Classified US intelligence report suggests Iran regime unlikely to fall or change

Iran KhameneiA CLASSIFIED REPORT ISSUED two weeks ago by the United States National Intelligence Council (NIC) found that even a full-scale interstate war against Iran would be unlikely to dislodge or drastically alter the current regime. A summary of the report was revealed by The Washington Post, which cited three anonymous sources the paper said were intimately familiar with the report’s contents.

Composed of senior and highly respected intelligence analysts from across the U.S. Intelligence Community (IC), the NIC is tasked with producing classified strategic assessments on critical issues of concern to American decision-makers. Technically NIC reports represent the collective voice of all 18 intelligence agencies that make up the U.S. IC, and come as close as possible to the IC’s consensus view on pressing national security concerns.

According to The Washington Post, the NIC report outlines several scenarios for leadership succession in Iran, resulting from either a surgical “decapitation” campaign against specific elements of regime, or from a large-scale military assault against the entirety of the Iranian security state. It concludes that in both cases the Iranian regime is too entrenched and powerful to fall. Moreover, even in the event of “decapitation”, the regime has substantial human resources to keep replenishing its fallen military and civilian leaders, including the Supreme Leader.

Lastly, the NIC report concludes that the Iranian opposition within Iran and around the world is too disjointed, fragmented and disorganized to pose a credible alternative to the Iranian security state. While discussing a number of different potential scenarios for the takeover of power by the Iranian opposition, the NIC report concludes that such an eventuality remains “unlikely”, The Post reports.

The Post’s report appears to confirm earlier accounts by The New York Times and the Reuters news agency, which suggested that the consensus view among the U.S. IC is that, if killed, Supreme Leader Ayatollah Khamenei would almost certainly be replaced by another hardliner, who would be ideologically opposed to both Israel and the West.

Notably, The Washington Post notes that the NIC report does not consider the possibility that the U.S. and Israel might decide to engage in a protracted ground war against Iran. Additionally, the report does not entertain the possibility that ethnic separatist forces within Iran—such as the Kurds, the Azeris or the Balochis—might revolt against Tehran, thus sparking a nationwide armed conflict.

Author: Joseph Fitsanakis | Date: 09 March 2026 | Permalink

CIA working with Kurdish separatists to foment armed rebellion in northwestern Iran

Iran KurdistanTHE UNITED STATES CENTRAL Intelligence Agency (CIA) is arming and training ethnic separatists in northwestern Iran with the goal of fomenting an armed rebellion against Tehran in the coming weeks, according to reports. Several news outlets, including CNN, report that Iranian Kurdish opposition forces are preparing to launch a ground operation in northwestern Iran “in the coming days”.

The nearly 10 million Kurds in Iran are one of the largest ethnic minorities in the country, concentrated in the mountainous western provinces bordering Iraq and Turkey. They are predominantly Sunni Muslims in a country governed by a Shia clerical state, creating both religious and ethnic tension. The central government has generally responded to calls for autonomy by various Kurdish factions with security crackdowns and suppression of dissent. Kurdish regions have been subject to heavy surveillance and military deployment, particularly during periods of regional instability.

British news outlet ITV reports that American and Israeli air strikes have consistently targeted Iranian military installations in western Iran in recent days, in an effort to degrade Tehran’s security assets in the region and provide Kurdish rebel forces with the ability to launch a successful armed campaign. According to ITV, Kurdish rebels have asked Israeli and American forces to provide air cover for an eventual ground campaign—though whether this request has been approved remains unknown.

According to Axios, US President Donald Trump spoke directly with Iraqi Kurdish leaders last weekend, seeking access to Iran’s Kurdish provinces through the Kurdish-controlled autonomous region of northern Iraq. Such access would allow the CIA and US Special Operations Forces to create a supply route for the provision of weapons and other war materiel to Iranian Kurdish rebels. The US president also spoke with at least one Iranian Kurdish leader on Tuesday, according to reports.

CNN said it reached out to the CIA about this story but the agency refused to comment on it.

Author: Joseph Fitsanakis | Date: 05 March 2026 | Permalink

Analysis: Escalation Without Endgame and the Limits of Defeating Iran

Iran Israel United States warTHE ONGOING CONFRONTATION BETWEEN Iran and its adversaries unfolds against the backdrop of a regime that is strategically depleted yet politically combustible. Yet strategic exhaustion does not equate to imminent collapse. Indeed, the potential degradation of Iran’s coercive institutions raises a more complex question: what follows tactical success? Thus, while Iran appears weakened and vulnerable, the longer-term trajectory of the conflict remains uncertain, fraught with the risk of protracted instability and regional spillover at a level that could make Libya and Syria seem mild by comparison.

Iran is Strategically Depleted and Vulnerable

Decades of crippling sanctions have ruined Iran’s economy and demoralized its population, causing an already polarized society to further-disintegrate. Outside of a small population of religious zealots, Iranians have little interest in martyrdom, and very few are willing to die for a regime that most see as politically and ideologically bankrupt. The stunning degree of the regime’s penetration by Israeli and American intelligence agencies is indicative of the disillusionment of ruling elites, let alone rank-and-file functionaries.

Militarily, this is hardly a war between equals. Even before bombs started falling in Tehran on February 28, Iran’s armed forces and its elite Islamic Revolutionary Guard Corps (IRGC) had been severely degraded by prior military engagements with the U.S. and Israel. Even with the assistance of its proxies and allies, Iran is demonstrably unable to match the military and intelligence resources of its opponents. As many have noted, Tehran’s retaliatory strikes appear to emphasize economic disruption and psychological pressure on civilian populations. But the marked inconsistency in the scale and delivery of Iran’s retaliatory attacks suggests that it is struggling to respond in a coherent fashion.

Russia, meanwhile, is nowhere to be seen. As in the cases of Venezuela and Cuba, Moscow has restricted its response to this crisis to diplomatic condemnations and offers to mediate, rather than offering military assistance to its Middle Eastern ally. This is hardly surprising, given Russia’s broader strategic priorities and its desire to further its ongoing expansionist goals in Europe by avoid overextension elsewhere.

Iran is weak, exhausted, alone. It is teetering on the edge. Yet, instead of cheering, this appears to trouble even seasoned Iran hawks like John Bolton, Trump’s onetime national security adviser. A veteran Republican, Bolton is probably the most consistent and vociferous Iran critic in the Western Hemisphere. The Iranian government has actively planned to assassinate him in recent years. But in a recent interview, Bolton cautioned about the lack of planning behind Washington’s latest adventurism in the Middle East and waned that the current situation may “deepen conflict, create a dangerous power vacuum, and purge the [entire Middle East] into turmoil”. What is Bolton seeing that Trump’s inner circle is not?

This War Will Not End Soon

American air campaigns have a demonstrated history of obliterating Washington’s tactical targets and severely disrupting its adversaries. Iran is unlikely to prove an exception to this rule. However, air campaigns—no matter how sophisticated—cannot by themselves reorder domestic politics and build long-lasting political outcomes. It follows that, despite delivering a series of indisputable tactical successes, including the assassination of Iran’s supreme leader and senior members of his inner circle, American and Israeli airpower cannot by itself ensure a pro-Western outcome in Iran.

Obliterating the Iranian regime’s military capabilities and degrading its ability to dispense violence against its own population is likely to create a power vacuum. But that is not the same as managing the ensuing political fallout. Even if the regime falls—which is not the likeliest scenario—its successor is unlikely to be friendly to the U.S. or Israel. For over a century, Iran has been permeated by a political culture shaped by fervent nationalism, revolutionary narratives and resistance against foreign intervention. This has been particularly so since 1979, with the theocratic regime building the nation’s identity around the idea of its resistance to the “Great Satan” and its regional allies, including Israel and Saudi Arabia. This identity permeates Iran’s security apparatus, its state institutions and its education system. Even anti-regime Iranians—including the student demonstrators who cheered Ayatollah Khamenei’s demise—espouse core elements of that narrative. Read more of this post

France arrests alleged Chinese spies living in small village—four arrests so far

France GirondeFOUR MEN HAVE BEEN arrested in France on suspicion of spying for China using a system of parabolic antennas and computers installed at a rented property in the French countryside. The men were arrested last Saturday and Sunday by the General Directorate for Internal Security (DGSI), which focuses on counterterrorism and counterespionage.

Two of the arrests took place on-site at a property in Camblanes-et-Meynac, a picturesque village located around 10 miles from Bordeaux in south-western France’s Gironde region. The property had reportedly been rented through the rental broker application Airbnb by two Chinese nationals who arrived in France in January. They are believed to have entered the country using work visas as engineers for a wireless telecommunications firm.

After settling in Camblanes-et-Meynac, the men erected a large parabolic antenna system in the garden of the rented property. The move reportedly alarmed locals, who noticed that their own Internet service experienced disruptions following the erection of the parabolic antenna system by the Chinese nationals. A local family proceeded to alert local authorities about the antenna.

According to reports the DGSI arrested two Chinese nationals aged 27 and 29, while also seizing a substantial quantity of computer and satellite equipment that was found on the property. Two other men reportedly “of Chinese origin” but based in France, were also arrested over the weekend. They were charged with providing assistance to the two residents of the Airbnb property by illegally importing the satellite equipment installed on the property. Their identities have not been released by the authorities.

The French prosecutor’s office stated that the suspects were engaged in efforts to “capture satellite data from the Starlink [mobile broadband] network”. They were also allegedly trying to intercept communications data from “vital entities” in the military realm and “retransmit them to their country of origin”, namely China, according to the statement. They are now in custody facing charges of “delivering information to a foreign power […] likely to damage the interests” of France—a standard phraseology used in the French legal code to describe foreign espionage.

France’s Gironde region has long been an epicenter of espionage by international actors due to its proximity to a growing number of facilities and restricted sites related to critical telecommunication, aerospace, and defense industries. Several small towns and villages in the area are in proximity to the industrial core of France’s defense, space and aeronautics operations.

Author: Joseph Fitsanakis | Date: 11 February 2026 | Permalink

European Union states begin requiring advance transit notices from Russian diplomats

European CommissionAT LEAST THREE EUROPEAN Union members states now require Russian diplomats who are not accredited in their territories to notify them prior to entering their borders. According to the new requirement, Russian diplomats must provide advance notification if they intend to travel to, or transit through, a European Union country in which they are not accredited.

For instance, a Russian diplomat accredited in Germany and stationed at the Russian embassy in Berlin, must provide France with advance notice if they intend to travel there or transit through French territory en route to a third destination. The new rule was first reported late last month by Russia’s state-affiliated RIA Novosti news agency and picked up by the investigative news site The Insider.

Citing Russian diplomatic sources, RIA Novosti said three European Union states, Austria, France, and the Netherlands, had contacted the Russian Ministry of Foreign Affairs with information about the new requirement. The Insider said last week it was unclear whether other European Union states had already issued similar restrictions against Russian diplomats.

The measure is included in the 19th Package of Sanctions against Russia, which the European Union adopted in October 2025. The text of the sanctions package includes “an obligation for Russian diplomats, travelling across the EU beyond their country of accreditation, to inform the relevant EU Member State in advance”. It also notes that the measure is “meant to tackle the increasingly hostile intelligence activities that support Russia’s aggression against Ukraine”.

Author: Joseph Fitsanakis | Date: 02 February 2026 | Permalink

Intelligence tensions rock NATO as Danish government issues espionage advisory

Mark Rutte NATO TrumpINTELLIGENCE PARTNERS IN THE North Atlantic Treaty Organization (NATO) are “not talking openly” anymore, while authorities in Denmark have advised government officials to disable Bluetooth functions on their devices due to spying concerns. According to reports in British news outlets, intelligence-sharing functions inside NATO are at a breaking point following a series of actions by the United States that one source described as “alliance-breaking moves” that could “thoroughly alter the global order for decades to come”.

One British outlet cited an unnamed “senior NATO insider” who said that the current dispute between the US and Europe over Greenland is “creating tensions and distrust between European and US colleagues in NATO”. The source added that European and Canadian NATO staff are “not talking openly” with their US counterparts amid “growing concerns that information will make its way back to [US President Donald] Trump”.

At the same time, reports from the US suggest that the White House has ordered the Pentagon to “scale back” its participation from NATO’s force structure and a number of transnational advisory groups. European and Canadian military officials are reportedly interpreting these moves as “the latest sign of the Trump administration’s drive to scale back the US military presence in Europe”.

Meanwhile, the Danish government has issued multiple advisories to its military and civilian officials to disable all Bluetooth functions across both government-supplied and personal electronic devices, reportedly over concerns of intensified foreign surveillance targeting Denmark. The Danish Defense Intelligence Service (DDIS) issued an advisory to military personnel across Denmark and Greenland to deactivate all Bluetooth functions.

The Information Technology Department of the Danish National Police issued a similar advisory to its personnel, instructing them to keep all Bluetooth functions deactivated until further notice. The advisory warned that wireless accessories, including Bluetooth-reliant headsets from popular brands like Apple could function as potential entry points for eavesdropping and other forms of data interception by foreign powers.

Author: Joseph Fitsanakis | Date: 26 January 2026 | Permalink

BBC given rare access to university course designed for French intelligence staff

Sciences Po Paris FranceEARLIER THIS MONTH, FRANCE-based British reporter Chris Bockman was given rare access to a training course designed collaboratively by a leading French university and France’s intelligence services. The course is part of the Diplôme sur le Renseignement et les Menaces Globales (Diploma of Intelligence and Global Threats), which is offered by the Institut d’études politiques de Saint-Germain-en-Laye (known as Sciences Po Saint-Germain), located on the northwestern outskirts of Paris.

Reporting for the BBC, Bockman said the program of studies was designed by Sciences Po in association with the Academie du renseignement (Intelligence Academy)—the classified training arm of the Communauté française du renseignement (French National Intelligence Community). The Academie du renseignement is responsible for training personnel in several French civilian and military government agencies, including the General Directorate for External Security (DGSE) and the General Directorate for Internal Security (DGSI).

Following the November 2015 Paris attacks by the Islamic State, which killed nearly 140 people, an unprecedented number of new employees joined the French National Intelligence Community as a result of a massive hiring spree. This unprecedented expansion prompted the Académie du renseignement to reach out to France’s state universities in search of training programs for new intelligence personnel, as well as for seasoned employees.

The result was the Diplôme sur le Renseignement et les Menaces Globales, a four-month program consisting of 120 hours of class contact time divided into several modules taught by academics and practitioners. The modules include Islamic radicalism, non-religious political violence, business intelligence, and the economics of organized crime. The cost is €5,000 (around $6,000) per student. Students tend to come from the French intelligence services and the private sector, including consulting, aerospace, and defense contracting, according to Bockman.

Author: Joseph Fitsanakis | Date: 19 January 2026| Permalink

Former deep-cover spy leads Kremlin’s efforts to woo Indian high-tech sector

Andrei Bezrukov A FORMER DEEP COVER Russian intelligence officer, whose cover was blown in 2010 when he was arrested in the United States, is spearheading efforts by the Kremlin to secure investments by India’s technology sector. The spy, Andrei Bezrukov, was recruited by the Soviet Committee for State Security (KGB) in the late 1970s or early 1980s—most likely alongside his wife, Elena Vavilova. For several years, the married couple lived in several countries, including Canada and France, before arriving in the United States in 1999 using fraudulently obtained Canadian passports.

Posing as Donald Heathfield and Tracey Foley, Bezrukov and Vavilova were among 10 Russian non-official-cover intelligence officers arrested by the Federal Bureau of Investigation (FBI) in June 2010. They were eventually swapped with Moscow for several Western spies held in Russian prisons. After returning to Russia, Bezrukov and Vavilova received the Order “For Merit to the Fatherland” 4th Class, which is Russia’s second-highest state decoration. They also entered state-sponsored employment, with Bezrukov advising the Rosneft Oil Company—Russia’s second-largest corporation—and teaching at the Moscow State Institute of International Relations.

In June 2025, Bezrukov apparently represented the Russian state at the 28th Saint Petersburg International Economic Forum (SPIEF)—often referred to as “Putin’s Davos”. According to the Washington Post, Bezrukov’s apparent role at SPIEF was to network with Forum representatives from India’s advanced technology sector, allegedly on direct orders by the administration of Russian President Vladimir Putin.

The event, which went under the tagline “Shared Values as a Foundation for Growth in a Multipolar World”, gathered nearly 20,000 delegates from 140 countries. The Kremlin touted it as evidence of the West’s failure to isolate Russia following its invasion of Ukraine. It also served as part of a set of broader efforts by the Kremlin to prevent the Russian economy from sliding into a recession by seeking to develop alternative energy markets and strengthening economic and political ties to the Global South.

India is by far the largest of a group of countries seen as “friendly” by Russia, which could potentially help revitalize the Russian economy, largely through the International North–South Transport Corridor (INSTC). The 14-year-old agreement aims to interconnect a transnational transportation network connecting Russia and India with import-export routes in Central Asia the Middle East, and Europe. Experts claim that the INSTC is the logistical backbone of Russia’s efforts to salvage its economy from the growing pressures of the war in Ukraine.

The Post reported that Bezrukov denied that he is still an employee of Russian intelligence agencies when approached and asked about his past by Western journalists.

Author: Joseph Fitsanakis | Date: 08 December 2025 | Permalink

Colombian spy chief claims intelligence-sharing with CIA continues despite dispute

Gustavo PetroIN A RARE MEDIA interview, the chief of Colombia’s National Intelligence Directorate (DNI) has said that his agency’s collaboration with the Central Intelligence Agency (CIA) and other American spy organizations continues unabated. This statement appears to contradict a prior statement by the president of Colombia, who said his country had stopped all intelligence-sharing with the United States in protest against the lethal targeting of civilian vessels in the Caribbean.

The political dispute between the two countries made headlines on November 11, when Colombian President Gustavo Petro (pictured) ordered his government’s intelligence agencies to “suspend intelligence sharing with US intelligence agencies”. The leftist leader made the announcement in response to the targeting of Colombian boats that Washington accuses of involvement in narcotics smuggling in the Caribbean. Two weeks earlier, the White House had personally accused Petro of participating in illicit drug trade activities and imposed sanctions on him and his immediate family.

Two days after the dramatic breakdown in intelligence cooperation between Colombia and the United States, Colombian officials claimed that Bogota would continue to share intelligence with international spy agencies, including those of the United States. Petro’s Minister of the Interior, Armando Benedetti, said that reports about the alleged breakdown in intelligence cooperation between the two countries were due to “a misunderstanding”. He added that Colombia would “continue working […] against drug trafficking and crime with the United States”.

Now the director of the DNI, Jorge Lemus, has told Agence France Presse that his agency’s relationship with the CIA had not been disrupted, despite the high-level political dispute between Colombia and the United States. The CIA “are collaborating a lot, and so are we”, said Lemus. The spy chief added that Colombian counternarcotics forces had destroyed “over 10,000” illicit cocaine labs in 2025 and were continuing operations against drug cartels “together with them [the CIA], hand-in-hand with them. We continue exactly as before […] not only with the CIA, but with all agencies”.

Lemus’ comments are reportedly the first high-level confirmation of Benedetti’s November 13 statement that intelligence cooperation between Colombia and the United States continued unabated despite the political falling-out between the two countries’ leaders.

Author: Joseph Fitsanakis | Date: 01 December 2025 | Permalink

British spy and his Chinese handler used private jet to escape to China, report claims

Belgrade Nikola Tesla Airport SerbiaA BRITISH MAN WANTED by American authorities for spying for China, who disappeared along with his Chinese handler while under house arrest, may have managed to escape to China using a private jet, a report claims. John Miller, 63, from Tunbridge Wells in the United Kingdom, was arrested alongside his alleged Chinese handler, Cui Guanghai, in April of this year.

At the time of their arrest, the two men were staying at the Hyatt Regency Hotel in Serbian capital Belgrade. Serbian authorities reportedly arrested the men just hours before they were about to board a flight to China. American authorities accuse Mille, who lives permanently in the United States, of attempting to smuggle “sensitive […] military technology” to China, such as drones, air defense systems, and ground-to-air missiles.

The two suspects were jailed while awaiting extradition to the United States, where each faced up to 40 years in prison for violating the United States Arms Export Control Act. A month later, the two suspects were moved out of jail and placed into house arrest in two separate apartments in Belgrade. Both were required to wear electronic ankle bracelets at all time.

However, on August 4, the two men damaged and forcibly removed their surveillance devices. Records show that the devices stopped transmitting their location coordinates between 12:43 and 12:54 a.m. local time. Alarms were automatically triggered, alerting officials at Serbia’s Criminal Sanctions Enforcement Directorate, whose surveillance systems were monitoring the two men.

In less than an hour, however, the two men had arrived at Belgrade’s Nikola Tesla Airport. According to a new report, published last week by the Serbia-based Balkan Investigative Reporting Network (BIRN), the suspects boarded a private Gulfstream G550 jet that was waiting for them at the airport. The report claims that the jet is owned by a Beijing-headquartered firm called Deer Jet. Shortly afterwards, the jet took off for a nine-hour direct flight to the Chinese capital.

Miller and Cui have not been seen since. BIRN said officials from the Serbian government did not respond to calls for comment. British newspaper The Mail on Sunday said it contacted Deer Jet but received no responses. The Department of Justice and the Federal Bureau of Investigation in the United States refused to comment as well.

Author: Joseph Fitsanakis | Date: 10 November 2025 | Permalink

Mossad had ‘some 100 agents’ on the ground in Iran on June 13, Israeli officials claim

Mossad inside IranTHE MOSSAD, ISRAEL’S PRIMARY covert action agency, had “some 100 agents” on the ground in Iran at the start of the Twelve-Day War, according to senior Israeli government officials who participated in a television documentary. The documentary was aired last week on Israel’s Channel 13 television channel. It features interviews with senior Israeli government officials, including Prime Minister Benjamin Netanyahu, Minister of Defense Israel Katz, Minister of Foreign Affairs Gideon Sa’ar, and National Security Adviser Tzachi Hanegbi.

According to the documentary, several new intelligence units focusing on Iran were established across the Israeli military establishment in the summer of 2023, in anticipation of a war with the Islamic Republic. These units acted in coordination with the Mossad in the lead-up to June 13, when Israel launched the opening salvos of the Twelve-Day War. The documentary claims that around 100 Mossad agents were active on the ground in the early hours of June 13. It appears that the term “agents”, as used in the documentary, refers primarily to Iranian Mossad assets, rather than Mossad officers.

Israeli officials describe the Mossad operation as “unprecedented” in scale, as never before had so many operatives been simultaneously activated for a single mission. It was also unprecedented in complexity, because it involved the deployment missile systems, the documentary claims. These systems had been previously smuggled into Iran and were used to destroy Iran’s anti-aircraft installations and ballistic missile launchers. Iranian war planners had not considered the possibility of missile attacks against their military installations originating from within Iran’s borders.

In addition to the Mossad-led component of the operation, members of the Israel Defense Forces were also active outside Israel’s borders that day. According to Brigadier General Gilad Keinan, commander of Israeli Air Forces’ Air Operations Group, Israeli troops were “on the ground somewhere in the Middle East” on the evening of June 13. He did not provide further details.

Author: Joseph Fitsanakis | Date: 22 September 2025 | Permalink

Austrian prosecutors charge ex-intelligence officer accused of spying for Russia

Landesgericht für Strafsachen Wien Vienna Regional Court for Criminal MattersPROSECUTORS IN VIENNA HAVE charged a former intelligence officer with spying for Russia in a high-profile case that has had broad political ramifications in Austria and abroad. The criminal case centers on Egisto Ott, a former employee of Austria’s Federal Office for the Protection of the Constitution and Counterterrorism (BVT). The BVT operated as Austria’s primary domestic intelligence agency from 2002 until its dissolution in 2021.

Ott was first arrested in March 2021, but was soon released after Vienna’s state court ruled that the accused no longer had access to classified information, and was thus not a persistent threat to the state. Ott was arrested again in March 2024 on suspicion of having maintained contact with Russian intelligence officers even following his 2021 arrest and release, and of trying to sell classified information after his release. As intelNews reported a year ago, Ott was released again from pre-trial detention in June 2024, in a decision that raised eyebrows.

Now Ott is facing charges of colluding with an unidentified police officer to “support an intelligence agency” of a foreign country “to the detriment of Austria”, according to the public prosecutor. Ott is also accused of having engaged in bribery, misuse of his office, and of having broken Austria’s Official Secrets Act. Among several instances of engaging in espionage, Ott is accused of having given Russian intelligence an encrypted SINA-workstation laptop of the type used by government employees to access classified information remotely.

Ott and his lawyers have denied he was involved in espionage and have vowed to confront all charges against him in court.

Author: Joseph Fitsanakis | Date: 02 September 2025 | Permalink

Soldier with far-right links becomes first convicted spy in New Zealand history

New Zealand ChristchurchA DISAFFECTED SOLDIER, WHO tried to commit espionage against New Zealand for a foreign government, has become the first convicted spy in the Pacific Island nation’s history. The only other time New Zealand prosecuted an individual for espionage was in 1974, when the government accused Bill Sutch, a prominent, English-born civil servant, of spying for the Soviet Union. Sutch was acquitted in 1975 and died soon afterwards.

According to reports, a member of the New Zealand Defence Force, who has not been named, drew the attention of the authorities in the aftermath of the 2019 Christchurch shooting. The attack was carried out by Australian white supremacist Brenton Tarrant, who stormed a mosque with an automatic weapon, killing 51 and injuring nearly 100 people. The terrorist attack sparked a widespread investigation into far-right militancy in the Australian and New Zealand armed forces, which continues to this day.

The soldier was found to have contacts with a number of local far-right groups, including the Dominion Movement and Action Zealandia. Government prosecutors said that, while observing the soldier’s activities, government agents found out that he had “made contact with a third party, indicating that he was a soldier” and signaling his desire to defect to a foreign country. They eventually approached the soldier using an undercover officer who pretended to be a representative of the country whose officials the soldier had previously contacted. The soldier told the undercover officer that he was prepared to “get a covert device into army headquarters” and offered to provide “mapping and photographs” of classified government facilities.

During his trial, the soldier pled guilty, admitting that he had tied to spy for a foreign government, and adding that his ultimate goal was to “leave New Zealand and get to what I thought was safety”. Following the soldier’s conviction, the three-judge military panel said it would announce the sentence later this week. The country for which the convicted soldier offered to spy has not been named.

Author: Joseph Fitsanakis | Date: 18 August 2025 | Permalink

Russian hacker group using Internet service providers to spy on foreign embassies

Hacking cyber - JFA HACKER GROUP LINKED to Russia’s Federal Security Service (FSB) has compromised Russia’s domestic internet infrastructure and is using it to target foreign diplomats stationed in Russia. According to a report, published last week by Microsoft Threat Intelligence, the hacker group behind this operation is Turla, also known as Snake, Venomous Bear, Group 88, Waterbug, and Secret Blizzard. Analysts have linked the group with “some of the most innovative hacking feats in the history of cyberespionage”.

Turla began its attempt to compromise a host of Russian internet service providers in February, according to Microsoft’s report. The group’s apparent goal has been to gain access to the software that enables Russian security agencies to legally intercept internet traffic, following the issuance of warrants by judges. This software is governed by Russia’s System for Operative Investigative Activities (SORM), which became law in 1995, under the presidency of Boris Yeltsin. All local, state, and federal government agencies in Russia use the SORM system to facilitate court-authorized telecommunications surveillance.

According to Microsoft, targeted Internet users receive an error message prompting them to update their browser’s cryptographic certificate. Consent by the user results in the targeted computer downloading and installing a malware. Termed ApolloShadow by Microsoft, the malware is disguised as a security update from Kaspersky, Russia’s most widely known antivirus software provider. Once installed the malware gives the hackers access to the content of the targeted user’s secure communications.

The Microsoft report states that, although Turla has been involved in prior attacks against diplomatic targets in Russia and abroad, this is the first time that the hacker group has been confirmed to have the capability to attack its targets at the Internet Service Provider (ISP) level. In doing so, Turla has been able to incorporate Russia’s domestic telecommunications infrastructure into its attack tool-kit, the report states. The report does not name the diplomatic facilities or the countries whose diplomats have been targeted by Turla hackers. But it warns that all “diplomatic personnel using local [internet service providers] or telecommunications services in Russia are highly likely targets” of the group.

Author: Joseph Fitsanakis | Date: 02 August 2025 | Permalink

Researchers uncover secretive Russian spy unit by studying its commemorative badges

FSB RussiaA GROUP OF RESEARCHERS in Finland have managed to outline the structure and geographic footprint of a highly secretive Russian signals intelligence (SIGINT) unit by studying commemorative badges issued by the Russian government. The research group, known as CheckFirst, specializes in open-source (OSINT) investigative reporting and works to combat online disinformation.

Earlier this month, CheckFirst published its latest report titled “OSINT & Phaleristics: Unveiling FSB’s 16th  Center SIGINT Capabilities”. The 36-page report focuses on the study of Russian government-issued commemorative badges—also known as challenge coins—relating to Center 16 (16-й Центр). Also known as  Military Unit 71330, Center 16 is a secretive SIGINT unit that houses most of the cyber espionage capabilities of Russia’s Federal Security Service (FSB).

Challenge coins are custom-made medallions given by military, intelligence, and government agencies to recognize service, commemorate achievements, or build morale. Originating in the United States military during World War I, and popularized during the Vietnam War, challenge coins are routinely exchanged in ceremonies or offered to personnel as tokens of camaraderie and loyalty within a specific unit or mission.

Often regarded as collectors’ items, challenge coins from various agencies are often resold on websites such as eBay, or displayed online on websites maintained by private collectors. CheckFirst researchers tracked down several versions of Center 16 challenge coins found on a variety of publicly available websites, as well as on the websites of Russian challenge coin manufacturers, such as GosZnak, SpetsZnak, or Breget.

Based on this OSINT methodology, CheckFirst researchers were able to identify 10 distinct directorates within Center 16, which specialize on various aspects of defensive and offensive cyber espionage. Previously only a single Center 16 directorate had been identified in the unclassified domain. Moreover, by examining geographic indicators found on several of challenge coins, such as maps or coordinates, CheckFirst researchers were able to partly map out the geographic structure of Center 16, locating nearly a dozen interception facilities throughout Russia.

Author: Joseph Fitsanakis | Date: 21 July 2025 | Permalink