UNCLASSIFIED // FOR PUBLIC RELEASE▸ INTELLIGENCE BRIEFING ACTIVESPYWITNESS NEWS
INTELLIGENCE REPORT
SPYWITNESS
NEWS & ANALYSIS
ESTABLISHED 2023
▌ LIVE INTELLIGENCE FEED
▌ LATEST INTELLIGENCESATURDAY, 19 SEPTEMBER 2026
Russian assassination and sabotage network
▌ INTELLIGENCE BRIEF

DOJ Unmasks Kremlin Assassination and Sabotage Network on Western Soil

◆ HIGH CONFIDENCECovert Operations18 SEPT 2026

The U.S. Department of Justice has unsealed an indictment describing a Russian intelligence-directed network, led by a father-son FSB duo, tasked with assassinating dissidents and sabotaging infrastructure across the United States and Europe.

The U.S. Department of Justice has unsealed an indictment describing a Russian intelligence-directed network, led by a father-son FSB duo, tasked with assassinating dissidents and sabotaging infrastructure across the United States and Europe.

ALSO FILED
▌ INTELLIGENCE BRIEF

Houthi Missile Reaches Riyadh, Breaching Saudi Capital's Defenses

A Houthi ballistic missile reached Riyadh for the first time since Yemen's war widened in July, signaling an intensifying threat to Saudi Arabia's capital and regional oil infrastructure.

◆ HIGH CONFIDENCEConflict and War
▌ INTELLIGENCE BRIEF

China-Nexus Spy Groups Rapidly Adopt Shared BlueMoon Exploit Chain

A previously undocumented exploit chain dubbed BlueMoon, chaining two Chrome zero-days with a Windows kernel flaw, was independently adopted by at least four China-nexus espionage clusters within a single week, pointing to a shared exploit broker or centrally coordinated tasking behind economic-intelligence collection against NGOs, mining firms, and commodity traders.

◆ HIGH CONFIDENCECyber and Information Warfare
INTELLIGENCE ARCHIVE
▌ INTELLIGENCE BRIEF

Houthi Missile Reaches Riyadh, Breaching Saudi Capital's Defenses

A Houthi ballistic missile reached Riyadh for the first time since Yemen's war widened in July, signaling an intensifying threat to Saudi Arabia's capital and regional oil infrastructure.

◆ HIGH CONFIDENCEConflict and War
▌ INTELLIGENCE BRIEF

China-Nexus Spy Groups Rapidly Adopt Shared BlueMoon Exploit Chain

A previously undocumented exploit chain dubbed BlueMoon, chaining two Chrome zero-days with a Windows kernel flaw, was independently adopted by at least four China-nexus espionage clusters within a single week, pointing to a shared exploit broker or centrally coordinated tasking behind economic-intelligence collection against NGOs, mining firms, and commodity traders.

◆ HIGH CONFIDENCECyber and Information Warfare
▌ INTELLIGENCE BRIEF

Russian Drone Strikes Train Carrying Ex-CIA Chief, Western Envoys

A Russian drone strike on a train carrying former CIA Director David Petraeus and ex-UK PM Boris Johnson near Ukraine's Polish border, paired with two separate drone incursions against President Zelensky's aircraft, points to an escalating Russian targeting posture against senior Western and Ukrainian officials operating inside the theatre.

◆ MODERATEConflict and War
▌ INTELLIGENCE BRIEF

Russian Drone Strike Signals Targeted Threat to NATO Officials Aboard Ukraine Train

A Russian drone struck an evacuated diplomatic train near the Ukraine-Poland border on 13 September in what Ukraine's rail operator assesses was a probable attempt to hit a convoy carrying Boris Johnson, Carl Bildt, and former CIA Director David Petraeus, marking an unprecedented escalation of risk to NATO's rail lifeline into Kyiv.

◆ MODERATECovert Operations
▌ INTELLIGENCE BRIEF

BlueMoon Exploit Kit Spreads Across Four China-Linked Spy Units

A previously undocumented exploit kit, BlueMoon, has been independently adopted by at least four China-nexus espionage clusters within twelve days of its first confirmed use, chaining a Chrome zero-day with a Windows kernel flaw to compromise NGOs, mining firms, and commodity trading houses.

◆ HIGH CONFIDENCECyber and Information Warfare
▌ INTELLIGENCE BRIEF

Russian Spy Cluster Weaponized AI to Automate Espionage Operations

Anthropic's September 2026 threat intelligence report reveals that a Russian state-nexus espionage cluster, GTG-20006, built AI-driven workflows around Claude to automate reconnaissance, phishing, and exfiltration against more than twenty Ukrainian, European, and diplomatic targets, marking a qualitative shift in how state intelligence services conduct cyber operations.

◆ HIGH CONFIDENCECyber and Information Warfare
▌ INTELLIGENCE BRIEF

Iran Strikes US Base, Ten Ships After Tanker Sinkings

Iran's retaliatory strikes on ten vessels and a U.S.-linked base in Jordan, following Washington's destruction of five Iranian tankers, mark the sharpest escalation yet in the Strait of Hormuz tanker war.

◆ HIGH CONFIDENCEConflict and War
▌ INTELLIGENCE BRIEF

Romania Foils Russian Plot Targeting NATO Bases, Antonov Jets

Romania's SRI disrupted a Russian-coordinated sabotage network surveilling NATO military sites and Ukrainian Antonov cargo aircraft on the same day Hungary expelled ten Russian diplomats, marking a coordinated European counterintelligence pushback against Moscow's hybrid-warfare apparatus.

◆ HIGH CONFIDENCECovert Operations
▌ INTELLIGENCE BRIEF

Iran-Linked Hackers Expand US Infrastructure Targeting to Telecoms

Iranian government-linked hackers have widened their campaign against U.S. critical infrastructure to include telecommunications networks for the first time, joining water and energy as active target sectors amid the ongoing U.S.-Israel-Iran war.

◆ MODERATECyber and Information Warfare