The Security Brief

Tag: APT

  • A Technical Post-Mortem of the Notepad++ Supply Chain Compromise

    The modern software supply chain is built on a foundation of implicit trust; a trust that users and systems place in update mechanisms to deliver secure patches. When this trust is weaponized, the resulting compromise can bypass even the most robust perimeter defenses. Between June and December 2025, the Notepad++ project became the target of a sophisticated infrastructure-level supply chain compromise attributed to a People’s Republic of China (PRC)-aligned threat actor. The operation, characterized by its selective targeting and operational stealth, used a compromise of the project’s shared hosting environment to manipulate the software’s update mechanism, WinGUp.

    This post will break down the technical specifics of the breach, the on-path hijacking mechanism, and the custom malware deployed against high-value targets.

    The Infrastructure Breach

    The compromise did not originate from a vulnerability in the Notepad++ source code itself, but from a fundamental weakness in the hosting infrastructure. On 2 February 2026, Notepad++ maintainer Don Ho disclosed that the project’s official domain was targeted through an infrastructure-level compromise at their former shared hosting provider.

    According to their investigations, the threat actor specifically searched for an targeted the notepad-plus-plus.org domain within the shared environment, ignoring other tenants. This targeted approach allowed the threat actor to intercept and manipulate the server-side logic responsible for handling update requests.

    Six-Month Dwell Time

    The timeline shows a patient adversary who maintained a foothold for half a year:

    • June 2025: Initial compromise of the shared hosting server.
    • Sept 2, 2025: Attackers lost direct server access following scheduled maintenance that updated the system’s kernel and firmware.
    • Sept – Dec. 2, 2025: Despite losing server access, the attackers retained stolen credentials for internal service accounts. This allowed them to continue redirecting update traffic for an additional three months.

    On-Path Redirection

    The mechanism for the delivery was a classic on-path infrastructure manipulation. When a user running an older version of Notepad++ checked for updates, the built-in Windows Generic Update Program (WinGUp, or gup.exe) would query the official website.

    Request > Redirection > Poisoned manifest > Unverified Execution

    This method was highly selective. Rather than a mass infection event, the attackers only redirected specific traffic likely based on the victim’s IP address or organizational profile.

    Chrysalis Payload and Multiple Infection Chains

    Technical analysis by Rapid7 and Kaspersky has identified at least three distinct infection chains used throughout the campaign to deliver various payloads, most notably a previously undocumented custom backdoor tracked as Chrysalis.

    The Chrysalis Backdoor

    Chrysalis is a sophisticated, feature-rich implant meant for long-term espionage. It’s capabilities include:

    • Uses Microsoft Warbird code protection and custom API hashing to evade detection.
    • Supports remote command execution, file system and registry enumeration, and process management.
    • Implements a chunked file transfer protocol over its C2 channel to bypass network size limits and mimic legitimate traffic.

    Infection Chain Summary

    PhaseTechniquePayload
    Chain 1 (July/Aug)ProShow DLL sideloadingCobalt Strike Beacon
    Chain 2 (Sept)Lua-based execution using legit Lua interpreter dropped in an Adobe themed folderCobalt Strike Beacon
    Chain 3 (Oct/Nov)Trojanized installer dropping a renamed Bitdefender binary to sideload log.dllChrysalis Backdoor

    Attribution

    Several researchers, including Kevin Beaumont (who first reported the issue in December 2025) and Rapid7, have attributed this activity to Lotus Blossom (aka Billbug, Violet Typhoon, APT31).

    Lotus Blossom is a Chinese state-sponsored group active since at least 2009, known for targeting government, telecommunications, and finance sectors across Southeast Asia. The precision of the Notepad++ targeting is highly consistent with the group’s historical intelligence requirements.

    Targets

    The campaign’s impact was concentrated in:

    • Sectors: Telecom, Financial Services, IT Services, Government
    • Regions: Vietnam, Philippines, El Salvador, Australia

    By compromising network administrators or engineers at a telecom provider via a trusted tool like Notepad++, the threat actors gain a vantage point for deep reconnaissance across the provider’s entire infrastructure, potentially facilitating further access to downstream high-value targets.

    Mitigation and Defense

    The Notepad++ maintainers have since migrated to a hardened hosting provider and released security-focused updates.

    Recommendations

    1. Ensure all Notepad++ installations are upgraded to version 8.9.1 or later. Versions 8.8.9 implement mandatory signature and certificate verification for all updates.
    2. Remove any custom root certificates that were required for older Notepad++ installations. Official binaries are now signed with valid GlobalSign certificates.
    3. Scan systems for files named AutoUpdater.exe or update.exe in the %TEMP% directory, as these are not legitimate Notepad++ filenames.
    4. Restrict gup.exe from connecting to any domain other than notepad-plus-plus.org or github.com.
    5. Enforce allow-listing for update mechanisms. Consider centrally managing developer utilities rather than allowing unverified, internet-initiated auto-updates.

    Technical Indicators of Compromise (IOCs)

    TypeValue
    C2 Domainapi.skycloudcenter[.]com
    C2 Domainapi.wiresguard[.]com
    C2 Domaincdncheck.it[.]com
    C2 Domainsafe-dns.it[.]com
    Exfil Hosttemp[.]sh
    Malicious URLhttp://95.179.213%5B.%5D0/update/update.exe
    Installer Hash (SHA1)8e6e505438c21f3d281e1cc257abdbf7223b7f5a
    Chrysalis Loader Path%AppData%\Bluetooth\log.dll

    Works cited

    1. https://fieldeffect.com/blog/chinese-linked-actors-notepad-update
    2. https://cyberunit.com/insights/notepad-plus-plus-supply-chain-attack/
    3. https://community.f5.com/kb/security-insights/f5-threat-report—december-17th-2025/344787
    4. https://www.csoonline.com/article/4126269/notepad-infrastructure-hijacked-by-chinese-apt-in-sophisticated-supply-chain-attack.html
    5. https://thehackernews.com/2026/02/notepad-hosting-breach-attributed-to.html
    6. https://evrimagaci.org/gpt/notepad-updates-hijacked-by-suspected-chinese-hackers-526543
    7. https://www.helpnetsecurity.com/2026/02/03/notepad-supply-chain-attack-iocs-targets/
    8. https://cyberscoop.com/china-espionage-group-lotus-blossom-attacks-notepad/
    9. https://www.infosecurity-magazine.com/news/notepad-update-hijacked/
    10. https://www.wiu.edu/cybersecuritycenter/cybernews.php
    11. https://notepad-plus-plus.org/news/v889-released/
    12. https://www.darkreading.com/application-security/chinese-hackers-hijack-notepad-updates-6-months
    13. https://www.esecurityplanet.com/threats/notepad-update-servers-hijacked-in-targeted-supply-chain-attack/
    14. https://orca.security/resources/blog/notepad-plus-plus-supply-chain-attack/
    15. https://www.techzine.eu/news/devops/137271/vulnerability-in-notepad-updater-exploited-for-malware/
    16. https://doublepulsar.com/small-numbers-of-notepad-users-reporting-security-woes-371d7a3fd2d9
    17. https://www.r3-it.com/blog/supply-chain-attacks-defensive-playbook/

  • DynoWiper and the Polish Energy Sector

    DynoWiper and the Polish Energy Sector

    In late-December 2025, the Polish energy sector was targeted by a coordinated series of destructive cyberattacks using a new malware tracked as DynoWiper [1]. The operation affected over 30 renewable energy sites and a major combined heat and power plant during a period of extreme cold.

    Key Technical Observations:

    • DynoWiper is a destructive tool designed to overwrite or delete data. It shares significant code overlaps with the “ZOV” wiper previously used in Ukraine [2].
    • The attack focused on the distributed edge, specifically targeting Remote Terminal Units (RTUs) at wind and solar farms. Attackers damaged firmware to disable remote communication with the grid operator.
    • In several instances, access was gained via internet-exposed edge devices lacking multi-factor authentication (MFA).

    Attribution Discrepancy

    A fairly uncommon disagreement exists between private industry and Polish officials regarding the actor:

    • Sandworm (GRU): Linked by ESET and Dragos due to technical malware lineage and the 10th anniversary of the 2015 Ukraine blackout [3].
    • Dragonfly/Berserk Bear (FSB): Formally attributed by CERT.PL based on specific C2 infrastructure overlaps with current FSB espionage operations [4].

    The evidence suggests a collaborative model or shared contractor network. One agency likely provided the initial access/infrastructure while the other provided the specialized destructive tradecraft. The targeting of Polish critical infrastructure is a shift for FSB-aligned actors from long-term pre-positioning to active destruction against NATO critical infrastructure.

    References

    [1] https://www.welivesecurity.com/en/eset-research/eset-research-sandworm-cyberattack-poland-power-grid-late-2025/

    [1] https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/

    [3] https://pylos.co/2026/01/31/attributive-questions-in-high-profile-incidents/

    [4] https://cert.pl/en/posts/2026/01/incident-report-energy-sector-2025/

  • Iranian Hybrid Warfare: Internal Suppression and Transnational Influence Operations

    Iranian Hybrid Warfare: Internal Suppression and Transnational Influence Operations

    BLUF:

    The Iranian regime is transitioning from reactive crisis management to a proactive digital isolation strategy to secure domestic stability. Recent breaches of state media and renewed civil unrest have accelerated plans for a “Barracks Internet,” while simultaneous offensive cyber operations and foreign influence campaigns indicate Tehran is increasingly weaponizing digital infrastructure to suppress dissent at home and sow discord within Western adversaries.

    Key Judgements:

    • KJ-1: The Iranian government is highly likely to implement a permanent, tiered national internet by late-2026. This “whitelist” system will designate global internet access as a state-vetted privilege, effectively severing the general population from unmonitored external communication.
    • KJ-2: Recent inauthentic behavior clusters targeting French and Scottish independence movements are likely part of a broader IRGC-led influence operation designed to exploit Western sociopolitical fractures. The synchronization of these accounts with Iranian domestic internet outages confirms an Iran-based point of origin.
    • KJ-3: The sophisticated phishing campaign targeting the Iranian diaspora and Middle Eastern officials represents a shift toward high-precision intelligence collection. I assess with moderate confidence that these operations aim to map opposition networks and preemptively disrupt coordination between domestic activists and external supporters.

    Intelligence Analysis

    I. Domestic Instability and the Media Breach

    On Sunday, 18 January 2026, the Islamic Republic of Iran Broadcasting (IRIB) suffered a significant technical breach. Activists hijacked the Badr satellite feed to air footage of exiled Crown Prince Reza Pahlavi. The broadcast, which lasted approximately ten minutes, specifically called for the defection of military and security forces, a direct strike at the regime’s “center of gravity.” This incident demonstrates persistent vulnerabilities in state-controlled infrastructure despite heavy investment in cyber defense.

    II. The “Barracks Internet” Initiative

    In response to the December 2025-January 2026 protest wave, Tehran has accelerated the “National Information Network” (NIN). Reporting indicates a move toward “Absolute Digital Isolation,” where the general public is routed through a domestic intranet, while “White SIM cards” (unfiltered lines) are reserved for regime loyalists and security officials.

    This architecture allows the regime to maintain economic functions (banking and logistics) during unrest while completely darkening the digital environment for protestors.

    III. Transnational Influence Operations (France and Scottland)

    Open-source evidence from 2025 and early-2026 reveals that clusters of “patriotic” accounts in France and “Scottish Independence” personas on X (formerly Twitter) are operated by Iranian cyber units. These accounts:

    • Mimic local identities
    • Go silent instantly when Iran suffers domestic internet or power outages
    • In some cases, have pivoted to pro-Tehran messaging upon restoration of services

    The primary objective is not the success of these movements, but the erosion of social cohesion within NATO and EU member states as a retaliatory measure for Western support of Iranian dissidents.

    IV. Targeted Cyber Espionage

    The recent phishing wave utilized the Phoenix backdoor and QR-code-based WhatsApp hijacking. Unlike broad cybercrime, this campaign is surgically focused on:

    1. Iranian experts/dissidents: To monitor regime change discourse.
    2. Regional officials: Including a Lebanese cabinet minister, to collect intelligence on regional shifting alliances.
    3. US-based experts: To identify potential channels of influence or intelligence being fed to Western governments.

    Analysis of Alternatives (AoA)

    • Alternative 1: Independent Non-State Actors. The TV hack and phishing could be the work of decentralized hacktivist groups (e.g., Edalat-e Ali) acting without foreign state support. While plausible for the breach, the scale and sustained nature of the “Barracks Internet” and the global IO clusters suggest state-level resources and strategic intent.
    • Alternative 2: Technical Coincidence. The silencing of French/Scottish accounts could be attributed to platform-wide bot purges rather than Iranian internet outages. However, the exact temporal correlation with Iranian kinetic incidents (e.g., the June 2025 strikes) makes this highly improbable.

    Final Assessment

    The regime is entering a “Fortress Iran” phase. By decoupling from the global web, Tehran aims to make domestic coordination impossible while maintaining a digital sniper capability to target enemies abroad. Analysts should expect increased friction between the regime’s need for global economic integration and its survivalist need for total information control.

  • Controlled Impunity in Russia’s Cyber Underground

    On 23 October 2025, Recorded Future assessed that Russia has shifted from a largely permissive “safe haven” model for cybercriminals to a managed cybercrime ecosystem. This evolution reflects a strategy of controlled impunity, where Kremlin authorities selectively tolerate, leverage, or regulate cybercriminal actors based on intelligence value, geopolitical utility, and risk of international pressure. State-linked or state-aligned operators remain insulated, while lower-tier enablers, money-laundering intermediaries, and infrastructure providers have faced increased arrests, disruption, and publicity-driven crackdowns. The report notes growing mistrust inside the criminal underground, leading to closed recruitment, collateral requirements, affiliate vetting, and frequent rebranding. Ransomware activity remains steady, with hundreds of new variants emerging as operators fragment and adapt to law-enforcement pressure. Western counter-ransomware operations, sanctions, payment restrictions, and coordinated takedowns continue to raise operational risk and cost for Russia-based cybercriminal groups.

    Analysis: Russia’s cyber ecosystem is entering a state-directed equilibrium where criminal capability remains accessible to the government while the Kremlin applies selective enforcement to maintain plausible deniability and political signaling. This model resembles a regulated illicit market as opposed to a laissez-faire sanctuary. Expect continued fragmentation, OPSEC tightening, and increased friction in monetization pipelines, but not any meaningful reduction in Russian-nexus cyber operations. Western pressure is reshaping incentives without removing cybercrime’s value as an instrument of state power. Network defenders should prioritize disruption of enabling services and financial channels, not anticipate Russian law enforcement to meaningfully degrade core ransomware operators.

  • Leaked Files Expose Iranian Charming Kitten Operations (Cont.)

    Leaked Files Expose Iranian Charming Kitten Operations (Cont.)

    On 28 October 2025, researcher Nariman Gharib detailed leaked CSV files reportedly tied to Charming Kitten containing domain registrations, hosting activity, payment records, and operational email infrastructure spanning 2023 to 2024, along with references to Iranian telecom blocks and suspected IRGC-aligned procurement channels. The disclosure appears to map core service providers, cryptocurrency-based payments, and active operator accounts used to support phishing and infrastructure rotation.

    Analysis: If authentic, these files provide actionable insight into Charming Kitten’s procurement and infrastructure lifecycle, including financial flows and service dependencies that could accelerate attribution, blocking, and proactive disruption. Public exposure of operators, service vendors, and domestic network blocks may pressure Tehran’s cyber units to retool, yet historical behavior suggests Iran will likely maintain tempo and diversify infrastructure rather than cease activity. This case underscores the importance of tracking adversary logistics and payment mechanisms as a means of degrading persistent state-aligned access operations.

  • Adversaries Intensify Scanning and Brute Force Activity Against Perimeter Devices

    On 3 October 2025, GreyNoise reported a ~500% increase in unique IPs scanning Palo Alto Networks GlobalProtect/PAN-OS login portals, the highest level in 90 days; open-source coverage between 4–8 October corroborated elevated reconnaissance volumes and noted US-heavy scanning with additional clusters hitting Pakistan. In parallel, Cisco has warned of a large-scale brute-force campaign against VPN, web auth, and SSH services tracked by Talos since 18 March 2024, and with active exploitation of Cisco ASA/FTD VPN web services disclosed 25 September 2025.

    Analysis: The GlobalProtect scan spike is highly likely preparatory reconnaissance for credential-stuffing or exploit development rather than noise, based on the scale and concentration GreyNoise reported. It is likely that cross-vendor VPN and portal infrastructure will face elevated probing in the near term given the concurrent, actively exploited Cisco ASA and FTD web-services flaws and the US government’s emergency order on 25 September 2025 requiring agencies to immediately hunt for and mitigate compromise on those Cisco ASA/FTD devices.

  • Leaked Files Expose Iranian Charming Kitten Operations

    The KittenBusters repository publicly discloses internal materials tied to the Iranian APT known as Charming Kitten (IRGC-IO Counterintelligence Unit 1500). The disclosures include official documents, employee photos, malware samples, chat logs, attack reports, and translations, all intended as evidence of the group’s operations. The repo also names a purported leader (Abbas Rahrovi/Abbas Hosseini) associated with front companies, asserts the group has targeted telecoms, aviation, intelligence, and dissidents in the Middle East and beyond, and announces future releases of additional evidence.

    Analysis: The release of these materials tied to Charming Kitten gives us a rare visibility into the structure, leadership, and tradecraft of an Iranian state-sponsored actor. If real, these disclosures are highly likely to aid defenders in attribution and detection, but they also risk prompting the group to adapt its operations and shift infrastructure. The exposure of individual operators and front companies could pressure Iran’s cyber apparatus, but it is likely Tehran will deny involvement while continuing on with other campaigns under modified units or identities. Should be a fun one to follow.

    https://github.com/KittenBusters/CharmingKitten

  • Iranian APTs and the Next Phase of Infrastructure Risk

    Iranian APTs and the Next Phase of Infrastructure Risk

    In the wake of escalating tensions in the Middle East this past spring, Iranian state-sponsored hackers turned their focus toward a new frontier: US critical infrastructure.

    From May through June 2025, cybersecurity telemetry revealed a 133% surge in Iran-attributed cyber activity targeting US industrial and operational technology (OT) environments. These campaigns hit transportation and manufacturing sectors, but energy and water infrastructure remain long-standing targets. While espionage remains a primary objective, the evidence increasingly suggests Iran is preparing for more overt disruption.

    Strategic Escalation

    Iran’s cyber posture has always mirrored its geopolitical environment. In Spring 2025, that meant responding to Israeli and US airstrikes with asymmetric cyber operations. Groups like APT33 (Elfin), APT34 (OilRig), and MuddyWater (Static Kitten) ramped up traditional espionage, while more aggressive actors like CyberAv3ngers and Fox Kitten (tied to recent Pay2Key.I2P ransomware operations) pursued OT-focused sabotage and ransomware deployment.

    Iran’s messaging through pseudo-hacktivist fronts and deepening ties with ransomware operators clearly framed this activity as retaliation for “Western aggression.” That framing is part of a broader Iranian cyber doctrine that views critical infrastructure compromised as a form of coercion and deterrence.

    In parallel with APT activity, pro-Iranian hacktivists ramped up operations against US defense and critical infrastructure sectors. Groups like “Mr. Hamza” claimed responsibility for defacing and leaking data tied to defense contractors, including Raytheon technologies (RTX), following US involvement in strikes against Iranian facilities. While attribution remains murky, these operations often mirror Iranian state objectives and timelines, suggesting coordination or at least ideological alignment. The targeting of US DIB entities serves Tehran’s broader goal of projecting reach and retaliation across both digital and strategic domains.

    Pre-Positioning

    Iran’s shift toward OT environments is the most significant development.

    • MuddyWater and APT33 continued to exfiltrate intellectual property from manufacturing and defense-adjacent industries.
    • CyberAv3ngers targeted water control systems and other ICS devices with their custom malware, IOControl, discovered embedded in US and allied OT environments.
    • Fox Kitten evolved into a ransomware-as-a-service operator with an 80% (up from 70%) profit-share for affiliates targeting the US or Israel.

    Alongside collecting information, these actors are also establishing persistence. In many cases, backdoors were quietly planted and left dormant; signaling an intent for future activation should the need arise.

    ActorAffiliationFocusObjective
    MuddyWaterMOISAerospace & Defense, Utilities, Gov, Civil & NGOsEspionage
    APT33IRGCAerospace & Defense, Energy, Gov, HealthcareEspionage and Access
    CyberAv3ngersIRGCWater, ICS, FinanceDisruption
    Fox KittenUnkownIT/OT GatewaysRansomware-as-a-service
    OilRigMOISFinance, GovCredential Theft

    Implications for the US DIB

    Iran’s campaigns are displaying a willingness to target logistics, aerospace, and manufacturing suppliers that support US and Israeli defense sectors. The Defense Industrial Base (DIB) should expect more of this; not only from state-sponsored actors, but from criminal or hacktivist affiliates acting on behalf of Iran’s IRGC or MOIS cyber arms.

    Some immediate implications:

    • DIB contractors should hunt for Iranian TTPs and malware like IOControl and DNSpionage.
    • OT segmentation, remote access policies, and endpoint hygiene are foundational.
    • Incident response (IR) planning must include scenario-based escalation modeling: what happens if the access Iran gains today becomes a wiper event tomorrow?

    US Response: Shields Up

    Initially, the federal response may have felt quieter than prior cyber alerts like those during the Ukraine conflict but the signals were still there.

    On LinkedIn, Jen Easterly, former CISA Director, reactivated the Shields Up mantra within hours of US strikes on Iranian nuclear sites. Her post explicitly warned US critical infrastructure operators to expect:

    • Credential theft and phishing
    • ICS-specific malware
    • Wipers masquerading as ransomware
    • Propaganda-laced hacktivist campaigns

    Easterly urged sectors to segment OT networks, patch internet-facing systems, enforce MFA, rehearse ICS isolation, and actively monitor ISAC channels.

    The various critical infrastructure-related ISACs followed suit. And while no single campaign bannered over the response, the defense posture matched the moment.

    Jen Easterly emphasizes the importance of cybersecurity vigilance for US critical infrastructure in response to recent Iranian cyber activities.

    So What’s Next?

    Iran’s recent activity represents a shift in focus, not necessarily a shift in capability. The targeting of OT environments and critical infrastructure may reflect aspirational doctrine as much as operational readiness. While there’s no conclusive evidence that Iranian actors have staged disruptive payloads in U.S. networks, the direction of their targeting and tooling, particularly the development of ICS and OT-specific malware, suggests a growing interest in operational disruption, and not just information gathering.

    For the US defense and critical infrastructure communities, this creates a clear mandate to prepare for the next phase before it arrives.

    • Monitor beyond the perimeter: Iranian threat actors have historically gained access through default credentials, exposed devices, and lateral movements through flat networks.
    • Expect dual-use operations: Intelligence collection and pre-positioning are not mutually exclusive.
    • Reassess assumptions: Iranian groups are traditionally viewed as less sophisticated than Russian or Chinese APTs, but recent coordination and tooling suggest they’re evolving quickly.

    In short, we’re seeing a doctrinal pivot. Iran is exploring offensive options in OT environments, and testing how far it can go without triggering escalation. This makes detection, attribution, and sector-wide coordination more important than ever.

    References

    https://www.nozominetworks.com/blog/threat-actor-activity-related-to-the-iran-conflict

    https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol

    https://www.cisa.gov/news-events/news/joint-statement-cisa-fbi-dc3-and-nsa-potential-targeted-cyber-activity-against-us-critical

    https://therecord.media/iran-state-backed-hackers-industrial-attacks-spring-2025

  • Hidden Bear: How GRU Unit 29155 Evolved Into a Cyber Sabotage Force

    Hidden Bear: How GRU Unit 29155 Evolved Into a Cyber Sabotage Force

    Disclaimer: This post is based on unclassified, open-source reporting and reflects my personal analysis and interpretations. The views expressed here are my own and do not represent the views or positions of my employer.

    In a previous post, I detailed GRU Unit 29155’s role in physical sabotage campaigns across Europe, from the Skripal poisoning to the Czech arms depot blasts. For years, their operations reflected a legacy of Cold War-era tradecraft. Covert, kinetic, and plausibly deniable.

    But according to a new investigation from The Insider, Unit 29155 has undergone a major transformation. While their physical sabotage capabilities remain intact, they have expanded into the cyber domain, developing a set of offensive capabilities that go far beyond what most attributed to this unit.

    This evolution has implications not only for Ukraine but for NATO supply chains, digital infrastructure, and future hybrid conflicts.

    Cyber Attacks

    The reporting confirms what many in the threat intelligence space have suspected. Unit 29155 is no longer limited to physical acts of disruption. In 2022, the group ran the WhisperGate operation in Ukraine, using destructive malware to damage government systems and leak personal data. The intent was not just disruption. It was psychological destabilization.

    This operation was structured and deliberate. The malware wiped systems while the data leaks created distrust. This fits Russia’s broader approach to hybrid warfare, where technical, cognitive, and physical effects are coordinated for maximum pressure.

    Disinformation Campaigns

    Unit 29155 also operated false flag personas like Anonymous Poland. These were used to publish disinformation that undermined trust between Ukraine and its Western partners. This was not unsophisticated trolling. It was part of a campaign using multilingual content and coordinated narratives.

    In one example, the group reportedly collaborated with Bulgarian journalist Dilyana Gaytandzhieva to publish stolen material. This gave the operation a veneer of journalistic legitimacy. Russia has long used this kind of media laundering to amplify leaks, but seeing it connected to Unit 29155 shows their deeper involvement in the information space.

    Hacker Recruitment

    This evolution started more than a decade ago. Around 2012, the GRU began recruiting programmers and hackers through online forums and competition platforms. They focused on individuals who could operate quietly, build offensive tools, and maintain strong operational security.

    Some of these actors developed malware, access frameworks, and data exfiltration tools that supported both espionage and sabotage. This is the convergence of cybercrime tradecraft and military doctrine. Unit 29155 has grown into a force that can operate in the digital domain with the same intent and effect as their physical missions.

    NATO Supply Disruption

    The investigation also highlights the unit’s interest in transportation and logistics networks, particularly in countries like Poland. This is a strategic move. It targets the rear areas that support Ukraine’s defense by interfering with how weapons and supplies reach the front lines.

    Instead of blowing up rail lines, the modern version might involve tampering with scheduling software, triggering false alarms, or planting disruptive code that causes bottlenecks. The outcome is the same. Slow the response. Introduce uncertainty. Force decision makers to question the integrity of their support systems.

    This aligns closely with Russian military thinking. Create friction, delay, and confusion through minimal but high impact actions.

    Analyst Comments

    This isn’t a new threat; it’s a mature one. GRU Unit 29155 has evolved from a physical sabotage unit into a hybrid operations group. Their capabilities now span cyber access, information warfare, and physical disruption. All under the same command structure.

    For security professionals, this should change how we think about attribution and intent. A single unit may now be responsible for an email phishing campaign, a leaked set of government documents, and a compromised transportation system. That complicates response planning and forces a more integrated intelligence posture.

    In my opinion, cyber sabotage is no longer the prelude to conflict. In many cases, it is the conflict.

    References

    https://theins.press/en/inv/281731

    The Escalation of GRU Unit 29155: Espionage and Sabotage Tactics
  • Shortcut to Superpower? Rethinking Intelligence and Learning in the Age of AI

    Shortcut to Superpower? Rethinking Intelligence and Learning in the Age of AI

    If I can get the information faster and more efficiently with AI, is that really a bad thing?

    In national security, cyber defense, and intelligence work, speed and accuracy aren’t luxuries, they’re requirements. The faster an analyst can detect, assess, and act on information, the more resilient our posture becomes. So, it’s worth asking: if tools like AI can help us get to those insights faster, does it matter how we got there?

    This isn’t just a classroom debate anymore. It’s a matter of operational advantage that I’m afraid adversarial states may be addressing quicker.

    Intelligence Work is Changing

    In the traditional model, analysts were trained to research exhaustively and reason independently. Today, the volume of data is overwhelming, the velocity of conflict is increasing, and the information space is more contested than ever. Memorizing doctrine or manually parsing SIGINT is outdated.

    AI changes the workflow. It doesn’t remove critical thinking; it simply relocates it. Instead of spending hours searching for the right piece of intel or policy precedent, analysts can use AI to surface patterns, contextualize alerts, and propose early assessments. That frees up cognitive space to focus on what it means and what to do next.

    Another key shift in modern intelligence work is the sheer volume of internally generated reporting, ranging from post-incident summaries and investigative writeups to tactical threat advisories. Over time, these internal repositories have grown so vast that referencing older yet still-relevant documents in future reporting becomes a major challenge. Analysts often know the insight exists somewhere in the backlog, but tracking it down quickly, especially under time pressure, is inefficient or even unfeasible.

    This is where private, domain-specific AI models trained exclusively on an organization’s own corpus can change the game. By indexing historical reports and enabling semantic search across them, these models can retrieve and summarize relevant findings in seconds. For example, if a threat actor resurfaces after a long dormancy, the AI can instantly surface prior incidents, TTPs, and internal commentary, giving analysts a head start and ensuring continuity across time. Rather than reinventing the wheel, intelligence teams can build on their own institutional knowledge more effectively. While some organizations may already employ this functionality, I believe most companies and agencies have yet to adopt it at scale; at least for now.

    The Real Threat Isn’t AI, It’s Passive Use

    Threat actors are already using AI to generate disinformation, automate phishing, and map attack surfaces. If defenders don’t leverage the same tools, they fall behind.

    The real concern isn’t that AI makes us weaker thinkers. It’s that some people will use it to skip thinking entirely. I wouldn’t say that’s the AI’s fault, it’s the user’s intent. A disengaged mind won’t be saved or spoiled by technology. A sharp one, however, can be enhanced.

    Stategic Implications

    In a contested world both geopolitically and informationally, the competitive edge doesn’t go to the one who remembers the most. It goes to the one who can interrogate input, synthesize perspectives, and act decisively. AI, used correctly, accelerates the process.

    National security professionals, educators, and leadership teams should embrace AI not as a crutch, but as a force multiplier. Train people not just to consume answers but to pressure-test them. To ask better questions. To turn good input into greater output.

    Final Thought

    Whether you’re an analyst, policymaker, or digital defender, the real skill today isn’t thinking in isolate, it’s knowing how to think with assistance. The people who learn that now will be the ones driving strategy tomorrow.