UNCLASSIFIED // FOR PUBLIC RELEASE▸ INTELLIGENCE BRIEFING ACTIVESPYWITNESS NEWS
INTELLIGENCE REPORT
SPYWITNESS
NEWS & ANALYSIS
ESTABLISHED 2023
▌ LIVE INTELLIGENCE FEED
▌ LATEST INTELLIGENCEWEDNESDAY, 3 JUNE 2026
us and iran trade strikes
▌ INTELLIGENCE BRIEF

Gulf Escalation: US and Iran Trade Strikes as Kuwait Caught in Crossfire

◆ HIGH CONFIDENCEConflict and War3 JUN 2026

The US-Iran ceasefire in the Gulf is fracturing following a US strike on Iranian military sites and Iran's retaliatory ballistic missile attack on US forces in Kuwait, intercepted by American air defences.

The US-Iran ceasefire in the Gulf is fracturing following a US strike on Iranian military sites and Iran's retaliatory ballistic missile attack on US forces in Kuwait, intercepted by American air defences.

ALSO FILED
▌ INTELLIGENCE BRIEF

Russia Abandons Attribution Caution in Western Defense Tech Espionage Surge

A coordinated four-nation intelligence advisory from Sweden, Finland, GCHQ, and Estonia confirms Russian spy agencies are escalating Western defense technology acquisition through front companies, sanctions-busting middlemen, and cyber espionage, with agents now operating with significantly reduced concern for attribution.

◆ HIGH CONFIDENCEIntelligence Community
▌ INTELLIGENCE BRIEF

China-Linked Operation Dragon Weave Exploits Azure Cloud to Spy on Czech and Taiwanese Targets

A China-aligned threat actor has weaponised Microsoft Azure Blob Storage as a command-and-control relay to conduct simultaneous spear-phishing operations against government, academic, and financial targets in the Czech Republic and Taiwan.

◆ MODERATECyber and Information Warfare
INTELLIGENCE ARCHIVE
▌ INTELLIGENCE BRIEF

Russia Abandons Attribution Caution in Western Defense Tech Espionage Surge

A coordinated four-nation intelligence advisory from Sweden, Finland, GCHQ, and Estonia confirms Russian spy agencies are escalating Western defense technology acquisition through front companies, sanctions-busting middlemen, and cyber espionage, with agents now operating with significantly reduced concern for attribution.

◆ HIGH CONFIDENCEIntelligence Community
▌ INTELLIGENCE BRIEF

China-Linked Operation Dragon Weave Exploits Azure Cloud to Spy on Czech and Taiwanese Targets

A China-aligned threat actor has weaponised Microsoft Azure Blob Storage as a command-and-control relay to conduct simultaneous spear-phishing operations against government, academic, and financial targets in the Czech Republic and Taiwan.

◆ MODERATECyber and Information Warfare
▌ INTELLIGENCE BRIEF

China's APTs Exploit Gulf Instability to Target Maritime and Energy Intelligence

China-aligned advanced persistent threat groups have pivoted operations toward Gulf maritime and energy targets, exploiting the intelligence vacuum created by the US-Iran conflict and ongoing regional instability — per ESET's Q1 2026 APT Activity Report.

◆ HIGH CONFIDENCECyber and Information Warfare2 JUN 2026
▌ INTELLIGENCE BRIEF

GREYVIBE Emerges: Russia's AI-Augmented Cyber Unit Strikes Ukraine

A previously undocumented Russian-linked threat group designated GREYVIBE has deployed AI-assisted cyberattack capabilities against Ukrainian military, government, and civilian infrastructure since at least August 2025, representing a documented escalation in AI-enabled offensive cyber operations within the ongoing Russo-Ukrainian conflict.

◆ MODERATECyber and Information Warfare2 JUN 2026
▌ INTELLIGENCE BRIEF

GCHQ Director Warns West's Window Is Closing as Russia and China Accelerate

GCHQ Director Anne Keast-Butler, in an inaugural public address at Bletchley Park, warned that the West is at a moment of consequence as Russia intensifies hybrid operations from seabed to cyberspace and China emerges as a full-spectrum technology superpower.

◆ HIGH CONFIDENCEIntelligence Community31 MAY 2026
▌ INTELLIGENCE BRIEF

Salt Typhoon Penetrates Italy's Critical IT Backbone in Silent Two-Week Operation

China's Salt Typhoon APT maintained undetected two-week access inside IBM's Italian subsidiary Sistemi Informativi, compromising IT infrastructure serving Italy's national institutions, energy, finance, and telecommunications sectors.

◆ MODERATECyber and Information Warfare31 MAY 2026
▌ INTELLIGENCE BRIEF

Russia Deploys Dual Covert Operation to Seize Armenia's June Election

Russia is conducting a dual-track covert influence operation against Armenia's June 2026 elections, combining the planned transportation of up to 100,000 diaspora voters from Russian territory with Storm-1516's most extensive disinformation campaign on record, targeting PM Pashinyan's pro-Western government.

◆ MODERATECovert Operations30 MAY 2026
▌ CT ALERT // EUROPE

Operator Identified: IRGC Assassination Network Active Across Europe as Tehran's External Operations Arm Loses Its Chief

European intelligence sources have identified Alireza Mohammadi — alias Meghdad Hassani — as the IRGC officer overseeing an active assassination, espionage and sabotage network operating across multiple European countries. The disclosure, timed to the killing of IRGC Intelligence chief Majid Khademi, signals a coordinated Western counter-intelligence campaign against Tehran's external operations during a period of structural disruption at the top of the IRGC.

◆ MODERATETerrorism and Counterterrorism29 MAY 2026
▌ OSINT REPORT // ATLANTIC INFRASTRUCTURE SURVEILLANCE

Tracked Every Mile: UK Exposes Russian Deep-Sea Surveillance Operation Against Atlantic Cable Infrastructure

British and Norwegian forces tracked three Russian vessels — including two GUGI deep-sea research submarines — conducting a month-long covert survey of North Atlantic undersea cable infrastructure. The UK's decision to publicly expose the operation represents a calibrated counter-intelligence and deterrence signal rather than a purely defensive response.

◆ HIGH CONFIDENCEOSINT29 MAY 2026