relations.

The espionage case against Terry dates to July 2024, when she was indicted on charges of acting as an unregistered agent working on behalf of South Korean intelligence. Prosectors alleged that over roughly a decade, Terry received luxury handbags and clothing, upscale meals, and tens of thousands of dollars in research funding from South Korea’s NIS.

In a September 28, 2026, filing opposing Terry’s motion to suppress evidence, prosectors alleged that the money came from the “highest levels” of NIS. They added that while Terry was aware of the support, “she sought to conceal the source of the NIS funds from the Woodrow Wilson Center, where she was then employed”. The prosecutors also publicly named three NIS case officers who purportedly had contact with Terry.

The two-page deferred prosecution agreement (DPA) allows for the prosecution to be suspended for 12 months, after which all charges will be dropped, provided that Terry complies to all terms set out in the DPA. In the DPA, Terry concedes to various charges, including accepting a Bottega Veneta handbag, a Louis Vuitton handbag, and a Dolce & Gabbana coat from South Korean officials, reportedly totaling $9,245. She also acknowledges raising approximately $37,000 for her research work, funded by checks that were issued directly from the South Korean embassy in Washington, DC. Read more of this post

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , ,

FBI arrests woman accused of spying on Taiwanese president’s son

October 15, 2026 by 1 Comment

Wanying ZhangTHE UNITED STATES FEDERAL Bureau of Investigation (FBI) has arrested a California woman for operating as an unregistered agent of a foreign state. The woman is accused of covertly surveilling the son of Taiwan’s president on behalf of Chinese government.

Wanying “Heather” Zhang, a 34-year-old naturalized U.S. citizen, was apprehended by FBI officers at Los Angeles International Airport on 4 October, shortly prior to boarding a flight to Shanghai. According to First Assistant US Attorney Bill Essayli, Zhang, a real estate agent, “used tradecraft to avoid detection” prior to her apprehension by federal agents.

Although the federal criminal complaint does not mention the alleged target’s name, the FBI’s rapid response account on the social platform X stated Zhang surveilled the residences of Taiwanese President Lai Ching-te’s son. Zhang allegedly travelled to Seattle in September 2025, filmed the home and vehicles of Lai’s son and family, and forwarded recorded footage and license-plate details to Chinese officials.

According to the FBI affidavit, Zhang attended the University of International Relations in Beijing, which is said to have a close affiliation to China’s Ministry of State Security—China’s primary intelligence organization. In January 2025, Zhang allegedly travelled to China to meet with an official, who is a graduate of the same university. According to records obtained by a search warrant pertaining to Zhang’s iCloud account, two months after the meeting, the pair exchanged WeChat messages containing the address of a Taiwanese official who had criticized Beijing. It is understood that Zhang visited China again in June 2025 and met with another Chinese official, who allegedly instructed her to surveil the Taiwanese president’s son.

According to an investigation by CBS television, after her move to the US, Zhang studied at the University of Southern California before obtaining her real estate license in 2016. She reportedly became involved with advocacy groups for Chinese Americans; in 2022, she attended an “entrepreneurship competition” for Chinese students, alongside officials from the Chinese consulate. She was also reportedly involved in the All American Chinese Association—photographs from 2023 show Zhang marching through San Francisco during President Xi’s visit. Read more of this post

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , , ,

Finland to probe mysterious intrusions of elected officials’ homes

October 12, 2026 by 1 Comment

Parliament of FinlandPOLICE IN FINLAND HAVE opened a preliminary investigation into suspected intrusions at the homes of members of Parliament (MPs), after several of them reported unexplained signs of unauthorized entry at their residences.

Officials with the Helsinki Police Department, which is leading the preliminary investigation, said the first break-in was reported about a year ago. As in subsequent incidents, there were no obvious signs of forced entry, and nothing appeared to have been stolen. However, several doors were left open and lights switched on, which residents said they did not remember leaving that way.

According to Yle, Finland’s state broadcaster, the Parliament’s First Deputy Speaker Paula Riskikko learned about the first suspected intrusion on the evening of 23 September. Upon learning of subsequent break-ins, Riskikko informed the Parliament’s Director of Security, Aaro Toivonen, who then convened a meeting with leaders of Parliamentary groups to discuss security concerns. The meeting aimed to establish how pervasive the intrusions were across MPs’ residences, as more cases emerged.

At a press conference held at the Finnish Parliament, Speaker Jussi Halla-aho suggested the intrusions could be part of a deliberate tactic to signal that intruders can access MPs’ homes at will, and said the behavior was “associated with state actors”. He added that officials do not yet know the exact number of MPs affected, but described the incidents as “significant”, emphasizing that there was no information concerning the motive or those responsible. Finnish President Alexander Stub, also spoke about the reported incidents, saying that “an attack on a member of parliament is an attack on democracy”.

Some have suggested that the incidents may be connected with the upcoming Finnish parliamentary elections, which are scheduled to be held in six months. Asked by a reporter if foreign involvement was likely, Prime Minister Petteri Orpo said it was “very possible, quite possible in this day and age.” He added that the break-ins raise the risk of election interference, and noted they must be monitored meticulously. Orpo also pointed to the possibility of foreign involvement, stating: “We see in several European countries that Russia has sought to influence elections”.

Finland shares a 1,320-kilometer (830-mile) border with Russia and ended decades of military non-alignment by joining the North Atlantic Treaty Organization in April 2023. Helsinki has previously accused Moscow of conducting hybrid warfare, including orchestrating a surge of migrants at the Finnish-Russian border in late 2023. There is currently no evidence that the break-ins are intended to influence the upcoming election or intimidate MPs, or that they form part of a foreign-directed malign influence campaign.

► Author: Molly Jones | Date: 12 October 2026 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , ,

Japan officials discuss strengthening counterespionage, establishing CIA-like agency

October 9, 2026 by 3 Comments

Sanae TakaichiJAPAN HAS HELD THE first meeting of an expert panel to discuss strengthening intelligence capabilities and anti-espionage measures. The agenda included weighing proposals for establishing a new foreign-oriented intelligence agency, as the Japanese government seeks to address long-standing gaps in its counterespionage posture and laws.

The closed-door session took place in late September. It was joined by Japanese Prime Minister Sanae Takaichi, who led a 17-member panel of officials. The session reportedly focused on strengthening Japan’s intelligence capabilities and planned the drafting of a formal medium and long-term national intelligence-strategy document.

The panel reviewed counter-espionage legalization through establishing a new foreign interference prevention law, among other legal innovations. Japan has lacked a comprehensive anti-espionage law since Allied occupation authorities dismantled most of its intelligence-gathering apparatus following World War II. The lack of an anti-espionage law has limited the nation’s ability to prosecute spies and negotiate exchanges for Japanese nationals detained abroad.

The panel also discussed the creation of an external intelligence agency, comparable to the United States Central Intelligence Agency. Such a body was affirmed as a priority in the October 2025 coalition agreement between Takaichi’s Liberal Democratic Party and the Japan Innovation Party, with the new agency reportedly set to be established by early 2028. If realized, such a move would represent a significant shift in Japan’s intelligence infrastructure.

Following the meeting, Prime Minister Takaichi held a press conference in which she expressed her concerns over what she referred to as the increasing threats to Japan’s advanced technology, cyberattacks targeting both public and private sectors, and the challenge of foreign disinformation campaigns. She highlighted the need to expand Japan’s foreign intelligence capabilities to prevent “undue interference from abroad”, referring to increased cooperation between China, North Korea and Russia, and the threats it presents.

Since taking office in October 2025, Takaichi has made intelligence and security reform a top policy priority of her government. She has repeatedly stated her intention to increase Japan’s intelligence and counterespionage capabilities, with the aim of addressing growing security threats. TextIn March 2026, Takaichi’s administration adopted a bill to establish the Japanese equivalent of the Committee on Foreign Investment in the United States (CFIUS), aimed at tightening scrutiny of foreign investment in sensitive sectors. In July 2026, the Japanese government launched the National Intelligence Council—chaired by Takaichi herself—and the National Intelligence Bureau, both of which are tasked with collecting intelligence related to national security and public safety.

► Author: Molly Jones | Date: 9 October 2026 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , ,

Germany arrests former BND spy chief on suspicion of espionage, treason

October 7, 2026 by 1 Comment

BND BerlinON THE MORNING OF October 6, 2026, news broke that German investigators had arrested August Hanning at his home in Nordwalde, near Münster, on suspicion of espionage and the disclosure of state secrets, potentially constituting treason. The 80-year-old Hanning is also accused of attempted treason and of acting as an agent for a foreign intelligence service.

These are serious allegations that could have grave consequences for the Germany, given that Hanning was head of the Bundesnachrichtendienst (BND), Germany’s civilian foreign intelligence service, from 1998 to 2005. After leaving this position, Hanning served as a Staatssekretär (state secretary—the highest-ranking civil servant) at the Federal Ministry of the Interior. What is publicly known at this time is that Hanning is suspected of having illegally gained access to classified BND information for several years after leaving his position there. He allegedly received this information from his former office manager (Büroleiter), identified only as Manfred D., who has also been arrested.

The Federal Prosecutor’s Office, which is in charge of the case, reportedly became aware of Hanning’s suspected activities after it raided a number of private and business premises used by Hanning. The searches took place in connection with a cross-border custody case involving the attempted kidnapping of two children in Denmark on behalf of their mother. Hanning has always denied any involvement in the alleged kidnapping attempt or other wrongdoing related to the custody case.

On the intelligence front, it is now alleged that Hanning and his former colleague, “D.”, agreed as early as 2010 that “D.” would provide material to his former superior. The material found during the investigation indicates that this arrangement continued at least until June 2022. Overall, it appears that Hanning received close to 2,000 documents. “D.” most likely received payments for providing the documents—although the amount is not currently known. The former office manager himself retired in March 2026, after serving as head of office for several of Hanning’s successors.

In at least one case, Hanning appears to have used confidential material (Verschlusssache) to produce an analysis intended for “an agent of a foreign intelligence service”. It is currently unclear whether this analysis was merely drafted, or whether it was also delivered to the foreign agent. While it is not known which foreign country the intelligence service belongs to, it was almost immediately alleged that it is not Russia. This has the hallmarks of a controlled leak by the German authorities, who presumably wish to advertise this with a very high degree of certainty to the German public and their allies alike.

In another case, Hanning stands accused of having used information from BND documents in his communications with an agent of a foreign power.

Many of the documents and pieces of information provided were intelligence reports prepared for the weekly high-level meeting of Germany’s security services at the Federal Chancellery. Some of the reports are described as highly sensitive, dealing with topics such as the Iranian nuclear program or the Russian Armed Forces. Material from allied intelligence services might also have been handed over to Hanning. Read more of this post

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , ,

Israeli expert warned of aviation security breach risk prior to Flydubai hijack attempt

October 5, 2026 by 2 Comments

FlydubaiAN ARTICLE PUBLISHED LAST summer in Mabat Malam, the journal of the Israel Intelligence Heritage and Commemoration Center, identified “insider threats”, ranging from aircrew members to airport employees, as major dangers to civil aviation. The article, “Terrorist Attacks on Civil Aviation: A Threat That Must Not Be Ignored”, was authored by Danny Shenar, former Director of the Security, Emergency and Cyber Division at Israel’s Ministry of Transport. It was published in July 2026, ahead of the summer vacation season and the expected increase in the number of Israelis traveling abroad.

In his article, Shenar highlights a recognized vulnerability in aviation security: the insider threat. This refers to the danger that someone within the aviation system, with authorization and access to sensitive systems or restricted areas, could exploit authorized access to circumvent security measures. In light of this week’s serious incident on a Flydubai flight to Israel, Shenar’s warnings highlight the need for Israeli professionals responsible for civil aviation security to remain alert to vulnerabilities in the security system. The similarity between the incident and the scenario identified by Shenar does not necessarily mean that the event was a terrorist attack—something that has not yet been established. Rather, the similarity lies in the possibility that the risk may have originated within the system itself, from an individual on the aircraft’s crew with direct access to the cockpit and the aircraft’s systems.

Shenar’s article addresses what he calls “the reliability of personnel authorized to access restricted areas, the ‘Trojan horse'”. While an ordinary passenger undergoes security screening before boarding an aircraft, an airport employee or another person authorized to enter restricted areas may already be on the other side of the security perimeter. If such a person becomes hostile, they may exploit their authorized access to circumvent protective mechanisms. “The insider threat is a significant vulnerability”, Shenar wrote. “A single radical employee is enough to circumvent the entire security system and assist in introducing prohibited materials into restricted areas”. Read more of this post

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , ,

U.S. charges Cuban national with conspiracy to finance terrorism on behalf of Russia

October 1, 2026 by 3 Comments

PetrozavodskUNITED STATES AUTHORITIES HAVE charged a Cuban dance teacher living in Russia with conspiracy to finance terrorism. According to the U.S. government, the Cuban national used the online alias “Dios” while coordinating a series of arson attacks across four European countries on behalf of the Russian intelligence services.

A recent investigation by German state broadcaster Deutsche Welle identified the individual behind the alias “Dios” as Oemis Romagoza Durruthy, a Cuban national. Born in Camagüey, Cuba, Romagoza has been living in Russia for at least the past seven years. He appears to work as a Latin dance teacher in “Made in Cuba”, a dance studio in the northern city of Petrozavodsk. After he reportedly faced financial strain, in 2023 Romagoza began to use Facebook to recruit individuals from Latin America looking for work in Poland or Ukraine. He would then transition the encrypted application Telegram to communicate with those interested in speaking with him, offering them $1,500 for each completed “operation”.

Romagoza’s recruits were largely Spanish-speaking migrants, Ukrainian refugees, and local youths with no prior connection to Russia or the Russian intelligence services. Investigators claim they were able to identify at least 12 such individuals who were recruited by Romagoza and directed to carry out surveillance and sabotage across Europe. These recruits were typically employed online and had no knowledge of their real employers (i.e. Russian intelligence) or the intended objective of their assignments.

One of Romagoza’s alleged recruits was Luis Alfonso Murillo Diosa, a 34-year-old Colombian national. Romagoza initially contacted Diosa in a Latin American-themed Facebook group for users seeking to join the Ukrainian military. Romagoza offered Murillo a “special mission” in Europe instead of deployment to Ukraine. He also reportedly offered to coordinated Murillo’s travel and logistics in Europe. Without ever meeting Murillo in person, Romagoza instructed him to travel to Bucharest in July 2024 and take photos of a recycling facility and an oil well. Murillo was then instructed by Ramagoza to start a fire. However, Murillo was apprehended by Romanian officials. Upon his arrest, he claimed he did not intend to commit arson and told Romanian investigators he did not know who he was working for. Romanian authorities eventually sentenced Murillo to six years in prison for attempted sabotage in 2025.

U.S. authorities claim that Romagoza’s network was active between June and September 2024. During that time, the network allegedly set fire to two construction-supply businesses in Poland, a bus garage in the Czech Republic, a Romanian recycling facility, and a Lithuanian warehouse filled with equipment destined for Ukraine. Read more of this post

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , , , , , ,

Men with Russian links charged with conspiracy to infiltrate US Secret Service

September 28, 2026 by 2 Comments

US Secret ServiceTWO MEN HAVE BEEN charged with conspiracy to commit wire fraud after allegedly concealing a software company’s Russian ownership from the United States government and trying to work as contractors for the Secret Service. Founded in 1865 and currently operating under the Department of Homeland Security, the Secret Service is a federal law enforcement agency with a dual mission of protecting America’s national leaders and investigating financial crimes.

On September 20, American and British authorities arrested Lee Reiber, a 55-year-old American who served as chief executive officer (CEO) of Oxygen Forensics, and Oleg Davydov, a 52-year-old Russian national, who co-founded the company and served as its chief technology officer. Reiber was arrested in the US state of Idaho and Davydov was apprehended at London Heathrow Airport in the United Kingdom prior to boarding a flight to Istanbul, Turkey. The US is expected to seek his extradition in the coming days. Shortly prior to the arrests of the two men, US authorities reportedly seized 57 internet domains, cyber infrastructure, and corporate bank accounts owned by the firm.

Based in Alexandria, Virginia, Oxygen Forensics develops software to recover, preserve and analyze electronic data from digital devices. Davydov originally founded a Russian-based predecessor company, Oxygen Software LLC (renamed to MKO Systems LLC in September 2022), in 2000. That company sold the same software directly to Russia’s Federal Security Service (FSB), Investigative Committee of the Russian Federation (ICRF), and Ministry of Internal Affairs. Davydov established Oxygen Forensics in 2013, with Reiber joining in 2015. In March 2022, one month after the invasion of Ukraine and the US-imposed sanctions on Russia, Reiber was named its CEO, president, and chairman of the board.

According to court filings, the firm’s Russian owners were removed from the company’s public corporate filings following Reiber’s appointment that same month. Prosecutors allege Davydov and four other Russian nationals continued to secretly own and control the company through a Cyprus-based holding company. According to an affidavit filed with the criminal complaint, affected entities include the US Department of Defense and three components of the US Department of Homeland Security. Read more of this post

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , ,

US indicts members of Russian spy cell for plotting assassinations on US, European soil

September 21, 2026 by 3 Comments

IndictmentTHE UNITED STATES DEPARTMENT of Justice unsealed last week charges against members of an alleged Russian intelligence network that planned a series of targeted assassinations in the United States and Europe. According to the indictment, the accused are part of a broad effort by the Russian state that amounts to a “global assassination network”—termed “intelligence services of the Russian Federation”, or “RIS”, network.

Three of the accused are believed to be senior members of the RIS network. They are: Yuri Khrameev, 63; his biological son, Kirill Khrameev, 27; and Oemis Romagoza Durruthy, 35. The elder Khrameev is a retired intelligence officer who claims to have reached the rank of colonel and has stated at least once that he worked alongside Russian President Vladimir Putin in the past. The younger Khrameev is believed to hold a mid-level rank in Russia’s Federal Security Service (FSB). The indictment describes Durruthy as a well-known member of the Cuban expatriate community in Russia, who has operated internationally as a member of the RIS network.

The fourth suspect is named as Yaidel Delgado Suarez (known as “the Viking”), who, like Durruthy, is a Cuban expatriate living in Russia. The remaining suspect is named as Angel Eduardo Castro, a 22-year-old Venezuelan. Notably all five suspects remain at large and are believed to reside in Russia. The Khrameevs and Durruthy are Russian citizens. Durruthy is also a Cuban national, as is Suarez—the latter’s status described in the indictment as that of “a Cuban national living in Russia”. Castro is referred to as a “Venezuelan national living in Russia”. It is therefore not known whether Suarez and Castro also hold Russian citizenship—though they most likely do.

According to the indictment, in the summer of 2026 Suarez and Castro recruited a Venezuelan citizen who was living in the New York area. The unnamed Venezuelan, who is referred to in the indictment as “Resident 1”, agreed to engage in reconnaissance activity in the vicinity of a house where the RIS network believed an exiled Russian dissident resided. In exchange for his services, “Resident 1” was promised between $1,000 and $1,500. The recruit was also offered $40,000 in exchange for assassinating the RIS network’s target, but appears to have declined the offer. Read more of this post

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , , , , , , ,

Germany charges businesswoman with espionage, expels her alleged Russian handler

September 19, 2026 by Leave a comment

Russian embassy in GermanyGERMAN FEDERAL PROSECUTORS HAVE formally charged a businesswoman with espionage on behalf of Russian intelligence, claiming she was tasked with gaining access to political and military circles in Germany. The woman, 56, officially identified only as Ilona W., is believed to hold German, Russian, and Ukrainian citizenship. She was arrested on January 21, 2026, and remains in pre-trial detention. The indictment was filed by Germany’s Federal Public Prosecutor’s Office on September 7, 2026.

The woman reportedly ran a consulting firm in Berlin and chaired a lobbying association. Through her role, she allegedly gained substantial access to elite political and military spheres across Germany. Prosecutors allege she had been in contact with a Russian intelligence officer stationed at the Russian Embassy in Berlin since October 2023. Throughout this time, it is alleged she provided her handler with intelligence on high-value political events. This information enabled him to attend some of these events under a false identity, with the aim of cultivating contacts for intelligence purposes.

The woman reportedly attended the events herself in order to identify and recruit potential contacts and targets—particularly from Germany’s Defense ministry and defense industry. Prosecutors claim she “compiled background information on participants in high-profile political events and gathered information on arms industry sites, drone tests and planned deliveries of drones to Ukraine”. The woman was also photographed at the December 2025 German-Ukrainian Economic Forum in Berlin, seated several rows behind Ukrainian President Volodymyr Zelenskyy and German Chancellor Friedrich Merz. It is also claimed the alleged spy cultivated a former head of the German Air Force’s 61st Test and Evaluation Center and a retired officer from Büchel Air Base, which stores United States nuclear weapons. Neither individual was detained and it remains unclear whether she obtained valuable intelligence from either of them.

The woman’s arrest triggered an immediate diplomatic confrontation between Berlin and Moscow. Within 72 hours of her detention, the German government expelled a Russian diplomat, identified as Andrei Mayorov, a colonel at the Main Directorate of the Russian Armed Forces’ General Staff—commonly known as GRU. Mayorov was serving as a deputy military attaché at the Russian Embassy in Berlin. He is accused of directing the alleged spy’s intelligence-gathering activities. His expulsion drew strong condemnation from Moscow, which vowed to retaliate.

This case reflects a broader pattern of Russian intelligence activity across Europe following the 2022 Russian invasion of Ukraine, which blurs the line between legitimate diplomatic activity and covert intelligence-gathering.

► Author: Molly Jones | Date: 19 September 2026 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , ,

Spanish NATO officer suspended from duty for dating Russian-born woman

September 16, 2026 by 3 Comments

Northwood Allied Maritime Command (MARCOM)A MILITARY OFFICER FROM Spain—a North Atlantic Treaty Organization (NATO) member—has been suspended from duty following an investigation into his relationship with a woman born in the former Soviet Union, amid fears she may have been spying for Moscow.

The unidentified Spanish naval commander, a married father of two, served at the Allied Maritime Command (MARCOM) at Northwood Headquarters in Hertfordshire, United Kingdom. MARCOM duties include the monitoring of Russian submarines, warships operating in United Kingdom waters and tracking sanctioned oil tankers from the Russian ‘shadow fleet’—a network of tankers used by the Russian state to clandestinely transport crude oil and evade international sanctions.

The Spaniard reportedly met Janina White, 49, on the online dating app Tinder in October 2024. White is believed to have been born in the Soviet Union but relocated to Poland and then to the United Kingdom as a teenager. She currently resides in Romford, London and holds joint Polish-British nationalities. Shortly prior to entering into a romantic relationship with the Spanish naval commander, White reportedly split from her British husband. The NATO commander is also believed to have separated from his wife shortly before starting a relationship with White.

Initial concerns were raised in December 2024 when, according to court documents, the couple attended a Christmas function at Northwood Headquarters. The following day, White reportedly accompanied her boyfriend to Oeiras, Portugal, while he attended an official meeting at Naval Striking and Support Forces NATO. The facility serves as NATO’s primary platform for integrating United States maritime forces into the Alliance’s operations. White maintains this was her only visit of substance to a NATO facility and insists she never entered classified areas. Read more of this post

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , , , , ,

Chinese-Belgian national charged with espionage involving microchips

September 13, 2026 by 2 Comments

State Security Service BelgiumA CHINESE-BELGIAN NATIONAL and former senior employee at a now-bankrupt microchip manufacturer remains in custody in Belgium on suspicion of espionage involving semiconductors. The suspect, who worked for BelGaN, is accused of attempting to transfer specialized intellectual property and trade secrets involving gallium nitride semiconductors—a technology critical to next-generation civilian and military devices.

Identified only as H.L., the suspect is a 52-year-old dual Belgian-Chinese national who reportedly held a senior research position at BelGaN, a microchip maker based in Oudenaarde, East Flanders. The company was the last industrial microchip producer in Belgium, specializing in gallium nitride semiconductors. It was overtaken by a consortium of Chinese investors in February 2022 before declaring bankruptcy in July 2024.

H.L. was reportedly arrested by Belgian authorities on May 10 at Zaventem airport in Brussels, as he was preparing to board a flight to Beijing. He faces four charges: espionage, participation in a criminal organization, misuse of company assets, and unlawful disclosure of trade secrets. A second suspect, reportedly former BelGaN CEO Alan Zhou Zhen, remains at large.

Investigators suspect H.L. simultaneously served as a director of Gankool, a company based in China’s Fujian province. Financed by a Chinese investment fund, the company was established a few months after BelGaN’s takeover by a Chinese investment fund. Gankool allegedly produces the same microchip technology as BelGaN. H.L. is accused of illegally transferring BelGaN’s specialized intellectual property and trade secrets to the Chinese firm.

This case highlights a pattern Belgium’s State Security Service explicitly flagged recently, terming it “mirror companies”. The practice refers to cases where Chinese investors acquire promising but underfunded European technology firms. The investors proceed to extract the European firms’ technology and establish a parallel company in China that replicates production at scale—often selling off the original European firm afterward.

► Author: Molly Jones | Date: 13 September 2026 | Permalink

Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with , , , , ,

← Older posts