Reporting period: September 14–21, 2026

Executive assessment

The most consequential development this week is the U.S. exposure of what prosecutors describe as a Russian intelligence services network conducting pre-operational surveillance, assassination recruitment, and terrorism/sabotage tasking across the United States and Europe. The September 15 indictment is unusually valuable because it exposes the operational ladder behind activity that has repeatedly appeared in European investigations: a recruit can begin with a $200 photography assignment, then be offered $25,000 to murder a dissident, and, after refusing, be redirected toward arson against warehouses or electrical substations in countries supporting Ukraine. DOJ says one member is an FSB officer and another a former Russian intelligence colonel. (Department of Justice)

That substantially strengthens the standing assessment that Moscow’s apparent “disposable agent” activity is not a collection of unrelated criminal cases. At least one alleged network appears designed to move recruits through:

The second major development is Iranian. The U.K., U.S., and Netherlands jointly exposed CHOSEN BRICK, Windows spyware used by Iranian state actors against dissidents, journalists, and activists. Its intelligence significance goes beyond malware collection. Stolen information has subsequently appeared on pro-Iranian leak sites, while the same target population has faced Iranian kidnapping and lethal-operation plots. This suggests a continuum between cyberespionage, coercive exposure, target development, and transnational repression. (National Cyber Security Centre)

China presents a different pattern. A former U.S. soldier pleaded guilty to helping obtain U.S. Army information for recipients in China; South Korea’s Supreme Court finalized the conviction of a former soldier who sold U.S.-ROK exercise information to an alleged Chinese intelligence officer; and ESET disclosed a sustained China-aligned cyberespionage campaign in which 90% of FamousSparrow’s observed targets since mid-2025 were in Latin America. (Department of Justice)

Key judgment: Russian activity currently presents the clearest convergence of espionage, sabotage, assassination, and terrorism-like covert action. Iranian activity shows a comparable convergence between cyber collection and physical transnational repression. Chinese operations remain predominantly oriented toward military, governmental, economic, and strategic intelligence acquisition.

U.S. exposes alleged Russian global assassination and sabotage network

On September 15, the U.S. Department of Justice unsealed an indictment against five alleged members of a network working for Russian intelligence:

• Yuri Khrameev, 63, described as a former Russian intelligence colonel;
• Kirill Khrameev, 27, identified by DOJ as an FSB officer and Yuri’s son;
• Oemis Romagoza Durruthy, 35, a Cuban national residing in Russia;
• Yaidel Delgado Suarez, 35, allegedly a prolific recruiter;
• Angel Eduardo Castro, 22, a Venezuelan national. (Department of Justice)

U.S. DOJ: Russian Intelligence Services Network indictment

The defendants remain at large and the allegations have not been adjudicated. The indictment describes an organization operating since at least 2024 that recruited people to conduct surveillance, assassinations, and attacks against civilian and military infrastructure in countries supporting Ukraine.

U.S. assassination operation

During summer 2026, Suarez allegedly recruited a U.S.-based individual to surveil a prominent Russian dissident believed to reside in the United States. The recruit received locations connected with the target and instructions for conducting surveillance. Payment offered for the reconnaissance was $1,000–$1,500. The recruit photographed and filmed the locations. Suarez and Castro then allegedly offered him $40,000 to “eliminate” or “disappear” the target. When he refused to personally commit the killing, they asked whether he knew someone else who would. Suarez allegedly said that other prospective killers were available in Mexico.

Lithuania operation

The indictment exposes an even clearer escalation mechanism. Kirill Khrameev allegedly recruited a U.S. citizen to photograph the residence of a Russian expatriate in Lithuania for approximately $200. After the surveillance was completed, Kirill introduced the recruit to Yuri Khrameev. Yuri then allegedly offered approximately $25,000 to kill the target, suggesting stabbing or an incendiary attack. When the recruit declined, Khrameev allegedly offered a “simpler job”: burn a warehouse or attack an electrical substation. According to DOJ, Khrameev explicitly said the purpose was to target countries helping Ukraine. (Department of Justice)

This is exceptionally useful tradecraft evidence because it exposes the transition from collection to kinetic action.

The first assignment functions simultaneously as reconnaissance and asset assessment. The service learns whether the recruit follows instructions, maintains communications, accepts money, reaches the target, and produces usable intelligence before exposing him to more serious tasking.

International reach

DOJ also alleges Durruthy coordinated logistics associated with attacks in Prague in June 2024 and Lithuania in September 2024, including target information, travel arrangements, and communications with participants. (Department of Justice)

Strategic objective

The network appears to support two Russian requirements:

• transnational repression: eliminating or intimidating Russian dissidents and defectors;
• coercive warfare: conducting sabotage against countries providing military or political support to Ukraine.

This is therefore not conventional espionage. Intelligence collection is functioning as the preparatory stage for state-directed violence.

Veracity assessment

• Existence of indictment and underlying FBI investigation: very high confidence.

• Individual operational allegations: high-moderate confidence pending adjudication.

• Russian intelligence nexus: high-moderate confidence. DOJ identifies Kirill Khrameev specifically as an FSB officer, and the indictment contains extensive alleged communications and recruitment activity.

Russia rejects allegations that it conducts foreign assassination operations. (Reuters)

Disinformation/deception risk

Moderate.

The evidentiary distinction remains important: these are detailed criminal allegations, not convictions. However, dismissing the entire network as Western narrative construction is increasingly difficult because the indictment provides specific names, payments, recruitment conversations, target locations, and operational activity.

Russian espionage-to-sabotage architecture is becoming visible

The new indictment materially strengthens several assessments from previous briefs. During recent weeks, European and allied investigations have independently exposed:

• Denmark: Russian recruitment of civilians to photograph defense companies and Ukraine-support infrastructure.

• Germany: GPS-equipped parcels used to map logistics routes before prospective sabotage.

• Romania: surveillance of NATO facilities, communications infrastructure, and Ukrainian Antonov aircraft.

• Britain: alleged reconnaissance against drone-production facilities by a recruit accused of working with a Russian-controlled network.

• Berlin: a clandestine weapons cache suspected of supporting Russian covert action.

• Arctic: reported GUGI experimentation with covert subsea-cable disruption.

The U.S. indictment now provides a plausible human infrastructure connecting reconnaissance with actual attack tasking.

Confidence: high.

This does not establish that all European incidents originate from the Khrameev network. It demonstrates that at least one alleged Russian network uses precisely the recruitment progression European counterintelligence services have been warning about.

European intelligence chiefs warn Russian escalation could occur within months

Reporting published September 21 quotes several European intelligence chiefs warning that Russian operations against NATO could intensify considerably. Czech BIS chief Michal Koudelka reportedly assesses escalation could occur in “months, not years,” including sabotage, drones, influence operations, and potentially limited incursions. Latvian State Security Service chief Normunds Mežviets offered a more qualified assessment, saying there are no indicators of an imminent large-scale attack but that Russia appears to be preparing for more decisive activity.

Swedish military intelligence chief Thomas Nilsson reportedly described the Leipzig explosive-drone incident as a “gamechanger”, because Russian sabotage capable of killing people would represent a substantial escalation. (Yeni Şafak English)

France separately stated on September 18 that Russian hybrid attacks against Europe are intensifying. President Emmanuel Macron ordered development of additional protections for critical infrastructure against drone and cyberattack. (AOL.com)

Assessment

• These warnings independently reinforce the Ratcliffe Moscow-visit assessment.

The most likely escalation pathway remains:

Confidence: high-moderate.

Iran: CHOSEN BRICK links cyber-espionage with transnational repression

On September 15, Britain’s National Cyber Security Centre, the FBI, and the Netherlands’ AIVD jointly disclosed a spyware family called CHOSEN BRICK used by Iranian state cyber actors against dissidents, activists, and journalists.

The campaign has operated since at least 2025.

Initial access

One documented lure involved fabricated MRI results. (National Cyber Security Centre)

Malware capability

CHOSEN BRICK can:

• steal contacts;
• collect emails;
• acquire WhatsApp and Telegram data from browsers;
• capture screens;
• record audio through the microphone;
• enumerate system information;
• download additional malware;
• persist through reboot;
• alter Microsoft Defender exclusions;
• and communicate through Telegram C2. (theregister)

Each infected system can communicate through a victim-specific Telegram bot, reducing infrastructure overlap among victims.

Malware IOC’s

Intelligence-to-coercion pipeline

The most important aspect is what happens after collection. The NCSC says personal information stolen from some victims subsequently appeared on pro-Iranian leak sites. The agencies also explicitly note that Iranian intelligence services have plotted kidnappings and lethal operations against individuals abroad whom Tehran considers enemies.

This produces an operational continuum:

Assessed objective

This is better classified as cyber-enabled transnational repression than ordinary cyberespionage.

Collection serves several possible purposes simultaneously:

• identify opposition networks;
• map contacts;
• discover travel and location information;
• expose sources;
• discredit targets;
• intimidate diaspora communities;
• and potentially support physical operations.

Veracity

• Campaign existence and malware capabilities: very high confidence.

• Three allied national-security organizations jointly issued the technical assessment.

Iranian state attribution: high confidence.

The NCSC assesses Iran almost certainly uses cyber activity to support repression. Reuters reports the FBI associates the activity with Iran’s Ministry of Intelligence and Security. (Reuters)

Disinformation risk

Low for the technical campaign; moderate for individual attribution beyond the published evidence.

The advisory does not publicly identify every victim or establish that every Iranian leak operation derives from CHOSEN BRICK.

China: former U.S. soldier admits military collection network

Former U.S. Army soldier Ruoyu Duan pleaded guilty September 16 to conspiracy to gather and transmit national-defense information.

DOJ: Ruoyu Duan guilty plea

Duan served in the Army from 2013–2017 and had training in handling sensitive and classified information. According to court documents, from November 2021 through March 2025 he conspired with others to acquire information concerning U.S. Army operational capabilities.

He paid active-duty soldiers and others for material concerning:

• Bradley fighting vehicles;
• Stryker vehicles;
• HIMARS;
• training materials;
• computer equipment;
• technical manuals;
• and intelligence reporting.

The material was subsequently transferred to people in China.

Tradecraft

This is a classic insider-recruitment architecture:

The former soldier serves as a buffer between the ultimate recipient and currently serving personnel.

Assessed objective

Collection against U.S. land-warfare capabilities and Indo-Pacific operational planning. HIMARS is particularly significant because of its relevance to U.S. Pacific operations and Taiwan contingencies.

Attribution discipline

DOJ establishes that information was transferred to individuals in China. The guilty plea does not by itself establish publicly that the recipients were MSS or PLA intelligence officers. That distinction should be preserved.

Veracity

Very high for Duan’s participation and transfer of defense information.

PRC government direction: unresolved from the currently cited public evidence.

South Korean soldier sold U.S.-ROK exercise intelligence to alleged Chinese intelligence officer

South Korea’s Supreme Court finalized a four-year sentence for a former Army sergeant who provided classified military information to a Chinese national he met through social media. (Yonhap News)

The Chinese contact allegedly identified himself as an official from a Chinese intelligence organization. The soldier subsequently provided classified information on seven occasions between August 2024 and February 2025 in exchange for approximately 17.26 million won.

Material included:

• U.S.-South Korean joint exercise information;
• United Nations Command material;
• South Korean military exercise information.

The handler supplied the soldier with a wristwatch camera for photographing classified documents.

The watch camera is traditional HUMINT equipment being used inside a digitally initiated recruitment.

Connection to previous South Korean case

This resembles the Chinese-linked Ken Jake network covered in an earlier brief, which also used social-media recruitment, financial incentives, concealed cameras, and military insiders. That overlap does not prove a common handler or organization. It does indicate a recurring collection methodology against South Korea’s defense establishment.

Veracity

Very high for the espionage conviction.

Specific Chinese intelligence organization: unclear publicly.

FamousSparrow shifts cyberespionage focus toward Latin American governments

On September 17, ESET disclosed a major geographic shift by the China-aligned cyberespionage actor FamousSparrow. Approximately 90% of FamousSparrow targets observed by ESET since mid-2025 have been located in Latin America. (GlobeNewswire)

Government organizations were compromised or targeted in:

• Argentina;
• Ecuador;
• Guatemala;
• Honduras;
• Panama;
• Peru;
• Puerto Rico;
• Venezuela.

New malware

The group has largely replaced SparrowDoor with a custom modular C++ backdoor called SparroWocky.

Capabilities include:

• arbitrary command execution;
• arbitrary file execution;
• TCP proxying;
• host reconnaissance;
• screenshot capture;
• file exfiltration;
• service or registry persistence;
• encrypted communications;
• runtime code modification;
• and Beacon Object File execution. (GlobeNewswire)

ESET attributes SparroWocky to FamousSparrow with high confidence based partly on direct deployment alongside SparrowDoor and overlapping victimology.

Assessed intelligence objective

ESET assesses the Latin American concentration probably reflects Beijing’s desire to understand governmental reactions to expanding U.S. activity in the region. One Panamanian target was directly involved in the dispute concerning two major ports near the Panama Canal previously operated by a China-based company. (GlobeNewswire)

The likely requirement is therefore:

rather than indiscriminate cyber collection.

Veracity

FamousSparrow campaign: high confidence.

China alignment: high-moderate confidence.

Specific Chinese government tasking: moderate/analytic.

ESET’s geopolitical explanation is plausible but remains an assessment rather than evidence of a documented tasking order.

Russia: we can now see the recruitment ladder

The Russian indictment is the week’s most analytically valuable development because it supplies the missing connective tissue between seemingly low-level reconnaissance activity and destructive operations across Europe. The recruitment ladder is now clearer: online or local recruitment can begin with a trivial paid task, such as a $200 photography assignment, which allows the handler to assess reliability before escalating to more serious operational proposals. In the cited case, that progression moved from reconnaissance to a $25,000 assassination offer and, after refusal, to proposed sabotage against a warehouse or electrical substation. The Department of Justice evidence therefore reinforces the assessment that mundane photography, surveillance, and pattern-of-life collection may function as the probationary phase of a covert-action recruitment process, in which the service is simultaneously acquiring intelligence and testing whether the recruit can be trusted with increasingly consequential tasks. The counterintelligence implication is significant: a person photographing a defense plant may not yet be a saboteur, but they may be undergoing an audition to become one.

A notable commonality emerges between the Russian and Iranian cases: both use intelligence collection as an enabling layer for activity that extends beyond traditional espionage into coercion, sabotage, or physical targeting. In the Russian model, surveillance and reconnaissance can progress into assassination or sabotage tasking, with human proxies used to collect information, test access, and potentially conduct operations. The Iranian CHOSEN BRICK model begins instead with cyber compromise of individual targets, allowing operators to collect communications, map relationships, identify locations and patterns of life, and then exploit that intelligence through selective leaking, doxxing, intimidation, or potential physical targeting. The principal distinction is therefore the collection mechanism: Russia’s exposed network relies heavily on recruited human proxies, while Iran begins with digital penetration of the target. In both cases, however, espionage functions as a preparatory stage for broader coercive activity and can support transnational repression.

The Duan and South Korean cases reinforce a distinct Chinese collection pattern in which the most valuable asset is not necessarily a trained intelligence operative, but an individual who already possesses military access, technical expertise, professional credentials, or institutional trust. That legitimate position can then be exploited through financial incentives, collection requirements, and relatively simple clandestine equipment to acquire sensitive technical or operational information. FamousSparrow represents the cyber equivalent of the same model: rather than recruiting a human insider, the operator establishes persistent access to government systems and quietly extracts information relevant to strategic decision-making. The common feature is access already embedded inside trusted environments. China’s observable pattern this week is therefore best characterized as legitimate human access plus persistent cyber access leading to strategic information acquisition, rather than the Russian pattern in which recruitment and reconnaissance can escalate toward sabotage or other destructive activity.

This week’s reporting also provides a useful cautionary example of the distinction between counterintelligence risk and confirmed espionage. A senior Spanish naval officer assigned to NATO Allied Maritime Command reportedly lost his security clearance after concerns arose over his relationship with Janina White, a British-Polish citizen born in the Soviet Union whom he met through Tinder. The officer was based at Northwood, where NATO monitors Russian submarines, warships, and shadow-fleet activity, making the relationship inherently relevant from a counterintelligence perspective. White has also said that during a subsequent visit to St. Petersburg she was questioned for approximately two hours by a man who identified himself as an FSB officer. These circumstances justify security scrutiny, but they do not establish espionage. White has not been arrested, charged, or publicly demonstrated to be a Russian intelligence asset; she denies involvement in espionage and is pursuing legal action alleging discrimination. The appropriate assessment is therefore that a significant counterintelligence concern was identified with high confidence, while allegations that White acted as a Russian agent remain unsubstantiated. The case should not be incorporated into the broader Russian operational network without additional evidence and serves as an important example of the analytical boundary between prudent counterintelligence risk management and formal espionage attribution.

The week’s most consequential analytical development is the stronger evidentiary support for the previously assessed Russian espionage-to-sabotage pipeline. The U.S. indictment describes an alleged Russian intelligence network in which handlers moved recruits from inexpensive surveillance assignments to assassination proposals and, when assassination was refused, to potential attacks against warehouses and electrical infrastructure in countries supporting Ukraine. This alleged progression closely parallels patterns independently reported by European security services and supports an emerging model of;

• Recruit a disposable intermediary
• Assign an apparently innocuous intelligence task
• Assess reliability
• Escalate operational tasking
• Conduct deniable violence.

Iran’s CHOSEN BRICK campaign reveals a parallel system built around digital rather than human access, with cyber compromise of individuals enabling communications collection, relationship and location mapping, selective leaks, intimidation, target development, and potentially physical transnational repression. China’s activity remains structurally different: the cases examined this week center primarily on acquiring legitimate insider access, military and technical information, government decision-making, and strategically significant technology, while FamousSparrow’s concentration on Latin American government targets suggests an intelligence requirement increasingly shaped by strategic competition and Beijing’s interest in political, economic, and diplomatic developments in the region. Together, the cases illustrate three distinct models: Russia using intelligence collection as a pathway toward deniable disruptive action, Iran using cyber-enabled collection to support coercion and transnational targeting, and China emphasizing sustained human and cyber access for strategic information acquisition.

Current assessments

• Russian state-directed assassination/sabotage network: High-moderate confidence; materially strengthened this week.

• Russian use of low-level reconnaissance as a gateway to kinetic recruitment: High confidence.

• Near-term Russian hybrid escalation against NATO: Elevated; high-moderate confidence.

• Iranian cyber-enabled transnational repression: High confidence.

• Chinese collection against U.S./allied military capabilities: High confidence at activity level; specific service attribution varies.

• Chinese cyberespionage focus on Latin American governments: High confidence for activity, moderate confidence for specific strategic tasking.

The primary warning indicator remains deceptively mundane: a stranger paying someone to take photographs, visit an address, watch a facility, identify an employee, or report what happens at a location. The new DOJ case demonstrates why that activity should not automatically be treated as low-level collection. It may be the first stage of the recruitment process for something considerably more destructive.