UNCLASSIFIED // FOR PUBLIC RELEASE▸ INTELLIGENCE BRIEFING ACTIVESPYWITNESS NEWS
INTELLIGENCE REPORT
SPYWITNESS
NEWS & ANALYSIS
ESTABLISHED 2023
▌ LIVE INTELLIGENCE FEED
▌ LATEST INTELLIGENCEWEDNESDAY, 27 MAY 2026
lazarus group
▌ INTELLIGENCE BRIEF

Lazarus Group Deploys Undetectable Memory RAT Against Global Financial Sector

◆ HIGH CONFIDENCECyber and Information Warfare27 MAY 2026

North Korea's Lazarus Group has deployed RemotePE, a fully memory-resident RAT leaving zero filesystem artifacts, against global financial and cryptocurrency institutions — a significant capability escalation directly funding Pyongyang's weapons programmes.

North Korea's Lazarus Group has deployed RemotePE, a fully memory-resident RAT leaving zero filesystem artifacts, against global financial and cryptocurrency institutions — a significant capability escalation directly funding Pyongyang's weapons programmes.

ALSO FILED
▌ ANALYSIS

Hormuz on the Edge: Iran's IRGC Tests Ceasefire Limits as Nuclear Deal Hangs in the Balance

Nearly three months after the United States and Israel launched the most significant direct military campaign against Iran in modern history, a fragile ceasefire is fracturing in real time. On 25 May, US forces conducted what the Pentagon described as "self-defence strikes" against Islamic Revolutionary Guard Corps boats actively laying mines in the Strait of Hormuz — the global chokepoint through which roughly 20 percent of the world's traded oil transits daily. The IRGC has responded by threatening reciprocal action and redefining the Strait as a "vast operational area." Peace negotiations in Doha remain deadlocked on the nuclear question. The conflict may have entered a post-offensive phase, but it has not ended.

◆ HIGH CONFIDENCEConflict and War26 MAY 2026
▌ ANALYSIS

Hormuz on the Edge: Iran's IRGC Tests Ceasefire Limits as Nuclear Deal Hangs in the Balance

Nearly three months after the United States and Israel launched the most significant direct military campaign against Iran in modern history, a fragile ceasefire is fracturing in real time. On 25 May, US forces conducted what the Pentagon described as "self-defence strikes" against Islamic Revolutionary Guard Corps boats actively laying mines in the Strait of Hormuz — the global chokepoint through which roughly 20 percent of the world's traded oil transits daily. The IRGC has responded by threatening reciprocal action and redefining the Strait as a "vast operational area." Peace negotiations in Doha remain deadlocked on the nuclear question. The conflict may have entered a post-offensive phase, but it has not ended.

◆ HIGH CONFIDENCEGeopolitical Analysis26 MAY 2026
INTELLIGENCE ARCHIVE
▌ ANALYSIS

Hormuz on the Edge: Iran's IRGC Tests Ceasefire Limits as Nuclear Deal Hangs in the Balance

Nearly three months after the United States and Israel launched the most significant direct military campaign against Iran in modern history, a fragile ceasefire is fracturing in real time. On 25 May, US forces conducted what the Pentagon described as "self-defence strikes" against Islamic Revolutionary Guard Corps boats actively laying mines in the Strait of Hormuz — the global chokepoint through which roughly 20 percent of the world's traded oil transits daily. The IRGC has responded by threatening reciprocal action and redefining the Strait as a "vast operational area." Peace negotiations in Doha remain deadlocked on the nuclear question. The conflict may have entered a post-offensive phase, but it has not ended.

◆ HIGH CONFIDENCEConflict and War26 MAY 2026
▌ ANALYSIS

Hormuz on the Edge: Iran's IRGC Tests Ceasefire Limits as Nuclear Deal Hangs in the Balance

Nearly three months after the United States and Israel launched the most significant direct military campaign against Iran in modern history, a fragile ceasefire is fracturing in real time. On 25 May, US forces conducted what the Pentagon described as "self-defence strikes" against Islamic Revolutionary Guard Corps boats actively laying mines in the Strait of Hormuz — the global chokepoint through which roughly 20 percent of the world's traded oil transits daily. The IRGC has responded by threatening reciprocal action and redefining the Strait as a "vast operational area." Peace negotiations in Doha remain deadlocked on the nuclear question. The conflict may have entered a post-offensive phase, but it has not ended.

◆ HIGH CONFIDENCEGeopolitical Analysis26 MAY 2026
▌ IC WATCH // EUROPE

Spy Chief in the Dock: France Pursues Unprecedented Prosecution of DGSE Official Over Intelligence Memoir

A former senior DGSE official faces criminal prosecution in France for publishing memoir content assessed by intelligence authorities to contain classified operational material — an unprecedented legal confrontation within France's foreign intelligence apparatus that has implications for post-service disclosure frameworks across Western intelligence services.

◆ CONFIRMEDIntelligence Community26 MAY 2026
▌ STRATEGIC AFFAIRS // AI & INTELLIGENCE

The $9 Billion Intelligence Bet: White House Commits to AI Transformation of the US Intelligence Community

The White House's commitment of $9 billion to artificial intelligence integration across US intelligence community operations is the most significant structural investment in IC analytical and collection capability since the post-9/11 reforms, with implications extending to intelligence tradecraft, collection prioritisation, and the competitive intelligence balance with China.

◆ CONFIRMEDEmerging Threats26 MAY 2026
▌ SECURITY ALERT // EUROPE

Austria Confirms Systematic Drone Surveillance of Military Installations: Central European Defence Infrastructure Under Active Reconnaissance

Austrian security authorities have confirmed systematic unmanned aerial vehicle surveillance of military installations in a pattern assessed with high confidence as state-sponsored intelligence collection — the latest confirmed operation in a series of similar campaigns identified across Central and Northern Europe targeting NATO-adjacent defence infrastructure.

◆ HIGH CONFIDENCESecurity and Defence26 MAY 2026
▌ CONFLICT INTEL // UKRAINE

SBU Charges 81 in Counterintelligence Sweep Including 20 Serving Officers: Russian Penetration of Ukraine's Security Apparatus Deeper Than Acknowledged

Ukraine's Security Service has filed charges against 81 individuals in an ongoing counterintelligence operation, with 20 of those charged being current SBU officers — a disclosure confirming Russian intelligence penetration of Ukrainian security structures at scale and raising immediate questions about operational security across the conflict theatre.

◆ HIGH CONFIDENCEConflict and War26 MAY 2026
▌ GEOPOLITICAL ANALYSIS // HIGH PRIORITY

Iran's Nuclear Calculus: Trump's Strike-or-Deal Dilemma as Ballistic Missile Capability Is Confirmed

Iran's advancing nuclear programme, combined with confirmed ballistic missile delivery capability, has compressed the decision space for the Trump administration into a binary that US foreign policy has sought for two decades to avoid: accept a nuclear-capable Iran under diplomatic constraint or authorise military action before the capability crosses an irreversible threshold.

◆ MODERATEGeopolitical Analysis26 MAY 2026
▌ IC WATCH // LEADERSHIP

Gabbard Departs as DNI: US Intelligence Community Faces Leadership Vacuum Amid $9 Billion AI Restructuring

The departure of Tulsi Gabbard from the position of Director of National Intelligence removes the political leadership layer of the US intelligence community at a structurally sensitive moment — mid-execution of the administration's $9 billion AI investment and following significant personnel disruption across the IC.

◆ HIGH CONFIDENCEIntelligence Community26 MAY 2026
▌ THREAT ASSESSMENT // MOIS OPERATIONS

MuddyWater Deploys Chaos Ransomware as MOIS Espionage Cover: Iran Escalates Dual-Use Cyber Operations

Available reporting indicates Iranian state-sponsored actor MuddyWater has deployed Chaos ransomware in operations assessed with moderate confidence as intelligence collection campaigns using destructive malware as cover, marking a tactical evolution in how Iran's Ministry of Intelligence and Security conducts espionage under commercial-crime deniability.

◆ MODERATECyber and Information Warfare26 MAY 2026