UNCLASSIFIED // FOR PUBLIC RELEASE▸ INTELLIGENCE BRIEFING ACTIVESPYWITNESS NEWS
INTELLIGENCE REPORT
SPYWITNESS
NEWS & ANALYSIS
ESTABLISHED 2023
▌ LIVE INTELLIGENCE FEED
▌ LATEST INTELLIGENCESUNDAY, 6 SEPTEMBER 2026
Russia Widens Sabotage Campaign to Denmark and Poland's Drone Industry
▌ INTELLIGENCE BRIEF

Russia Widens Sabotage Campaign to Denmark and Poland's Drone Industry

◆ MODERATECovert Operations4 SEPT 2026

Danish and Polish authorities have confirmed a coordinated Russian sabotage campaign targeting Europe's Ukraine-facing defense-industrial base, combining online recruitment of civilian assets in Denmark with confirmed arson at Poland's largest drone manufacturer.

Danish and Polish authorities have confirmed a coordinated Russian sabotage campaign targeting Europe's Ukraine-facing defense-industrial base, combining online recruitment of civilian assets in Denmark with confirmed arson at Poland's largest drone manufacturer.

ALSO FILED
▌ INTELLIGENCE BRIEF

Tehran Weighs Major Escalation as U.S. Strike Capacity Questioned

U.S. intelligence assesses that Iran's IRGC leadership believes American munitions stockpiles are depleting and may pursue a major military escalation following the heaviest US-Iran exchange of fire in over a month.

◆ MODERATEConflict and War
▌ INTELLIGENCE BRIEF

Russian Drone Targets Kyiv SBU Chief Ahead of Moscow Peace Talks

A Russian jet-powered drone struck the Kyiv headquarters of Ukraine's Security Service in a deliberate attempt on acting chief Oleksandr Poklad's life on 4 September, hours before U.S. envoys Steve Witkoff and Jared Kushner arrived in Moscow for Trump-brokered talks to end the war, prompting a Ukrainian retaliation order and a subsequent mutual pause on capital strikes during the envoys' visits.

◆ HIGH CONFIDENCEConflict and War
INTELLIGENCE ARCHIVE
▌ INTELLIGENCE BRIEF

Tehran Weighs Major Escalation as U.S. Strike Capacity Questioned

U.S. intelligence assesses that Iran's IRGC leadership believes American munitions stockpiles are depleting and may pursue a major military escalation following the heaviest US-Iran exchange of fire in over a month.

◆ MODERATEConflict and War
▌ INTELLIGENCE BRIEF

Russian Drone Targets Kyiv SBU Chief Ahead of Moscow Peace Talks

A Russian jet-powered drone struck the Kyiv headquarters of Ukraine's Security Service in a deliberate attempt on acting chief Oleksandr Poklad's life on 4 September, hours before U.S. envoys Steve Witkoff and Jared Kushner arrived in Moscow for Trump-brokered talks to end the war, prompting a Ukrainian retaliation order and a subsequent mutual pause on capital strikes during the envoys' visits.

◆ HIGH CONFIDENCEConflict and War
▌ INTELLIGENCE BRIEF

Pegasus Spyware Wave Confirmed Against Serbian Opposition, Student Movement

Independent forensic analysis confirms NSO Group's Pegasus spyware and a bespoke NoviSpy variant were used to surveil at least fourteen Serbian opposition politicians, activists, and student protest leaders, marking the country's largest documented mercenary-spyware campaign to date.

◆ HIGH CONFIDENCECovert Operations
▌ INTELLIGENCE BRIEF

Kyiv Gunfight Between SBU and HUR Exposes Agency Rift

A firefight between Ukraine's SBU and HUR intelligence services in Kyiv, triggered by a disputed FSB-assassination-plot detention, has exposed a dangerous breakdown in wartime interagency coordination at the heart of Kyiv's security establishment.

◆ MODERATEIntelligence Community
▌ INTELLIGENCE BRIEF

Wedding Strike Triggers Four-Front Iranian Retaliation Across Gulf

Iran launched coordinated missile and drone strikes against U.S. military facilities in four countries after accusing Washington of a war crime over strikes that killed at least eighteen people, including children, at a wedding celebration in southern Iran.

◆ MODERATEConflict and War
▌ INTELLIGENCE BRIEF

Fire Ant Turns Routers Into Silent Spy Platforms

A China-linked espionage cluster tracked as Fire Ant has hijacked Cisco IOS XR routers and authentication servers to establish covert, log-evading access across enterprise networks, with reconnaissance activity extending toward U.S. critical infrastructure.

◆ MODERATECyber and Information Warfare
▌ INTELLIGENCE BRIEF

Germany Blames Russian GRU for Leipzig Airport Drone Plot

Germany has formally attributed an August 4 explosive drone attack on a Ukrainian cargo aircraft at Leipzig/Halle Airport to Russia's GRU military intelligence directorate, expelling diplomats and closing Russian diplomatic facilities in response.

◆ HIGH CONFIDENCECovert Operations
▌ INTELLIGENCE BRIEF

Iran Renews Strikes on US Bases in Jordan and Bahrain

Iran launched missile and drone strikes against US and allied military installations in Jordan and Bahrain on 1 September, the first direct clash in roughly a month, prompting President Trump to vow renewed retaliatory strikes against Tehran.

◆ MODERATEConflict and War
▌ INTELLIGENCE BRIEF

China-Linked Fire Ant Hijacks Router Infrastructure to Blind Network Defenses

A China-nexus threat actor tracked as Fire Ant has expanded its espionage campaign from VMware hypervisors to Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts, using the compromised infrastructure to harvest credentials and blind security logging across high-value networks.

◆ HIGH CONFIDENCECyber and Information Warfare