SpyWitness News — Intelligence & Global Security

▌ LATEST INTELLIGENCEMONDAY, 2 NOVEMBER 2026

Baku Becomes Hub in German Spy Scandal as Secret Russia Talks Surface

◆ LOW CONFIDENCEGeopolitical Analysis14 OCT 2026

Reporting that former German officials met Russian representatives in Azerbaijan, while ex-BND chief August Hanning sat on a German-Azerbaijani forum board, places Baku at the centre of a possible influence channel that German counterintelligence is only beginning to map.

ALSO FILED

▌ INTELLIGENCE BRIEF

Two Charged as Britain Tests Iran's Fairford Operation in Court

UK prosecutors have charged two men under the National Security Act over the RAF Fairford vans incident, the first court test of the allegation that Iran directed a hostile operation against a US-used air base on British soil.

◆ MODERATECovert Operations

▌ INTELLIGENCE BRIEF

Qatari Gas Tanker Hit as Iran War Mediation Teeters

An unattributed attack on a Qatari LNG carrier, while Qatar hosts mediation, suggests an actor is working to degrade the one channel keeping the US-Iran war paused.

◆ MODERATEGeopolitical Analysis

INTELLIGENCE ARCHIVE

▌ INTELLIGENCE BRIEF

Two Charged as Britain Tests Iran's Fairford Operation in Court

◆ MODERATECovert Operations

▌ INTELLIGENCE BRIEF

Qatari Gas Tanker Hit as Iran War Mediation Teeters

An unattributed attack on a Qatari LNG carrier, while Qatar hosts mediation, suggests an actor is working to degrade the one channel keeping the US-Iran war paused.

◆ MODERATEGeopolitical Analysis

▌ INTELLIGENCE BRIEF

Hegseth Fires Joint Staff Strategy Chief Over Alleged Iran, Ukraine Leaks

The firing of Joint Staff strategy chief Lt. Gen. Brett Sylvia over alleged leaks on Iran and Ukraine, with a Justice Department referral, shows the Pentagon's leak hunt has reached the core of its war-planning apparatus.

◆ MODERATEIntelligence Community

▌ INTELLIGENCE BRIEF

Volt Typhoon's Disposable Relay Network Blinds US Defenders

Black Lotus Labs assesses that China-linked Volt Typhoon moved to single-use, self-erasing relay chains and management-platform zero-days, degrading defenders' ability to detect and attribute pre-positioned access in US critical infrastructure.

◆ MODERATECyber and Information Warfare

▌ INTELLIGENCE BRIEF

Storm-0940 Weaponises AI Agents Against ConnectWise Supply Chain

Microsoft assesses that China-aligned Storm-0940 used the open-source ARTEX agentic AI framework to turn a ConnectWise cloud-backup compromise into automated attacks on more than 2,250 Microsoft 365 tenants, compressing time from targeting to privileged access to under three hours in some cases.

◆ MODERATECyber and Information Warfare

▌ INTELLIGENCE BRIEF

Finland, Norway Open Direct Channel to Putin as Russia Hits Kyiv

Finland and Norway opened a rare direct line to Putin on 27 October, coordinated with Kyiv and Washington, while Russia struck Kyiv's South Bridge overnight, indicating Moscow is pairing diplomatic access with pressure on Ukrainian logistics ahead of November talks in Abu Dhabi.

◆ MODERATEGeopolitical Analysis

▌ INTELLIGENCE BRIEF

Netanyahu Reportedly Sought Pre-Election Iran Strike; Washington Held Back

Anonymously sourced US and Israeli accounts say Netanyahu lobbied Washington for a joint Iran strike before Israel's 27 October election and was held back partly by the IDF chief's warning, a claim Israeli leaders deny, while the Shin Bet separately removed foreign influence accounts targeting the vote.

◆ LOW CONFIDENCEGeopolitical Analysis

▌ INTELLIGENCE BRIEF

China-Aligned Storm-0940 Turns AI Agents on 2,250 Microsoft Tenants

Microsoft attributes a ConnectWise supply-chain compromise that reached roughly 2,250 Microsoft 365 tenants to China-aligned Storm-0940, assessing that agentic AI drove intrusion at machine speed and compressing the window defenders have to respond.

◆ MODERATECyber and Information Warfare

▌ INTELLIGENCE BRIEF

54 Russia-Linked Sabotage Incidents Strike Europe in Six Months, Broadcasters Find

A 17-broadcaster EBU-SVT investigation counts at least 54 Russia-linked physical sabotage attacks and plots across Europe between April and October 2026, with Estonia's security service confirming one arson was ordered by Russian intelligence.

◆ MODERATESecurity and Defence