SPY NEWS: 2026 — Week 43

Summary of the espionage-related news stories for the Week 43 (October 18–24) of 2026.

1. India/China: Army Officer’s Wife Booked for Espionage in Jammu over Alleged Chinese Links

Zee News reported on October 18th that “Jammu and Kashmir Police have registered an espionage case against the wife of a senior Army officer posted in Jammu, alleging that she shared sensitive information with foreign intelligence operatives, including individuals linked to China who allegedly posed as academicians. The FIR was registered at Gandhi Nagar Police Station in Jammu under Sections 3 and 5 of the Official Secrets Act, 1923, and Sections 152 and 61(2) of the Bharatiya Nyaya Sanhita (BNS), according to an official source on Sunday. The accused is a resident of Telangana. The woman is suspected of sharing sensitive information, documents, photographs and electronic data through encrypted communication channels with individuals allegedly linked to foreign intelligence agencies. According to the source, the suspected operatives established contact with the woman while posing as academicians and digital content creators. They allegedly persuaded her to write long-form articles on subjects including the environment, geopolitics and defence. Police are investigating how the woman came into contact with the suspected foreign operatives and whether sensitive information was passed on to them knowingly or unknowingly.”

2. Lithuania/Russia/Ukraine: Lithuania Says Attempted Starlink Arson was Russia-linked Sabotage

Reuters reported on October 18th that “Lithuania is treating an attempted arson attack at a SpaceX (SPCX.O) Starlink base station on Sunday as a ​Russia-linked act of sabotage aimed at undermining Ukraine’s military capacity, ‌the head of the government’s National Crisis Management Centre said. Lithuanian authorities are searching for suspects who attempted to set fire to a Starlink base station ​on the outskirts of the capital Vilnius at about 2 ​a.m. (2300 GMT on Saturday), said Vilmantas Vitkauskas. The blaze was ⁠quickly extinguished, causing only minor property damage and no disruption to ​operations, he added. “We understand that this was not a routine arson ​attack but an act of sabotage,” Vitkauskas told reporters in Vilnius. He said the incident was linked to earlier arson attacks against Starlink stations in Bulgaria and ​Poland. “They are part of Russian attempts to disrupt Starlink and influence ​the success of Ukrainian operations,” he said. “Ukraine is the target.” Ukraine uses Starlink terminals ‌extensively ⁠for battlefield communications and installs Starlink receivers in many of its drones as part of their guidance systems. The terminals are used to conduct strikes on Russian targets inside Ukraine and help its interceptor drones ​defend against Russian drone ​attacks.”

3. Ukraine/Russia: Ukraine’s SBU Detainsed Russian Agent in Izyum (Aug. 2026)

On October 19th we added this in our archived collection/footage playlist. As per its description, “coordinates: 49°13'18.0”N 37°18'04.0"E // 49.221653, 37.301111. On August 18th, 2026 the Ukraine’s Security Service (SBU) published this footage. According to Ukrainska Pravda, the incident actually happened a few days earlier, on August 6th, 2026. On that date, Ukraine’s SBU detained a 33-year-old man acting as an agent of Russia’s intelligence services. He had registered 27 Starlink satellite communications terminals, to be used by Russian forces. One of the terminals was discovered in the Russian-controlled Zaporizhzhia Oblast, used to control and communicate with Russian attack drones. This led to the investigation of the man, and his detainment by SBU officers. The suspect is an unemployed man who moved to Izyum after the Russian military occupied his original place of residence, Khrustalnyi in Luhansk Oblast. After moving to Izyum he started looking for work on social media. There, a representative from Russia’s intelligence services recruited him. Their communication continued via Telegram with the Russian handler paying him UAH 1,500 (approximately $30) via bank transfer for each Starlink terminal registered.”

4. United States/China: US Sanctions 5 Chinese Entities over Ex-Google Engineer’s AI Trade Secrets Theft

South China Morning Post reported on October 20th that “the US State Department announced on Monday that it was imposing sweeping sanctions under the Protecting American Intellectual Property Act (PAIPA) on five Chinese entities suspected of stealing trade secrets from American companies. The targets include Shanghai Zhisuan Technology, founded by former Google software engineer Ding Linwei, venture capital firm MiraclePlus and three related entities. Ding was convicted of seven counts of trade secret theft in January. A federal judge subsequently acquitted him on seven additional counts of economic espionage, finding insufficient evidence that he knew or intended at the time of the thefts that his conduct would benefit the Chinese government. The theft convictions remain in place.”

5. United States/Mexico: From Serving in Afghanistan to Operating in Mexico — The Last Mission of Two CIA Agents Trained in the US Army and Navy

El País reported on October 20th that “a tragic vehicle crash exposed a covert counter-narcotics operation riddled with irregularities. In mid-April, a pickup truck plunged off a mountain road in the Sierra of Chihuahua in Mexico, killing its four occupants. Two of them were officials from the Chihuahua Attorney General’s office, and the others, as was later confirmed, were undercover CIA agents. The case continues to unfold in new chapters, and over the weekend former Chihuahua prosecutor César Jáuregui was arrested, accused of treason for allowing — without authorization from the federal government — armed foreign officials to take part in sensitive security operations on Mexican soil. This Monday, the newspaper El Universal confirmed that the U.S. agents were Richard Leiter Johnston III, 35, and John Dudley Black, 43. Both served in their country’s armed forces — Johnston in the Army and Black in the Navy — and took part in operations in war zones such as Afghanistan. The Attorney General’s Office (FGR), which is investigating how the CIA agents entered Mexico and what they were doing there, has confirmed that shortly before the road accident the two had been present in an operation led by the Chihuahua Attorney General’s office to dismantle a huge drug lab in El Pinal, a community in the Sierra Tarahumara. The most sensitive aspect of the case is that the two men were armed and left the Chihuahua Attorney General’s facilities bound for El Pinal as part of the tactical group assigned to the mission, El Universal reported, after gaining access to details of the FGR investigation. That finding undermines the explanations offered by the Chihuahua government after the crash. Initially it was said they were U.S. embassy staff conducting training activities, with no mention of the CIA connection. Later authorities claimed the agents did not take part in the operation but simply met the state officials as they were returning to the capital and boarded their vehicle. Public information about the CIA operatives is scarce, which is reasonable given their status as spies. Black served in Afghanistan as a field aide to the commanding general of the 1st Marine Division, according to a brief profile published by The Seattle Times. He was born in San Francisco and raised in Washington, where he attended Gonzaga University. He played football and competed in track and field. He also took part in the university’s Reserve Officers’ Training Corps. “He was a pleasure to coach. He worked hard and gave his best. That’s why he was doing what he was doing. It was in his DNA. He put others first. He didn’t want to be the center of attention nor did he need to be. For young people, that’s unusual. He was a great man,” Black’s high school football coach, Dave McKenna, told the paper. In Johnston’s case, more biographical details have circulated on a site dedicated to publishing obituaries for U.S. Army Special Forces veterans. He was born in Washington, D.C., and graduated from the University of Virginia with a bachelor’s degree in history and Mandarin Chinese. In the U.S. Army he reached the rank of captain. He served as a platoon leader in the 25th Infantry, where he led soldiers in support of Operation Freedom Sentinel in Afghanistan in 2016, conducting counterterrorism operations and training Afghan Security Forces, the site U.S. Special Forces Taps notes. Johnston later joined the Special Forces and earned the coveted Green Beret. After leaving the Army, he served his government working in “some of the most challenging regions of the world,” including the Middle East, Africa, East Asia and the Americas. The obituary refrains from stating explicitly that the former soldier became a CIA operative. “Richard’s life was tragically cut short in a vehicle accident while on duty, supporting our nation’s priorities. […] He was doing work he truly believed in, using the skills he had refined throughout his career,” the site says. “His skills were instrumental in advancing critical initiatives that enhanced our national and global security.” El Universal reports that during the Chihuahua antinarcotics operation Johnston and Black “did not act as passive observers but as members of the armed tactical cell.” The FGR conducted interviews with state Attorney General’s officers who took part in the mission and reconstructed the CIA operatives’ final movements. “The U.S. agents actively took part in tactical foot maneuvers, carried long guns, wore balaclavas, checked coordinates on electronic tablets and coordinated directly with the director of the State Investigation Agency [Pedro Román Oseguera Cervantes, who also died],” the newspaper says.”

6. France: New Bosses Appointed for DGSI’s Counter-espionage and Counter-terrorism

Intelligence Online reported on October 19th that “with the French presidential election next April and as the Russian threat increases, the domestic intelligence service just appointed a new head of its Sub-Directorate H. Responsible for counter-espionage, it is one of the agency’s most critical departments. There’s also a new boss in the department dedicated to counter-terrorism.”

7. Russia/Ukraine: FSB Detained GUR Agent in Primorsky

Media Zone reported on October 19th that “FSB officers detained a 22-year-old resident of the city of Bolshoy Kamen in the Primorsky Territory, suspected of high treason. This was reported by the regional government. According to the security forces, the girl met in a Telegram and «maintained confidential cooperation» with a representative of the Main Intelligence Directorate of the Ministry of Defence of Ukraine. The FSB claims that, on his instructions, it collected and transmitted data about railway facilities in Primorye: relay cabinets, complex transformer and power substations. The girl was paid for this, the department indicated. The FSB reported that a resident of Bolshoy Kamen admitted guilt and «is actively cooperating with the investigation». It is unknown when exactly she was detained, but the court has already sent the girl to a pre-trial detention centre.”

8. Japan/Russia: Japan Slams Lack of Access to Journalist Detained in Russia

The Japan Times reported on October 20th that “Tokyo said Tuesday it was “extremely regrettable” that its diplomats had been unable to visit a Japanese journalist detained in Russia, despite a bilateral protocol that guarantees the right to consular access. Russia arrested the journalist from the Hokkaido Shimbun on the Far East island of Sakhalin a week ago on suspicion of espionage. Moscow has arrested several citizens of what it calls “unfriendly” countries in recent years, accusing them of working for Western intelligence services. Japan has denied the spying allegation and demanded that Russia release the man. Chief Cabinet Secretary Minoru Kihara said the protocol, which was signed between Japan and the Soviet Union and remains effective with Russia, ensures the right to consular access within “a period of no later than four days from the time of arrest or detention.” “It is therefore extremely regrettable that, despite this provision, a consular visit was not realized within the prescribed period,” Kihara said. Japan will “continue to strongly urge the Russian side to arrange a consular visit at the earliest possible time,“ he said, adding that Tokyo was also demanding his release, humanitarian consideration and fair treatment. Russian media reported that the journalist would remain in custody until Dec. 12. Moscow’s foreign ministry last week identified the arrested reporter as Yuki Imai, with a spokesperson saying he was accused of “conducting espionage activities on Russian territory.” Russia’s FSB security service said a Japanese national was arrested on Sakhalin — near a disputed cluster of islands — but did not name the individual.”

9. Taiwan/China: Four Indicted in Alleged Espionage Case

Taipei Times reported on October 20th that “the Taiwan High Prosecutors’ Office yesterday indicted four people, including a retired military police captain already facing separate espionage charges, for allegedly helping Chinese contacts pay Taiwanese service members for leaking classified military information. Retired captain Yu Cheng-yu (尤正宇), who was previously indicted for allegedly accepting tether cryptocurrency in exchange for military secrets, allegedly collected cryptocurrency on behalf of Chinese contacts, converted it into cash and distributed payments to service members who leaked classified information. He allegedly earned NT$430,403 from the scheme, prosecutors said. The other defendants are two retired servicemen surnamed Lee (李) and Sen (森), and a coast guard member surnamed Tsai (蔡), who allegedly provided a bank account to receive payments. Prosecutors urged the court to impose heavy sentences on all four. The case was yesterday transferred to the High Court.”

10. Poland/Ukraine: Poland Detains Reservist Suspected of Spying on Military Sites

AA reported on October 19th that “Polish military police have detained a Polish-Ukrainian dual national suspected of carrying out reconnaissance of military installations while attending an officer training course for reservists, officials said Monday. Deputy Defense Minister Cezary Tomczyk confirmed that the man was detained at the Military Medical Academy in the central city of Lodz after attracting the attention of Poland’s Military Counterintelligence Service. “He clearly revealed himself as someone carrying out reconnaissance of certain installations of the Polish Armed Forces,” Tomczyk told reporters. He stressed that the circumstances are still being investigated and that suspicions of espionage would have to be established through legal proceedings. The man was detained Friday on the orders of the Lodz-Polesie District Prosecutor’s Office after an investigation by military counterintelligence. He had acquired Polish citizenship some time previously and also holds Ukrainian citizenship, Tomczyk said. Polish authorities may contact Ukrainian security services as part of the investigation. The academy confirmed that a participant in its reserve training program had been detained but declined to disclose further details. According to daily Rzeczpospolita, officers found several cellphones, sets of documents and stamps, large amounts of foreign currency, and gold in the man’s possession. Authorities have not publicly confirmed those details. A court was expected Monday to consider whether the suspect should be placed in pretrial detention. Polish media said it was not yet known which foreign intelligence service he was suspected of working for.”

11. Ukraine/Russia: SBU Detained FSB Agent in Odesa

Ukraine’s SBU announced on October 19th that they “detained another FSB agent in Odesa. The attacker was preparing coordinates for rocket-drone attacks by the Rashists on the regional centre. It was established that the main «targets» that the enemy set before the adjuster were the locations of the National Guard of Ukraine, oil refining facilities and port infrastructure. As the investigation found out, the agent task was carried out by an enemy-recruited sales representative of a local food company. The Odessa woman came to the attention of the Russian intelligence service when she was looking for «additional» earnings in Telegram channels. After being recruited in the messenger chat, the agent contacted the Rashists through a «liaison» — employee of one of the departments of the occupation Ministry of Internal Affairs of the Russian Federation in the temporarily captured Crimea. According to his instructions, the figure tracked the places of concentration of personnel and equipment of the Ukrainian troops, and then marked them on Google Maps for further «reports» for the FSB. Separately, the agent recorded the location of oil refining enterprises and large logistics centres of the Odesa port. For the reconnaissance conspiracy, she constantly changed public transport, from the windows of which she photographed the location of Ukrainian sites on a telephone camera. SBU officers documented the crimes of the person involved and detained her «on a hot pursuit» while she was conducting a reconnaissance near a potential «target». During the detention, a smartphone with evidence of work on the FSB was seized from her.”

12. Hungary/Poland: Hungarian Journalists Feel the Pressure Lifting after Orbán’s Defeat

ABC News reported on October 19th that “just a few months ago, Hungarian investigative journalist Szabolcs Panyi faced smear campaigns in the pro-government media and accusations by top officials of spying for Ukraine. When the government filed a criminal complaint against him for espionage, he faced the prospect of years in prison, and left for Poland. Now, following an election in April that swept former Prime Minister Viktor Orbán out of office after 16 years in power, Panyi is again strolling the streets of the Hungarian capital, Budapest, and preparing to release his book, “Friends with Benefits,” which details Russian intelligence penetration and influence operations in Hungary. Orbán’s landslide loss in the election changed the fortunes of Panyi and many other journalists in the Central European country, where the populist leader had consolidated control over the media and cracked down on press freedoms.”

13. Israel/France: The French-Israeli Experts Monitoring TikTok and Eyeing New Business in Europe

Intelligence Online reported on October 19th that “the new Israeli start-up Senaï caused a stir among cyber-intelligence specialists at the latest ISS exhibition this month. Developing an AI tool that analyses videos on TikTok and Instagram, it is run by several Franco-Israelis who previously worked for industry giants such as NSO, Cognyte and Voyager Labs.”

14. Russia/United States/Finland/Ukraine: Russian Military Satellite Comes Within 26 Metres of US-Finnish Spacecraft Providing Data to Ukraine

The Insider reported on October 20th that “a Russian military satellite, Kosmos-2612, made an unusually close approach to the U.S.-Finnish commercial satellite ICEYE-X36, according to data from orbital monitoring services including Orbital Radar. The data shows the two spacecraft came within 26 meters of each other, with a relative speed of 0 kilometers per second. An orbital approach of less than 1 kilometer is considered critical. ICEYE-X36 is a synthetic-aperture radar Earth-observation satellite capable of imaging the planet’s surface even through cloud cover. Its data is used for intelligence purposes, including as part of the company’s cooperation with Ukraine, according to RBC-Ukraine. A report published Oct. 15 by the Center for Strategic and International Studies (CSIS) said Kosmos-2612 was moving along a trajectory that would bring it into close proximity with ICEYE-X36, which supports Ukraine. The center said it should be assumed that Kosmos-2612 could take actions that might threaten the commercial satellite. Any Russian activity in space directed against Western spacecraft should be viewed in the context of Moscow’s aggressive “gray-zone” policies targeting U.S. and European interests, CSIS said. Kosmos-2612 was among six satellites Russia launched into low Earth orbit in April 2026. The spacecraft later began carrying out unusual maneuvers and approaching ICEYE satellites. In May, Kosmos-2609 came within 2.5 kilometers of one ICEYE satellite. CSIS also noted that Russia has previously conducted tests in which satellites in orbit released other objects. In 2017, a senior U.S. official compared such configurations to a “matryoshka” Russian nesting doll. Georgy Trishkin, a rocket-launch analyst and space and rocketry commentator, told The Insider that a direct attack on ICEYE-X36 is unlikely, as it would be viewed as an attack on Pentagon property and, therefore, an act of aggression against the United States.”

15. United States/Haiti/Turkey: US Court Exposes Alleged Role of Haiti Assassination Suspect Turkey Refused to Extradite

Nordic Monitor reported on October 19th that “a Haitian-American businessman of Palestinian origin accused of providing logistical and material support for the assassination of Haitian president Jovenel Moïse found refuge in Turkey after a court operating under the tight grip on the judiciary of the government of President Recep Tayyip Erdogan refused to extradite him to Haiti to face criminal charges in 2022. Four years later, however, Samir Handal was apprehended by US authorities and brought before a federal court, where an October 9, 2026, detention order detailed extensive allegations of his involvement in the conspiracy that culminated in Moïse’s assassination on July 7, 2021. The case has brought renewed attention to Turkey’s handling of an internationally wanted suspect who is now facing charges carrying a potential life sentence in connection with one of the most consequential political assassinations in the Caribbean. Samir Nasri Salem Handal, a Haitian-American real estate businessman who was detained while transiting Istanbul in November 2021 en route to Palestine, where he was born, was released following a July 4, 2022, ruling by the Istanbul 37th High Criminal Court. Turkish judges rejected Haiti’s extradition request, citing concerns that he could face torture, ill-treatment or punishment incompatible with human dignity if returned to the country. The decision is particularly ironic given the Turkish judiciary’s handling of well-documented allegations of torture and ill-treatment in police custody and prisons involving opponents and critics of the Erdoğan government. While Turkish judges invoked human rights concerns to justify refusing Handal’s extradition, courts in Turkey have frequently dismissed or failed to effectively investigate credible complaints of torture and abuse by law enforcement officers, intelligence operatives and prison officials, allowing alleged perpetrators to evade accountability. The stark contrast raises serious questions about the consistency and selectivity with which Turkey’s judiciary applies fundamental human rights protections.”

16. China/United Kingdom: China Protests UK Border Searches, Phone Seizures Amid Growing Espionage Tensions

South China Morning Post reported on October 20th that “China has lodged a formal representation with the UK after British border authorities subjected Chinese citizens to extended questioning and seizures of personal electronic devices, including mobile phones. According to a statement from China’s embassy in Britain, multiple Chinese nationals — including trade delegates, tourists and people visiting relatives — have experienced long delays, as well as questioning by Border Force officers and confiscation of phones and other devices. The embassy said that British border officials claimed their actions were carried out in accordance with relevant provisions of the United Kingdom’s Counterterrorism and Border Security Act 2019.”

17. Ukraine/Russia: SBU Detained Two Russian Agents in Chernihiv and Sumy

Ukraine’s SBU announced on October 20th that they “prevented a series of terrorist attacks in Kyiv, which were supposed to take place on the order of the Russian intelligence services. According to the results of actions in advance, two recidivists were detained, who, fulfilling the tasks of the enemy, planned to destroy the buildings of the shopping centre in the centre of the capital. As the investigation found out, the perpetrators considered several options for terrorist attacks. Among other things, they studied the possibility of shelling military buildings with a grenade launcher, throwing them with Molotov cocktails or live grenades, or detonating them with homemade bombs. Law enforcement officers exposed the criminal intent ahead of time and detained both defendants while they were conducting a reconnaissance near potential «targets». According to the case materials, the enemy’s tasks were performed by two recidivists. In particular, we are talking about a resident of Chernihiv Oblast, who was previously convicted of murder, as well as his accomplice from Sumy Oblast, with whom they previously served their sentences in the same colony. In preparation for the crime, the persons involved had to use a third accomplice. It is documented how two attackers in their own car drove around the city and recorded the locations of regime facilities, the presence of security and video surveillance cameras on the phone camera. In addition, they studied escape routes from each of the potential sites. During the arrest, a live grenade prepared for committing a terrorist attack was found in the car of one of the members of the criminal group.”

18. Bulgaria/Germany/Ukraine: Bulgaria Seeks Suspects in Germany after Starlink Sabotage

DW reported on October 19th that “Bulgaria on Monday issued European arrest warrants against two 19-year-old German nationals, saying it suspected their involvement in the sabotage of a series of Starlink antennas near the capital Sofia. “The evidence gathered makes it possible to conclude that there are reasonable grounds to suspect the involvement of the two defendants,” the court in Sofia rules, granting a request from prosecutors. Ukraine’s military uses Starlink’s military-grade satellite internet service Starshield for battlefield communications amid Russia’s invasion. Bulgaria does not directly border Ukraine, but it is on the Black Sea, one of the flashpoints of the conflict. A similar case in Poland, which does directly border Ukraine, led to a total of four arrests last week, also in Germany. The two teenage suspects are accused of deliberately setting fire to the antennas on the evening of October 9. Of 18 in a mountainous region south of Sofia, three were destroyed entirely, two were partially burned and three more were damaged, according to prosecutors. Prosecutors say the suspects entered from Serbia in a car with German license plates, claiming to be tourists, staying just a few hours around the time of the alleged crime. Plamen Tonchev, the head of Bulgaria’s domestic intelligence agency DANS, said he was working on the assumption that it was deliberate sabotage and said other such acts could not be ruled out in future.”

19. Germany/Iran/Israel/Denmark/Afghanistan: Germany Summons Iran Envoy over ‘Malicious’ Assassination Plots

L’Orient Today reported on October 19th that “Germany on Monday summoned the Iranian ambassador after two men were jailed last week over what it called a “malicious” plot to assassinate pro-Israeli public figures on behalf of Tehran. A Hamburg court on Thursday convicted a Danish national and an Afghan national for planning to target the president of Germany’s main group representing the Jewish community and the head of the German-Israeli society. The foreign ministry said on X the Iranian ambassador had been summoned, adding Tehran would not be allowed to “threaten our free society.” “The malicious assassination attempts… will have legal consequences,” it said. “We do not tolerate attacks on Jewish life and on those who defend it — anywhere, and certainly not in Germany.” The Danish man, partially identified as Ali Hassan S., was jailed for eight and a half years. The 54-year-old worked directly for Iranian intelligence and was tasked with scouting targets in Germany in preparation for assassinations and arson attacks, according to prosecutors. As well as prominent pro-Israel figures, he had been planning to target a Jewish grocer’s shop in Berlin, they said. The Afghan man, who was recruited as his accomplice, was jailed for four and a half years. He had agreed to recruit a third man and provide him with a weapon for the attack on the head of the German-Israeli society, the court heard. The two men were convicted in Germany after being arrested in Denmark last year and extradited. Sentencing them, the judge said they were guilty of “terrorist activities orchestrated by Iran.”.”

20. Russia/Ukraine: FSB Detained Ukrainian Agent in Crimea

Media Zone reported on October 19th that “a 1963 pensioner from the village of Chernomorsky in annexed Crimea was sent to a pre-trial detention centre on charges of treason as reported by the FSB press service. According to investigators, on instructions from Ukrainian intelligence, she filmed air defence facilities and then transmitted their coordinates, which «could be used to launch missile and artillery strikes». Judging by what TASS published video, the woman was detained by two men in civilian clothes while she was sitting on a bench. At the recording of the interrogation, the pensioner said that «she met a certain Yuri», with whom they «communicated via messenger WhatsApp». «[Yuri] became interested in the mood of the people who live in Crimea: how many are pro-Russian, how many are pro-Ukrainian citizens. Then he became interested in the issue of the former winery, on the territory of which, according to residents, some military personnel are based. I drove past in a car and took two photographs of this location — there were military personnel there», — said the detainee. Most likely, the pensioner told about complex of buildings founded in the 1960s by the Black Sea Winery, which is now abandoned.”

21. Guatemala: Killing of Former Anti-graft Prosecutor a Grim Milestone in Guatemala’s Political Violence

Reuters reported on October 20th tha “the assassination at the weekend of anti-graft lawyer Juan Francisco Solorzano Foppa, who made powerful enemies by taking on Guatemala’s elite, marks one ​of the most significant political killings in the country in recent decades, renewing concerns about the vulnerability of those who fight corruption in ‌Central America. Family, friends and supporters held a wake for Solorzano, 43, on Monday, two days after he was shot dead by two assailants at a Guatemala City sports center. His burial is scheduled for Tuesday. Guatemalan police said they had detained two men in relation to the killing, and seized a carbine-style firearm and a motorcycle. Both were released on Sunday without charge and maintain their ​innocence. Police said they have yet to establish a motive for the killing. For Guatemalans, it brought back grim memories of the 1998 assassination of Bishop ​Juan José Gerardi, who was beaten to death two days after presenting a damning report that documented atrocities from Guatemala’s civil ⁠war, blaming the army and its allied forces for most of the violence. “In terms of magnitude and significance, I think (we have to go back) to 1998, when ​Father Gerardi was killed,” said Juan Francisco Sandoval, former head of Guatemala’s Special Prosecutor’s Office Against Impunity.”

22. North Korea/South Korea: Lazarus Hackers Use Post-quantum Cryptography for Malware Delivery

Bleeping Computer reported on October 21st that “North Korean hackers are using a post-quantum cryptographic mechanism to secure malicious payload delivery in new operations that combine old and new malware. The campaign targets South Korean organizations through a “rather complex” infection chain. Researchers at cybersecurity company Kaspersky dubbed the operation FlashHole and attributed it to the Lazarus Group. Analysis of the malware revealed that the threat actor used the standardized ML-KEM post-quantum cryptographic mechanism to communicate with the command-and-control (C2) server for malware delivery. Kaspersky says the attackers used LPEClient malware, previously associated with Lazarus, to receive ML-KEM-1024 public keys from its C2 infrastructure and generate shared keys that allowed it to decrypt subsequently incoming payloads. According to the researchers, the attacks started in July 2025 and relied on phishing pages directing targets to specially crafted GitHub pages.”

23. France: Finger Pointed at French Territorial Intelligence after Weekend Riots

Intelligence Online reported on October 19th that “the French DNRT territorial intelligence agency, which vastly underestimated the scale of the protests in France on Saturday which were followed by rioting and looting across the country, finds itself under intense scrutiny. All the more so after President Emmanuel Macron highlighted “failures in foresight and intelligence” in his national televised address on Sunday.”

24. Turkey/Norway/Finland/Denmark: Secret Turkish Document Exposes Surveillance of Erdogan Critics in Norway, Finland and Denmark

Nordic Monitor reported on October 22nd that “a secret Turkish government document obtained by Nordic Monitor reveals that Turkish intelligence and counterterrorism authorities conducted an intelligence-gathering operation targeting members of the Gülen movement in Norway, Finland and Denmark, identifying individuals who participated in peaceful demonstrations against the repressive government of President Recep Tayyip Erdogan and forwarding their personal information for use in criminal proceedings in Turkey. The classified document, dated August 19, 2026, shows that Turkish authorities systematically examined photographs and social media posts from demonstrations held simultaneously in the three Nordic countries on June 24, 2026, compiling lists of participants suspected of having links to the Gülen movement, a faith-based civic group that has become one of the principal targets of Erdogan’s sweeping crackdown on political opponents. The intelligence collected on the demonstrators was transmitted to the counterterrorism department of the Turkish National Police, which subsequently instructed provincial police departments to identify individuals and report their findings to the relevant courts and prosecutors. The operation reveals how the Erdogan government has extended its domestic surveillance and intelligence apparatus beyond Turkey’s borders, treating peaceful political expression in European democracies as grounds for intelligence collection and potential criminal prosecution. Marked “GİZLİ” (SECRET), the document was issued by the Antalya Provincial Police Department in response to an August 11, 2026, directive from the Counterterrorism Department (Terörle Mücadele Daire Başkanlığı) of the Security Directorate General (Emniyet). Signed by Yasin Neciboğlu, a deputy provincial police chief acting on behalf of the Antalya police chief, the letter was addressed to the Antalya 2nd High Criminal Court, with a copy forwarded to the national Counterterrorism Department. The document specifically identified demonstrations held in Denmark, Finland and Norway in solidarity with a protest organized by the Peaceful Actions Platform outside the Council of Europe headquarters in Strasbourg, France. The document does not disclose the original source of the intelligence, an omission consistent with a practice in Turkish security correspondence of concealing the involvement of intelligence operatives and protecting the government from potential exposure should classified documents become public. Although the letter refers to the examination of photographs and social media posts, this explanation may obscure the actual methods used to identify and track participants in the Nordic countries. Intelligence potentially obtained through clandestine surveillance and spying operations could have been repackaged as information gathered from publicly available social media sources, allowing Turkish authorities to conceal the involvement of covert operatives while presenting the resulting intelligence as routine counterterrorism research.”

25. Ukraine/Russia: SBU Announced 15 Year Prison Sentence for FSB Agent Detained in January 2025

Ukraine’s SBU announced on October 20th that “according to SBU materials, a FSB agent who was preparing to blow up a track in front of a freight train in the Rivne region received 15 years in prison. According to the evidence base of counter-intelligence and investigators of the Security Service, a FSB agent who was exposed by the SBU in January 2025 for preparing a sabotage on Ukrzaliznytsia in the Rivne region received 15 years of imprisonment with confiscation of property. As the investigation found out, he tried to plant an improvised explosive device (IED) under the track used by freight trains. It was established that the Russian intelligence services planned to detonate explosives remotely while the train was moving. According to the case materials, the task of the FSB was performed by an unemployed resident of Lviv Oblast recruited by the enemy. Previously, he was prosecuted for vandalism at the burial places of Ukrainian defenders. The recidivist came to the attention of the Rashists through his anti-Ukrainian comments in the chats of Telegram channels. After recruitment, the agent received step-by-step instructions from the enemy: to take explosives from the cache to arrive in the Rivne region and install it on the local railway track. SBU counter-intelligence officers exposed the traitor at the stage of sabotage preparation and detained him «on a hot pursuit» near the — track before he could plant a homemade bomb.”

26. Qatar/Iran/United States/Turkey: Qatar Revamped its Entire Defence System in Six Hours, Intelligence Chief Reveals

EuroNews reported on October 20th that “at Doha’s Global Security Forum, Qatar’s head of intelligence revealed how the war with Iran forced the Gulf country to urgently redeploy its defensive assets, while the US ambassador to Turkey offered new insights into a fundamental shift in Washington’s presence in the Middle East. In a rare public appearance, Qatar’s head of the Intelligence and Security Authority Brigadier General Khalid Mohammed Al-Nuaimi revealed how Qatar took the dramatic decision to redeploy its entire defensive systems in just six hours to counter Iran’s war threats. Addressing the Global Security Forum in Doha on Tuesday, Al-Nuaimi said the redeployment was “unprecedented and successful”, based on eight months of adapting Qatar’s forces, defence capabilities, and military doctrine, which had been built for a totally different threat landscape.⁠ ⁠ When asked about Qatar’s response to countering drones during the war, Qatar’s head of Intelligence replied that the six-hour overhaul was based on fast-moving changes to Qatar’s defence systems, both at concept level, but also in the allocation of defence assets. “We adapted. we redeployed and we did it within six hours,” Al-Nuaimi revealed, adding that “we were caught off guard, yet we adapted rapidly, out of sheer necessity.” Also during the Global Security Forum, Qatar’s Foreign Ministry spokesperson Dr Majed al-Ansari said the Qatar-mediated US-Iran negotiations “are ongoing and we are seeing engagement from both parties.” “The fact that we are not hearing about it is a good sign that we are doing our job properly,” the Qatari diplomat added amid the rising tensions and concerns that the Iran war may restart.”

27. France: French Protests — From Intelligence Failures to Insufficient Police Presence, Overview of a Security Disaster

Le Monde reported on October 20th that ““as with all difficult operations, there are things you get right, and things that go wrong.” Standing on the steps of the Interior Ministry on Monday, October 19, Prime Minister Sébastien Lecornu acknowledged, using an expletive, that the handling of the protests that shook France on Saturday had been inadequate. What went wrong exactly? “We have nothing to hide,” the prime minister said. Yet the government was not willing to advance many hypotheses. In Paris, Lyon, Marseille, Bordeaux and many other cities across France, overwhelmed police forces faced unprecedented violence and failed to prevent the destruction and looting of thousands of shops. Interior Minister Laurent Nuñez, whose resignation the president rejected, offered some remorse, though he remained noticeably short on explanations. “We obviously need to be better at anticipating protests as they unfold,” he acknowledged on radio station France Inter on the morning of October 19, because “the measures put in place ended up asymmetrical with the number of participants.” What were the national police intelligence agency, known as DNRT, and the intelligence unit of the Paris Police Prefecture, the authorities’ eyes and ears, doing? The reports produced by these agencies, tasked with maintaining sources in a wide range of organizations and monitoring social media, are usually a crucial element in sizing up the security arrangements.”

28. Russia/Ukraine: FSB Detained GUR Agent in Mari El

Media Zone reported on October 20th that “the FSB reported on the arrest «of a person involved in the commission high treason», a resident of Mari El. This was reported by the Department Public Relations Centre (PSC). According to security officials, the young man, born in 2008 «established contact» with a Ukrainian GUR officer and passed on information to him about the defence enterprises of Mari El. It is alleged that he received a monetary reward for this. Other details of the case are still unknown. Now the young man is in a pre-trial detention centre.”

29. Norway/China/Russia/Hong Kong/Guatemala: Norway Detains “Guatemalan” Cargo Ship with Chinese Name linked to Russia’s Arctic LNG 2 Project

The Insider reported on October 20th that “Norway has detained two cargo ships, at least one of which is linked to Russia’s Arctic LNG 2 project. The vessels were stopped last week, though the detentions received little media attention at the time. Both ships remain off the Norwegian coast. One of the detained vessels, Ya Qing Hai Yang (IMO1021570) is a heavy-lift cargo ship. It was likely stopped by Norwegian authorities on Oct. 14. European authorities have largely targeted oil tankers and LNG carriers involved in transporting Russian energy. Ya Qing Hai Yang is neither, but it has documented ties to Arctic LNG 2, Novatek’s liquefied natural gas project on the Gydan Peninsula in Russia’s Yamalo-Nenets Autonomous District. In October 2024, the vessel helped transport power-generation modules from China to Russia’s Utrenny port, which serves the Arctic LNG 2 project. The ship was later placed under sanctions over that activity. According to Starboard Maritime Intelligence data reviewed by The Insider, early this month Ya Qing Hai Yang was spotted several kilometers away from the Norwegian border. The Barents Observer reported on the vessel’s presence on Oct. 8. The ship had sailed from Hong Kong, making several stops in the Russian Far East before travelling along the Northern Sea Route — the shipping corridor connecting the Atlantic and Pacific oceans via Russia’s Arctic coast. The cargo ship was sailing under the Guatemalan flag. However, because Guatemala does not maintain a public ship registry, Lloyd’s List has classified the registration as potentially false. Norwegian authorities have confirmed the detention of Ya Qing Hai Yang. Another cargo vessel, the Chinese-flagged Jian Yang Cheng He (IMO 9813137) was stopped with it. That ship is not under sanctions, and no connection to Russian projects is known. It also left Hong Kong in mid-July and traveled along the Northern Sea Route.”

30. China/Philippines/Taiwan/Afghanistan/Namibia/South Korea: China-Aligned BRONZE SANDCASTLE Abuses SANDBOXIE DLL Side-loading to Deploy Backdoors

The Hacker News reported on October 21st that “cybersecurity researchers have disclosed details of a previously undocumented China-aligned threat cluster known as Bronze Sandcastle that has been observed targeting organizations in Asia and Africa since mid-2025. “The most distinctive technical marker for Bronze Sandcastle is its consistent use of Sandboxie DLL sideloading,” Sophos security researcher Gabor Szappanos said in a post published Tuesday. Between August 2025 and August 2026, attacks mounted by the threat actor have resulted in victims in the Philippines, Taiwan, Afghanistan, Namibia, and likely South Korea. Evidence indicates that Bronze Sandcastle is most active in the UTC+8 time zone. DLL sideloading is a popular adversarial technique that exploits the way Windows loads DLL files, allowing an attacker to trick a legitimate program into loading a malicious DLL. When an application is launched, it needs to load various DLLs in order to function correctly. If the application does not provide the full path to a required DLL, the operating system looks for it in a predetermined sequence of directories. An attacker can take advantage of this behavior by planting a malicious DLL with the same name as a legitimate one in a location that Windows searches before the folder that contains the actual DLL. Thus, when the legitimate application starts, it proceeds to load and run the malicious DLL, giving the attacker a way in to the system. “Because the malicious code is executed by a trusted and often digitally signed application, it is less likely to be flagged by antivirus software and other security solutions,” Zscaler noted in an analysis last week. “If the legitimate application runs with elevated privileges, the malicious DLL will inherit those same permissions, allowing the attacker to perform more sensitive actions on the system.” What’s more, the technique enables persistence if the compromised application is configured to automatically run every time a system is rebooted, thereby allowing the attacker’s code to execute on the infected host. Sophos said it observed legitimate Sandboxie executables placed in multiple victim environments, along with a malicious “sbiedll.dll” file, which, in turn, causes the trusted application (“SandboxieWUAU.exe”) to load attacker-controlled code during runtime.”

31. Iran: Two Citizens Arrested by IRGC Intelligence Agents in Mahabad

HRANA reported on October 20th that “on Sunday, October 18, 2026, two residents of Mahabad, identified as Diako Bayazidi and Mostafa Jooshkar, were arrested by agents of the Islamic Revolutionary Guard Corps (IRGC) Intelligence Organization in the city and transferred to an undisclosed location. According to HRANA, citing Kolbarnews, two citizens were arrested by IRGC intelligence agents in Mahabad. According to the report, Diako Bayazidi, 35, and Mostafa Jooshkar, 52, were arrested on Sunday, October 18, at approximately 11:00 AM. The report states that efforts by the detainees’ families to obtain information about their fate and whereabouts have so far been unsuccessful. At the time of this report, no information was available regarding the reasons for their arrests or the charges brought against these two Mahabad residents.”

32. Singapore/Vietnam: A Singapore Surveillance Solutions Retailer and its Intriguing Ties to Vietnam

Intelligence Online reported on October 20th that “Singapore-based company offering surveillance solutions appears to be linked, through its shareholder, to a Vietnamese group that is in the Ministry of Public Security’s good books.”

33. Russia/Romania/Spain/Turkey: Russian GRU Hackers Hit NATO Shipbuilder, Aircraft Engine Maker, Law Enforcement Agency in Espionage Campaign

Cyberscoop reported on October 20th that “Russian government-connected hackers compromised two defense firms and a law enforcement agency in North Atlantic Treaty Organization countries as part of an espionage campaign, Symantec researchers said in a blog post Tuesday. The infamous group behind hacks of the Democratic National Committee during the 2016 election cycle was behind the attacks that Symantec identified in recent months: Swallowtail, also known as APT28, Fancy Bear and Forest Blizzard, notorious for its links to the Russian military agency GRU. The hackers apparently chose the targets of their attacks carefully, including a naval shipbuilder, a manufacturer of military aircraft engines and the law enforcement agency. In the attack on the shipbuilder, Symantec saw “hands-on-keyboard” activity as the hackers repeatedly returned to a compromised host over the course of a week to steal credentialed material. “Hands-on-keyboard activity means a human operator is choosing what to do next, rather than malware running a fixed routine,” Dick O’Brien, principal intelligence analyst at the Symantec Threat Hunter Team, told CyberScoop. “It’s essentially confirmation that the organization is a genuine target for the operators, not an accidental infection. It also confirms that further exploitation beyond the initial infection was at least attempted.” O’Brien said the campaign reflected broader intelligence collection aimed at European government and defense targets, but its motive wasn’t certain. He speculated that it could have been part of campaigns to target nations aiding Ukraine in its war against Russia. The hackers made use of the Hookedge backdoor first identified in August by Recorded Future’s Insikt Group. That firm saw attacks dating back to September of last year by the same group using the same backdoor on defense and diplomatic targets in Romania, Spain and Turkey. Symantec also observed the hackers deploying a previously undocumented loader.”

34. Ukraine/Russia: SBU Announced Prison Sentence for GRU Agent Detained in the Summer of 2024

Ukraine’s SBU announced on October 22nd that “according to the SBU, a new sentence was received by an agent of the Russian Federation, who blew up the car of a soldier of the Armed Forces of Ukraine and set fire to the facilities of Ukrzaliznytsia. According to the evidence base of the Security Service, another guilty verdict was received by a member of the agent-combat group of the Russian military intelligence (better known as the GRU), which the SBU neutralised in the summer of 2024 in Kharkiv region. Then all 4 agents of the enemy cell who blew up the car of the Ukrainian soldier were detained. As a result of the incident, the soldier was seriously wounded. According to the SBU, in August 2026, the perpetrator received a 15-year prison sentence with confiscation of property. Currently, the convict received another term of 15 years of imprisonment for setting fire to two relay cabinets of Ukrzaliznytsia. We remind you that the enemy task was performed by a handyman recruited by the Rashists from the suburbs of Kharkiv. The man came to the attention of the Russian Federation GRU through an acquaintance from Donetsk, who is part of the so-called «special forces of the DNR» and cooperates with the Russian intelligence service. It was established that the agent purchased a flammable mixture to set fire to the relay cabinets, which he later poured on electrical equipment.”

Get The Spy Collection’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

35. China/United States/South Korea/Japan: Alleged Chinese Spy’s Snooping on Korea-US Drills Raises Alarm over Shared Intelligence Practices

Korea JoonAng Daily reported on October 21st that “a former member of China’s People’s Liberation Army was found to have intercepted military communications at U.S. military bases in Korea — particularly during joint drills between Seoul and Washington, as well as trilateral exercises with Tokyo. Security experts have urged Korea to bolster counterintelligence against China after a series of Chinese espionage cases disrupted intelligence cooperation between Korea and the United States. A former lieutenant colonel who spent four decades in the Chinese Army’s signal-intelligence unit intercepted communications at Korean and U.S. military bases 13 times between March 2024 and August this year, according to an indictment obtained by People Power Party Rep. Kim Meen-geon from the Ministry of Justice on Tuesday. Seven of the 13 surveillance operations coincided with bilateral and trilateral military exercises, including Ulchi Freedom Shield (UFS).”

36. Russia/Ukraine/Norway/Belarus/Azerbaijan/Turkey/Bosnia and Herzegovina: Russian National Who Attempted to Join Ukrainian Paramilitary Group Sentenced to 13 Years in Prison

Media Zone reported on October 20th that “the 2nd Western District Military Court sentenced 27-year-old Nizhny Tagil resident Alexander Maslov, accused of attempted high treason and participation in a terrorist organisation. This was reported by the press service of the court. Maslov must spend the first four years of his sentence in prison, the rest of the term — in a maximum security colony. He was also fined 600 thousand rubles. According to investigators, in March 2023, a resident of Nizhny Tagil decided to join the «Russian Volunteer Corps», contacted a representative, filled out a form and received «instructions on the possibility of coming to the territory of Ukraine» through Norway. In June, Maslov arrived at the border checkpoint in the Murmansk region, but «fearing to be exposed» returned home. Once again, the man tried to leave for Ukraine in September 2025. The court was told that he then bought clothes, personal hygiene items, a portable power source and train tickets from Yekaterinburg to Moscow and flights. The court release states that Maslov was planning to fly from Moscow to Minsk, and then — to Baku, Istanbul and Sarajevo.”

37. Russia/Germany/Ukraine/Afghanistan/Somalia/Syria: Russian Security Forces Detain German National Who Served in Ukrainian Army

The Insider reported on October 21st that “the Public Relations Center of Russia’s Federal Security Service (FSB) has announced the detention in Russia of a German citizen who allegedly fought on Ukraine’s side, as reported by the state-owned news agency Interfax. According to the FSB, the man came to Ukraine in November 2025, signed a three-year contract to serve in the Armed Forces of Ukraine, but deserted, allegedly because he did not receive the “promised monetary reward.” In the video published by the state news agency TASS, the detainee does not give his name but states his year of birth (1976) and describes his career as a soldier. The foreigner says he previously took part in combat operations in Afghanistan, Somalia, and Syria. He says he also took part in combat operations in eastern Ukraine in 2016–2018. In the video, the man claims he was promised “100,000 hryvnias” ($2,200) but never received the money and “was forced to flee.” It is unclear whether this sum was for the entire contract. It is also unknown where and under what circumstances the man was detained. How he got into Russia has not been specified. The detainee is being charged under Article 359 of the Russian Criminal Code, which covers mercenarism. It carries up to 20 years in prison.”

38. Germany/Ukraine/Russia: Germany Arrests Ukrainian Man Accused of Spying for Russia

Al Jazeera reported on October 22nd that “a Ukrainian national has been arrested in Germany on suspicion of spying for Russia, German authorities have said. Germany’s federal prosecutors confirmed in a statement on Thursday that the man, identified as Vadym Y, was arrested in the state of Brandenburg 85km (53 miles) west of Berlin. Prosecutors said the suspect had been in touch with the Russian secret service via an intermediary since at least July 2025. The suspect had gathered military intelligence on the production of armoured vehicles, ammunition and explosives, as well as military personnel and defence installations at locations designed to secure NATO’s eastern flank, prosecutors added. German Chancellor Friedrich Merz, who is currently meeting with regional leaders in Montenegro for the EU-Western Balkans Summit, said he was “not surprised” by the news of a suspected Russian spy. The arrest comes after German authorities blamed Russia for drone attacks that officials said are part of Moscow’s “shadow war” on the country. Germany’s armed forces on Wednesday raised the threat level of Russian sabotage against their troops and facilities to “significant” for the first time — the ‌second-highest level on their internal threat scale, German news reports noted. The move followed the discovery in mid-September of a crashed drone carrying high explosives near the Wunstorf ⁠airbase in Lower Saxony, German news sites WDR and Sueddeutsche Zeitung reported.”

39. United States/China: Pentagon Looks to Build a Deep-cover Spy Programme to Confront China

The Washington Post reported this exclusive story on October 21st, stating that “the Pentagon is looking to build a more robust deep-cover spying program to conduct economic warfare against China and other U.S. competitors, according to half a dozen people familiar with the initiative.”

40. Turkey: Erdoğan Government Propagandist Who Praised Terrorist Killers Warns of New Turkish Intelligence Operations Overseas

Nordic Monitor reported on October 10th that “a government-backed Turkish Islamist operative who has publicly praised terrorists associated with jihadist violence has stated that clandestine operations targeting opponents of President Recep Tayyip Erdogan will soon take place in several countries, raising concerns that Turkish intelligence may be preparing a new campaign of intimidation, abductions or other secretive activities against dissidents living abroad. Orhan Aydın, a 44-year-old Islamist propagandist known for his aggressive attacks on government critics and opponents of Erdogan, issued the warning on October 5, suggesting that Turkish authorities may conduct overseas operations against members of the Gülen movement, a group opposed to the Erdogan government, in countries where such activities would come as a surprise. “I wouldn’t be surprised if operations targeting FETÖ [Gülen movement] members were launched in several unexpected countries abroad in the near future, perhaps even before the end of this year,” he wrote. The statement has raised particular concern among Turkish diaspora communities because of Turkey’s documented history of using its National Intelligence Organization (Milli İstihbarat Teşkilatı, MİT) to track, surveil and forcibly repatriate political opponents living abroad, sometimes with the cooperation of foreign intelligence agencies and local government officials, particularly in countries suffering from democratic deficits, systemic corruption, weak rule of law and entrenched political favoritism. Aydın’s background, public statements and close connections to Turkish government’s media and propaganda operations raise additional questions about whether his prediction reflects advance knowledge of intelligence activities, an attempt to prepare public opinion for future operations or another episode in the intimidation campaign directed against Turkish dissidents overseas.”

41. Ukraine/Russia: SBU Announced 15 Year Prison Sentence for Russian Agent Detained in January 2026

Ukraine’s SBU announced on October 21st that “according to the SBU, another traitor received 15 years in prison, who, on the order of the Russian Federation, directed aerial bombs at Kramatorsk. According to the evidence base of counter-intelligence and investigators of the Security Service, a Russian agent was sentenced to 15 years in prison with confiscation of property, whom the SBU exposed in January of this year on the adjustment of enemy strikes on the defenders of Donetsk region. As the investigation found out, the attacker directed super-heavy guided aerial bombs and long-range artillery of the Rashists at the bases of the Ukrainian troops in the Kramatorsk direction. It was established that the agent task was performed by a local handyman who worked for one of the armed groups of the Russian Federation fighting on the Eastern Front. In order to attract the man to cooperate, the Rashists involved his acquaintance from the Russian Federation, to whom he told about his expectations for the capture of the entire territory of the Donetsk region. After the recruitment, the agent acted under the leadership of a «liaison» — Russian military officer, who passed the received data to his commander. According to his instructions, the traitor tracked the fortifications and firing positions of the Defence Forces. He disguised such reconnaissance trips as trips for part-time work to Kramatorsk. The agent transmitted the collected data to the enemy through a messenger in the form of screenshots of the coordinates of military sites on Google Maps. To check his information, the scouts first lifted reconnaissance drones into the air and, if confirmed, prepared an attack. SBU officers detained the traitor at his place of residence. In parallel with this, the locations of the Defence Forces in the area of espionage activity of the aggressor country were secured. During the search, two smartphones were seized from the attacker, which he used for conspiratorial contacts with the enemy.”

42. Serbia/Israel/Canada/United States: Pegasus Spyware Infection Confirmed on Serbian University Rector’s iPhone Days Before Election

The Hacker News reported on October 20th that “the iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia’s student protest movement, was infected with NSO Group’s Pegasus spyware in 2026, the Citizen Lab said on October 19. The finding came six days before Serbia’s October 25 snap parliamentary election. The infection used a zero-click exploit, meaning Đokić did not have to tap a link or open a file for it to work. The lab found the infection with high confidence, but its note provides no date within 2026, does not identify who was behind the attack, and notes that its investigation is ongoing. The election was called in September after nearly two years of protests that began when a railway station canopy collapsed in Novi Sad in November 2024, killing 16 people. The Citizen Lab, a research group at the University of Toronto, analyzed forensic artifacts from the phone at Đokić’s request, working with the Serbian digital-rights group SHARE Foundation. SHARE led the investigation of an earlier wave of Serbian cases made public in September. A second case concerns Rade Bajić, a senior prosecutorial associate at Serbia’s Public Prosecutor’s Office for Organized Crime who worked on the “Generalštab” corruption investigation into a Kushner-linked property project in Belgrade. Bajić received an Apple Threat Notification on August 13 and a reminder on August 27. Apple sends these alerts when it detects activity consistent with an attack by mercenary spyware, the commercial hacking tools that companies such as NSO sell to governments, and it does not say who is behind the attacks. The Citizen Lab treats a notification as a high-confidence sign that Bajić’s phone was likely targeted. Its forensic analysis of the device is ongoing, and the note does not say whether the phone was infected. The Generalštab case concerns the removal of heritage protection from Belgrade’s bombed-out former army General Staff complex to clear the way for a luxury development backed by a company linked to Jared Kushner, U.S. President Donald Trump’s son-in-law.”

43. Russia/Romania/United Kingdom: Love Affair to Staged Arrest — How a Romanian from England was Jailed in Russia as a Spy

Reuters reported on October 22nd that “springtime in a park. Grey sky. A young man in a blue knitted hat and Adidas backpack walks down a path. Two burly security agents spring from a van and pin him to the pavement. “What is your name?” asks a voice in English as a gloved hand holds the man’s face towards the camera. “David Adrian Kercso,” he swiftly responds. Where is he from? “Romania. Romania.” The video, released by Russia’s FSB security service and published by state media, purports to show the arrest of ​Kercso, now 23, a Romanian citizen who grew up in England and was sentenced earlier this year to 15 years for spying for Ukraine. Reuters has not been able to verify all of the evidence in Kercso’s case. ‌But what is clear is that the arrest video is not what it purports to be: Reuters analysis of the video and of court records of his detention shows that at the time it was made he had already been in Russian custody for months. It was filmed in a park inside Russia, in the southern city of Sochi. But Kercso’s arrest was first announced elsewhere, by pro-Russian separatists across the border in Abkhazia, a breakaway region of neighbouring Georgia, who released their own video of him in their custody the day before he first turned up in a Russian court. The FSB did not respond ​to requests for comment for this story, including why it would release a video depicting the purported arrest of a suspect who was already in custody. Requests for comment were also sent to the Abkhazian separatists’ SGB security agency, the Russian embassy ​in London, the Romanian and Ukrainian foreign ministries. None replied. To Kercso’s family, who say he was lured to the Black Sea coast to pursue a romance with a woman he had met online, ⁠the FSB video of a staged arrest is just another bizarre turn in a story that alarmed them from the outset. He hopes to lodge an appeal against his conviction. “I told him to not go there because it’s very dangerous, because it’s a war,” ​his mother Julia Kercso told Reuters. “And he never listened to me yet.”.”

44. Israel/France: Shin Bet Chief Said to Visit France for Security Talks Amid Violent Rioting

The Times of Israel reported on October 22nd that “Shin Bet security agency chief David Zini traveled to France for talks on dealing with terrorism and Islamic extremism, according to a Wednesday report. The visit came after weekend demonstrations in France that began over soaring prices and devolved into some of the worst street violence the country has seen in recent years, the Kan public broadcaster reported. Zini’s visit Tuesday had been planned before the rioting, the network said. He met with senior figures in France’s internal security agency DGSI, and the DGSE, the country’s spy agency. The Shin Bet declined to comment on the report.”

45. Russia/Ukraine: FSB Detained SBU Agent in Sevastopol

Media Zone reported on October 22nd that “FSB officers detained a resident of annexed Sevastopol, born in 1969, in a case of cooperation with Ukrainian intelligence services. This was reported by the FSB Public Relations Centre. A Sevastopol resident is suspected of treason (Article 275 of the Criminal Code). According to investigators, the detainee «initially for selfish reasons» through WhatsApp contacted a representative of the Security Service of Ukraine and agreed on cooperation. Security officials claim that a resident of Sevastopol provided the SBU «information about the locations of military equipment and units of the Black Sea Fleet». The court placed him in custody. After the arrest, the suspect said on camera that he was photographing the ships on North side in Sevastopol, he handed over these photographs to a person whom the FSB considers a representative of the Ukrainian intelligence services. As the Sevastopol resident noted, he contacted him through an acquaintance with whom he took courses in 2021. A man complained to this friend about «problems with the Bank of Ukraine». After the war broke out, she contacted him and offered contact for someone who «could help». «He got in touch with me through WhatsApp. We talked, he was generally interested in the situation in the city, people’s attitude towards this SVO», — said the detainee.”.”

46. Israel: Cognyte Expands Military Footprint with $20+ Million Framework Agreement with Tier-1 Ministry of Defence

Cognyte announced on October 21st that “Cognyte Software Ltd. (NASDAQ: CGNT) (“Cognyte”), a global leader in AI-powered investigative analytics solutions, today announced a $20+ million framework agreement with a new Tier-1 customer, the Ministry of Defense of a NATO member nation, with an option to increase the framework agreement by up to 50 percent. Established with the ministry’s procurement authority, the agreement sets predefined terms and conditions for solutions across Cognyte’s AI-powered investigative analytics portfolio. One agency has already placed an initial order under the agreement, and other units across the ministry can order under the same terms. This offers agencies a quick and direct route to vetted and approved solutions and gives Cognyte a pathway to broader adoption across the ministry. Defense organizations are operating in a dynamic security environment, where securing national interests depends on understanding threats early and acting with confidence. Intelligence data is growing in volume and complexity, and military agencies are actively enhancing their intelligence capabilities to ensure they remain self-sufficient and ahead of ever-evolving threats. Framework agreements allow defense ministries to set commercial and delivery terms in advance, so agencies can quickly deploy new solutions from trusted partners as their requirements evolve. “This award followed an extensive competitive evaluation and multiple proofs of concept, where our technology demonstrated the performance required for mission-critical defense operations,” said Adam Philpott, Chief Revenue Officer at Cognyte. “The initial order reflects the customer’s confidence in Cognyte and establishes a strong foundation for broader adoption across the ministry.” “Military intelligence is a growth priority for Cognyte, and this agreement demonstrates our execution against that strategy,” said David Abadi, Chief Financial Officer at Cognyte. “With more than $10 million already ordered and a clear path to broader adoption across the ministry, it provides growth potential and greater visibility into future business.”.”

47. Russia: OSINT Analysts Spot Russian Cargo Ships Loading Military Vehicles in Kaliningrad

The Insider reported on October 22nd that “Russian cargo ships have been spotted loading military vehicles and equipment in the port of Baltiysk, in Russia’s Kaliningrad Region. Some of the vessels had previously been observed delivering supplies to Russia’s Africa Corps. Satellite images confirming the vessels’ locations were published by the open-source intelligence projects GeoInsider and SONARROW_OSINT. At least three ships were involved in the operation: Ascalon (IMO 9198226), Lady D (IMO 9349289), and Anastasiia (IMO 9349291). The loading took place Oct. 15–16 at the port of Kaliningrad. The operation could be tracked only through satellite imagery because the vessels’ crews had switched off transmission of their location data, making them impossible to follow through conventional ship-tracking services. Ascalon and Lady D had last transmitted signals from the vicinity of the Kaliningrad Region. Satellite images show military equipment including infantry fighting vehicles (IFVs), armored personnel carriers (APCs), mine-resistant ambush-protected vehicles (MRAPs), and logistics vehicles. Analysts said there may have been additional cargo ship rotations in October that could not be tracked because of heavy cloud cover. Some convoys may already be underway, but their destinations are unknown. All three vessels have previously been linked to Russian military shipments outside Russia.”

48. Israel: Golan Accuses Netanyahu of Paving Way for ‘Next Yigal Amir’ on Anniversary of Rabin Assassination

The Times of Israel reported on October 22nd that “Democrats chairman Yair Golan accuses Prime Minister Benjamin Netanyahu of creating the conditions for another political assassination, as Israel marks 31 years since the murder of former prime minister Yitzhak Rabin. “Horrifyingly, 31 years after Rabin’s assassination, the same inciting prime minister is today creating the conditions for the next Yigal Amir,” Golan says during a wreath-laying ceremony at Rabin Square in Tel Aviv, referring to the Jewish extremist who assassinated Rabin on November 4, 1995. “We will rise again and rebuild Israel in the spirit of the Declaration of Independence,” he adds, pledging to build a “free, Jewish, egalitarian and democratic state.” Golan himself has faced a wave of death threats in recent months, prompting his party to petition the High Court of Justice for state-provided security. The petition cited dozens of threats against him and his family, including calls for him to take “a bullet to the head” and for his family to be hanged. Israel held its official memorial ceremony commemorating the assassination of Rabin according to its Hebrew calendar date at Jerusalem’s Mount Herzl cemetery, which Netanyahu did not attend. Netanyahu has long faced accusations of contributing to the incitement preceding Rabin’s assassination, including by holding campaign rallies where demonstrators loudly chanted “Death to Rabin” and burned effigies of the then-prime minister in the months leading up to his assassination. Netanyahu has always denied any responsibility for the incitement that led to the murder.”

49. France: Traditional Route for DGSE Executives Under Threat

Intelligence Online reported on October 22nd that “senior staff at the French foreign intelligence agency feel they are not being given their fair share of management and executive posts.”

50. Ukraine/Russia: SBU Detained FSB Mole in Kyiv

Ukraine’s SBU announced on October 22nd that they “detained a «mole» FSB that pointed Russian missiles at the position of its unit, where more than 100 drone fighters were stationed. Military counter-intelligence of the Security Service, with the assistance of the Commander-in-Chief of the Armed Forces of Ukraine, exposed another Russian agent in the ranks of the Armed Forces. He turned out to be a recruited FSB mobilised from Zhytomyr Oblast, which launched an air attack by the Rashists on its BPLA unit. Thanks to the operational response of the SBU, it was possible to evacuate more than 100 Ukrainian drone fighters from the zone of potential damage in advance and detain the enemy adjuster. As the investigation found out, the person involved in leaked the coordinates of the Defence Forces to the FSB after voluntarily left the military unit and arrived in the Kyiv region. On the territory of the capital region, the deserter tracked for the Russian intelligence service the location of the logistics centres of the Ukrainian army, on which the enemy was preparing missile and air strikes. SBU officers documented his crimes and detained him near one of the critical warehouses in the Kyiv region. According to the case materials, the person involved was recruited by the FSB even before being drafted into the ranks of the Armed Forces. Initially, the agent performed «test» tasks: he tracked the location of the facilities of the fuel and energy complex in the north of Ukraine. Then the Russian intelligence services instructed him to mobilise to the Defence Forces to spy on «inside the Ukrainian troops. During training at the courses of BPLA operators, he collected personal data for the enemy command and personnel of the training centre. In exchange for cooperation, the Rashists promised their accomplice «to evacuate» to the Russian Federation with Russian citizenship. During the detention, a smartphone with evidence of his work at the FSB was seized from «mole». It was also established that in order to prevent the proper functioning of one of the railway stations of Ukraine, the person involved made an anonymous, knowingly false report about his alleged mine.”

51. Austria/Russia: Austria Declares Four Russian Diplomats Suspected of Espionage “Persona Non Grata”

APA reported on October 23rd that “Austria has declared four Russian diplomats “persona non grata,” according to Reuters, APA’s Moscow bureau reports. Austria is expelling four Russian diplomats suspected of espionage. Foreign Minister Beate Meinl-Reisinger has demanded that they leave the country immediately.”

52. Netherlands/United States/Russia/Ukraine/Palestine/Iran/Israel/United Arab Emirates/Azerbaijan/Saudi Arabia/United Kingdom: Dutch Intelligence Service Spied on Phone of Trump’s Son-in-law Jared Kushner

NL Times reported on October 23rd that “the Dutch Military Intelligence Service (MIVD) reportedly monitored the phone of Jared Kushner, the son-in-law of the U.S. president Donald Trump and his negotiator in the wars in Ukraine, Gaza, and Iran, according to a new book by American investigative journalist Matthew Cole. The MIVD started monitoring Kushner’s phone in 2018 with the help of a Russian defector, a hacker who previously worked for the Russian military intelligence service GRU, according to an excerpt of the book published in Vanity Fair. According to Cole, a source told him that the MIVD witnessed how Kushner logged into a bank account in the United Arab Emirates (UAE). “What was odd, the source said, was that the money in the account — hundreds of millions of dollars — had come from a bank in Azerbaijan. Most importantly, Kushner appeared to have transferred significant amounts of money from the Dubai account to other individuals, including a warlord, a mercenary, and a one-time hit man,” Cole wrote. The funds were reportedly provided by the royal families of Saudi Arabia and the UAE and intended to advance political and diplomatic objectives in the Middle East. According to Cole, in addition to Kushner, the Emirati president Mohammed bin Zayed Al Nahyan also had access to the account. A source said in the book that Kushner was looking for a workaround to achieve his diplomatic goals and promised the Emirati president that he would present their interests to Trump if they contributed to the fund. The goal was to normalize relations with Israel by forcing a breakthrough in the Gaza war. This would enable Trump to continue relations with Israel without losing face. According to Cole, the MIVD gained access to Kushner’s phone through a former GRU operative. In 2017, the Dutch intelligence service got wind that this operative was en route to the United Kingdom for an espionage mission and asked the British authorities to detain him. The MIVD then presented the man with two options: work as an informant for the Dutch government, or potentially face years in prison in the U.K. for espionage. The Russian man decided to defect and granted the MIVD access to one of the GRU’s most sensitive systems. While investigating this system, the MIVD found screenshots from Kushner’s iPhone on a server in the Russian city of Rostov. This led the intelligence service to gain direct access to the phone in early 2018, allowing them to view the screen whenever Kushner used the device. The excerpt of the book published in Vanity Fair does not reveal how long the MIVD had access to Kushner’s phone. The intelligence service told NOS that it does not comment on its operational methods, the extent of its knowledge, or its sources.”

53. Russia/Ukraine: Three Agents of SBU Sentenced to 17 and 19 Years in Prison in Berdyansk for Involvement in Sabotage

Media Zone reported on October 22nd that “the Zaporozhye regional court, created by the Russian authorities, announced the verdict of three residents of occupied Berdyansk in the case of an attempt to blow up a gas distribution substation. This was reported by the press service of the court. Valentina M., born in 1969, was sentenced to 17 years in a general regime colony, a year of restriction of freedom and a fine of 500 thousand rubles. Her son Andrei, born in 1990, and friend Sergei, born in 1965, were sentenced to 19 years in a maximum security colony, one and a half years of restriction of freedom and fines of 600 thousand rubles. They were found guilty of treason (Article 275 of the Criminal Code), involvement in a sabotage group (Part 2 of Article 281.3 of the Criminal Code), attempted sabotage (clauses «a», «c» of Part 2 of Article 281 of the Criminal Code using Part 3 of Article 30 of the Criminal Code) and illegal possession of explosives and explosive devices (Part 4 of Article 222.1 of the Criminal Code). Judging by the available information, the defendants in the case were natives of the Zaporozhye region Valentina and Andrei Mironenko, as well as Sergei Smykalov. Their data on April 14, 2025 were added to the list «of extremists and terrorists» of Rosfinmonitoring. According to investigators, in the fall of 2022, a resident of Berdyansk contacted a representative of the Ukrainian intelligence services and agreed on cooperation, to which she later involved her son Andrei and acquaintance Sergei. The prosecution alleged that in January 2025, the woman received from an SBU officer photographs of a cache from which components for making explosives had to be taken. As stated in the court press release about the verdict, Sergei went to pick them up, after which, together with Andrei, they assembled an improvised explosive device.”

54. Cyprus/United Kingdom/Azerbaijan/Iran: Cyprus court rejects UK bid to extradite Akrotiri spying suspect

PhileNews reported on October 23rd that “a Cyprus district court has rejected a request from the United Kingdom to extradite R.S., a 45-year-old man accused of espionage at the British bases. The case against him will now be filed again at the Limassol Criminal Court. Britain sent the extradition request to the Republic of Cyprus last June, arguing that his alleged offences had been committed on British territory. Cyprus Police arrested him in the summer of 2025. He was accused of offences including photographing military installations within the Akrotiri bases. The man was arrested on June 21, 2025, philenews reported in July. The Republic of Cyprus filed a case against him at the Limassol Criminal Court on charges including alleged surveillance of the ‘Andreas Papandreou’ air base in Paphos. The Attorney General later suspended that case after considering the British request and decided to pursue his extradition instead. He, who holds Azerbaijani and British citizenship, was re-arrested on the basis of the British request when the suspension took effect in July. According to information available to philenews at the time, UK authorities believe that he has a direct link to Iran’s Islamic Revolutionary Guard Corps. They allege he took visual material from inside buildings at the bases, monitored the frequency of British fighter jet flights and passed the information to a suspected handler, Elshad Elchin Hajiyev, who is wanted under an international arrest warrant. The man would face up to 14 years in prison if convicted in Britain.”

55. India/Pakistan: Delhi High Court Denies Bail to Man Accused of Passing Classified Military Documents to Pakistan

Bar and Bench reported on October 23rd that “the Delhi High Court recently refused to grant bail to a man accused of spying for a Pakistan High Commission official [Habib Ur Rahman Vs State]. The accused man, Habib Ur Rahman, was allegedly found in possession of sensitive documents pertaining to military training and other material marked as “confidential.” He was also accused of passing secret and sensitive military information to an official in the Pakistan High Commission by acting as an intermediary. An FIR was registered against Rahman and he was arrested in 2021 on charges of spying under the Official Secrets Act, 1923. Rahman, who is wheelchair-bound and suffering with several ailments, was previously granted medical bail. In January this year, the Court refused to extend his interim medical bail and said that he can instead apply for regular bail. In the order passed on September 25, Justice Sanjeev Narula refused to grant regular bail to the accused, after noting the seriousness of the allegations against him. “The gravity of the present case lies not in the statutory label alone, but in the nature of the documents allegedly procured, their asserted source, and their intended destination,” the Court said.”

56. Ukraine: SBU Detained Man Leaking Sensitive Information in TikTok

Ukraine’s SBU announced on October 22nd that they “exposed a deserter who lit up the positions of missile complexes of the Armed Forces of the Armed Forces of Ukraine in TikTok. The military counter-intelligence of the Security Service, with the assistance of the leadership of the Naval Forces of the Armed Forces of Ukraine, exposed a sailor in the Mykolaiv region who distributed videos of his unit’s base points in TikTok. As the investigation found out, the contractor posted on social media the combat positions of operators of missile complexes defending the coast of the southern region of Ukraine. According to the case materials, the person involved unauthorisedly published closed information after that how he voluntarily left the military unit. It was established that when the deserter was hiding, he published on his own page in TickTock more than ten previously made videos with the locations and combat work of the Navy unit. «Merged» records were recorded on a telephone camera with reference to the terrain, which allowed the enemy to establish the coordinates of the defensive lines of the Ukrainian troops. According to the available data, the Rashists could use the published information to attack the positions of the Armed Forces of the Armed Forces of Ukraine. But the military counter-intelligence officers of the SBU worked ahead of schedule and secured the temporary deployment points of the Defence Forces in advance after exposing the figure.”

57. Philippines: Intelligence Sharing Key to Strengthening ASEAN Fight Against Cross-border Crimes

PIA announced on October 23rd that “the Department of the Interior and Local Government (DILG) on Wednesday emphasized that sustained intelligence sharing among Association of Southeast Asian Nations (ASEAN) member states is crucial to strengthening the regional campaign against transnational crimes, citing a multi-billion peso drug seizure in Laos as an example of cross-border coordination. During a press briefing following the ASEAN Plus Three Ministerial Meeting on Transnational Crime (AMMTC + 3), DILG Secretary Jonvic Remulla, serving as AMMTC Chair, said the region’s gains in combatting transnational crimes are anchored on the proactive exchange of intelligence on shared security threats. “We share information. What is important is the intelligence sharing, and I give credit to all the ASEAN nations for being very active in that area,” he said. Remulla cited the interception of Php 3.54 billion-worth of methamphetamine by Laotian authorities earlier this month which helped prevent the illegal drugs from reaching Philippine shores. Philippine law enforcement agencies said they received initial intelligence about the drug shipment weeks before the actual interception. “[This] is what we want to make routine across ASEAN: faster intelligence sharing, joint operations, and better-equipped people on the front line,” he stressed. As the Philippines passed the baton of AMMTC Chairship to Singapore, Remulla underscored the growing cooperation among ASEAN member states in addressing shared security challenges. “The level of cooperation between all member-states is now greater than ever. Everyone faces the same problem. So, everyone is collaborating in order to find better solutions to stop this,” he said.”

58. Russia/Israel: Russia Rejects Netanyahu’s Accusations of Alleged Involvement in Antisemitic Online Campaign

AA reported on October 23rd that “Russia has rejected accusations by Israeli Prime Minister Benjamin Netanyahu concerning Moscow’s alleged involvement in an antisemitic online campaign. The Russian Foreign Ministry told state news agency Tass on Thursday that it was “perplexed” by the “entirely unsubstantiated accusations,” saying attempts to claim Moscow operated such a campaign appeared “particularly absurd.” It said that this is so, “given a fact well known to — and repeatedly acknowledged in public by — the Israeli side, that thanks to the Russian leadership’s policy of strengthening interethnic peace and harmony, manifestations of antisemitism in our country are virtually non-existent.” On Sunday, Israel’s i24 News reported that Netanyahu, in response to a question from the news channel, accused Russia of “aiding Iran and using artificial intelligence to operate antisemitic bot networks targeting Israel and Jews worldwide.” The ministry noted that it is regrettable Netanyahu’s remarks came on the 35th anniversary of the restoration of diplomatic ties between the two countries, and that it took note of his statements concerning Moscow’s alleged bot activities. “Yet, as early as 2018, Russia proposed that Israel enter into a bilateral agreement on cooperation in the sphere of information security — a proposal to which no response was ever received,” the ministry said, noting this “could have prevented problems from arising out of thin air.” It also described that it is “regrettable” Netanyahu chose to engage “in media-driven allegations” ahead of Israel’s legislative election scheduled for Tuesday rather than fostering dialogue between relevant experts on cybersecurity issues, noting this is not the first time Russia has “encountered such fakes.” “There is a well-known Russian expression: ‘Shifting the blame from a sick head to a healthy one.’ Perhaps this is precisely such a case. It is clear that the world’s attitude toward Israel is determined solely by the course of action taken by its own authorities,” it added.”

59. Belgium/Russia: Leaked WhatsApps Between Ex-EU commissioner Reynders and Senior Belgian Spy Reveal Attempts to Bury Allegations of His Possible Russia Ties

EU Observer published this exclusive story on October 23rd, stating that ““the ‘job’ … has been mostly accomplished,” said a senior official in Belgium’s spy service, Hugues Brulin, in a WhatsApp message to the Belgian then EU commissioner, Didier Reynders. “Bravo for the work you did,” said Reynders. It was back in 2022, and, at least on the surface, they were chatting about a staff reshuffle inside Belgium’s intelligence service, La Sûreté de l’Etat/Veiligheid van de Staat (VSSE) — which was already a peculiar thing for Brulin to be doing on WhatsApp with an EU official. But their messages, seen by EUobserver and published in full below, were now also evidence in a Belgian police investigation into Reynders on money-laundering charges, which painted them in the light of a potentially criminal conspiracy. They reconfirmed that Belgian authorities were looking into wider allegations of Reynders’ possible collusion with Russia. Brulin’s real “job” had been to stop the VSSE from probing Reynders and his potential Russia links, according to five former and current Belgian intelligence officers who spoke to EUobserver. And Brulin also WhatsApp-ed Reynders on how to “counterattack” a Russia whistleblower. The 68-year-old liberal politician from Liège, in French-speaking southern Belgium, had had a glittering career before his sudden fall from grace in December 2024, when Belgian police raided his properties, and before he was subsequently charged in 2025 with having laundered some €1m via the ING Bank, using lottery tickets and cash deposits. Reynders had been EU justice commissioner from 2019 until 30 November 2024 (just four days before the police raid) and Belgium’s foreign and defence minister from 2011 to 2019. And Belgium had vetted and cleared him to read “top secret” national, EU, and Nato documents.”

60. United States/Russia/Germany: Airfield Attack Marked Opening Shot in Putin’s Stepped-Up Sabotage Campaign

The Wall Street Journal published this exclusive story on October 20th, stating that “U.S. intelligence agencies say the failed operation in Germany this summer was part of a new wave of attacks ordered by the Russian leader. Amassive cargo plane, used to carry military assistance to Ukraine and parked at an airfield in eastern Germany, was attacked by explosive-packed drones in early August. German officials say they were piloted by Russian military-intelligence agents. One drone slammed into the Antonov freighter but failed to explode. Another collided with a different plane, and a third detonated near the airport perimeter, authorities say. Had the assault worked as planned, investigators say, the result would have been mayhem and casualties at one of Europe’s most important air-cargo airports.”

61. United States/Russia/United Kingdom: Surveillance and ‘Constant Paranoia’ — Western Diplomats Tell BBC of Life in War-time Moscow

BBC reported on October 2nd that ““being the ambassador to Russia was probably the hardest assignment of my career,” Lynne Tracy, who represented the US in Moscow from 2023 to 2025, tells the BBC. US, UK and European diplomats once played a crucial role in Russia, defusing tensions even at the worst moments of the Cold War. But now, deemed “unfriendly” by President Vladimir Putin’s government, Western ambassadors are under constant surveillance, isolated and increasingly cut off from the country they were sent to understand, as the war in Ukraine grinds on through its fifth year. The BBC has spoken to five diplomats who have served in Russia since it launched its full-scale invasion. They compare current pressure levels to the Cold War era — when Western embassies were monitored through physical surveillance, listening devices hidden inside gifts, and “spy dust” — a near invisible chemical agent used to track officials. Hundreds of Russian diplomats were expelled from countries in Europe and the US after the war began in 2022. Moscow responded in kind, declaring hundreds of Western diplomats persona non grata and leaving many embassies short-staffed. Tracy’s 30-year career took her to countries like Pakistan, where she survived an armed attack in 2008. But she says that even under constant physical threat, her posting in Peshawar was, in a sense, easier than Russia. “There, I still felt that there were things within my control. What made Moscow more difficult were the high levels of uncertainty.” The constant pressure from Russian counterintelligence was the primary source of such uncertainty, she recalls.”

62. Russia: FSB Arrested Resident of Verkh-Isetsky for Treason

Media Zone reported on October 23rd that “the Judge of the Verkh-Isetsky Court of Yekaterinburg Nelly Baraeva sent 42-year-old taxi driver Andrei Voloshin to a pre-trial detention centre in a case of treason (Article 275 of the Criminal Code), «Media Zone» found out. Voloshin was detained on the morning of October 22 at the exit from the 14th police department on Bauman Street — he came for a phone seized as part of the first criminal case about «discrediting» the army. Together with him, two friends came to the police department who were witnesses in the case of «discredit» — they were also detained by FSB officers and released only at midnight as witnesses. After his arrest, Voloshin was beaten on the body and head, his hands were handcuffed and strangled with bags. He still had signs of torture: handcuff marks on his hands, red stripes on his neck from a bag, marks of blows on his face, and hematomas on his stomach. As it became known to Media Zone, the criminal case may be related to a photograph on Voloshin’s phone, which he took while working at the plant «Novator» associated with the military industry. In February 2025, Voloshin was fined 30 thousand rubles because of six pictures with «caricatures of his brothers-in-arms» on «VKontakte» under the article about «discrediting» the army. And at the end of August 2026 fined already 150 thousand rubles for two episodes of repeated «discrediting» the army (Part 1 of Article 280.3 of the Criminal Code). The case was opened in April for two comments on «Vkontakte» published in 2025.”

63. United States: Jim Himes, the US Democrat Set to Reassert Congressional Oversight of Intelligence

Intelligence Online reported on October 23rd that “ the representative for Connecticut is getting ready to chair the House intelligence committee should the majority flip. A big opportunity for the experienced lawmaker to hold CIA Director John Ratcliffe and FBI Director Kash Patel to account over Trump administration policies. For Democratic lawmaker Jim Himes, ranking member of the House of Representatives’ intelligence committee — the House Permanent Select Committee on Intelligence (HPSCI) — the 3 November mid-terms will be a decisive moment. Not for his own re-election in his quiet Connecticut constituency, which seems a shoo-in, but in case his party wins a majority in the House.”

64. Iran: Two Espionage Operatives Arrested in Western Iran

Tasnim News reported on October 24th that “the arrests came after round-the-clock efforts by Intelligence Ministry agents and the Islamic Revolution Guards Corps (IRGC) Ground Force commandos, according to an announcement. During the intelligence operation, security forces seized 10 Starlink satellite internet devices, 10 AK-47 rifles, and 5,200 rounds of ammunition for pistols and G3 rifles. The operation was part of ongoing intelligence efforts to identify and counter activities by individuals affiliated with foreign espionage services and prevent actions that could threaten Iran’s security.”

65. Ukraine/Russia: SBU Announced 10 and 15 Years in Prison for Two GRU Agents Detained in September 2025

Ukraine’s SBU announced on October 23rd that “according to SBU materials, two agents of the Russian Federation who directed strikes on Sloviansk and Kramatorsk received 15 and 10 years in prison. Two agents of Russian military intelligence (better known as GRU) received real prison terms under the evidence base of counter-intelligence and investigators of the Security Service, whom the SBU exposed in September 2025 on the adjustment of enemy strikes on Donetsk region. As the investigation found out, the attackers acted separately in different directions of the front and «reported» to the only curator from the Russian Federation. One of the convicts is a resident of Sloviansk, recruited by the Rashists, who aimed Russian aerial bombs and rocket artillery at the front-line city. For the conspiracy, before going on a mission, the agent wore a tactical uniform and pretended to be a serviceman of the Armed Forces. The second convicted, resident of Kramatorsk, who was involved by Russian intelligence services in cooperation through his acquaintance, a militant of the armed groups of the Russian Federation fighting on the Eastern Front. On the instructions of the handler, the agent went around the district centre and the outskirts of the city in order to trace and transfer to the Russian Federation the geolocation of checkpoints and traffic routes of mobile fire groups of the Defence Forces. SBU counter-intelligence officers documented the crimes of the correctors and detained them at their places of residence. During the searches, mobile phones and laptops with evidence of work for the Russian GRU were seized from them.”

66. United States/Cuba: Rubio Urges Cubans to Work with CIA, But Warns — Be Discreet

AFP reported on October 24th that “US Secretary of State Marco Rubio on Friday called for Cubans to make “discreet” contact with the American intelligence services as Washington seeks to force an end to the island’s communist government. For months, President Donald Trump and other senior US officials have openly hinted at a military intervention or takeover of Cuba, ramping up economic, political and legal pressure on the country. “To those who seek to create positive change in Cuba — now is the time,” Rubio said on social media. “The disappointment of failed promises, corruption, and the privileged lives of only a few; seize this opportunity to create the change you desire through a discrete partnership with the CIA.” The unusual post appeared to confirm that the CIA is currently active in Cuba after a long history of covert operations including backing the disastrous Bay of Pigs invasion in 1961. The call was mocked by Cuban officials. “Now the United States is resorting to public recruitment for the CIA,” Cuban Deputy Foreign Minister Carlos Fernandez de Cossio wrote on X. “There must be a great deal of desperation or misery within the agency for it to be forced to sell its services like a tube of toothpaste.” The CIA later uploaded a video to X offering instructions in Spanish for those who believe they have information of interest to the intelligence agency, encouraging them to first and foremost visit an official US installation in person if they can safely travel to one. For those hoping to contact the CIA online via the cia.gov website, the agency instructed users to access the internet on a secure network like a VPN using a private browser and a burner email account unassociated with any personal details.”

67. Russia/Ukraine: Agent of the SBU Sentenced to 12 Years in Prison

Media Zone reported on October 23rd that “the Krasnodar Regional Court sentenced a 27-year-old native of Ukraine to 12 years in a maximum security colony in the case of filming a parking lot in Gelendzhik on instructions from the SBU. The verdict was reported by press service of the court. The young man was found guilty of treason (Article 275 of the Criminal Code). In addition to the real sentence, he was given a year of restriction of freedom. The video recording from the announcement of the verdict mentions the name of the convicted person — this is Nikolai Gusev. He lived in the city of Zugres in the Donetsk region writes kuban prosecutor’s office. According to investigators, Gusev, on instructions from the Ukrainian intelligence services, came to Krasnodar and took «a video of cars in the parking lot of the Brigantina Hotel in Gelendzhik and gave the handler data on models and state registration plates of vehicles». He was paid $100 USD for this. The court ordered the confiscation of a similar amount as part of the verdict. The security forces claimed that the data about the vehicles «were of interest to the Ukrainian intelligence services and their use could damage the security of the Russian Federation».”

68. Cuba/United States: Cuba Mocks US ‘Desperation’ Calling on Cubans to Work with CIA

Le Monde reported on October 24th that “Havana on Friday, October 23, mocked the “desperation” of the United States after it called for Cubans to collaborate with the CIA, as Washington intensifies its pressure on the communist island. “Now the United States is resorting to public recruitment for the CIA,” Cuban Deputy Foreign Minister Carlos Fernandez de Cossio wrote on X. “There must be a great deal of desperation or misery within the agency for it to be forced to sell its services like a tube of toothpaste.” US Secretary of State Marco Rubio, earlier Friday, called for Cubans to make “discreet” contact with the American intelligence services as Washington seeks to force an end to the island’s communist government. For months, President Donald Trump and other senior US officials have openly hinted at a military intervention or takeover of Cuba, ramping up economic, political and legal pressure on the country. “To those who seek to create positive change in Cuba — now is the time,” Rubio said on social media. “The disappointment of failed promises, corruption, and the privileged lives of only a few; seize this opportunity to create the change you desire through a discreet partnership with the CIA.” The unusual post appeared to confirm that the CIA is currently active in Cuba after a long history of covert operations including backing the disastrous Bay of Pigs invasion in 1961. The CIA later uploaded a video to X offering instructions in Spanish for those who believe they have information of interest to the intelligence agency, encouraging them to first and foremost visit an official US installation in person if they can safely travel to one.”

69. Iran/United States/Saudi Arabia/Yemen: Iranian Assassination Plots Targeting American Officials are in ‘Advanced Stages’

OKC Fox reported on October 24th that “Iran has “substantially increased” efforts to target U.S. officials and diplomats abroad, with lethal plots believed to be in “advanced stages” in the Middle East, according to an intelligence memo obtained by Fox News and Axios. The unclassified memo was sent by Director of National Intelligence Jay Clayton to Secretary of State Marco Rubio on Friday, with U.S. officials confirming the document’s authenticity, per the media outlets. Clayton warned that intelligence involving Iranian assassination plots should be shared with additional U.S. personnel, Axios, who broke the news on Friday, reported. The report did not identify possible targets, the alleged planners, or specific countries where plots may be unfolding. The warning came as the State Department reduced staffing at U.S. diplomatic missions. The department directed nonessential government employees and eligible family members to leave the U.S. Embassy in Riyadh and consulates in Jeddah and Dhahran, Saudi Arabia. The personnel drawdown followed escalating attacks blamed on Iran-backed Houthi rebels, who control much of Yemen. U.S. officials have cited growing concern that violence could broaden beyond Saudi Arabia.”

70. Russia/Ethiopia: Uninvited Guest — How a GRU Spy Connected to State Hackers Broke into the African Union’s Diplomatic Residence in Ethiopia

The Insider reported on October 23rd that “after the death-by-plane crash of Wagner Group founder Yevgeny Prigozhin in August 2023, the Kremlin’s influence operations in Africa have undergone a transformation. In addition to the Africa Corps — a state-run armed formation made up mostly of former Wagner fighters — Russia’s military intelligence agency (GRU) is also active on the ground. However, fresh revelations about a GRU break-in at an African Union facility in Addis Ababa threaten to tarnish relations between the Kremlin and the continent. The news couldn’t come at a worse time for Moscow, which is set to host the third ever Russia-Africa Summit on October 28–29. On April 28, 2025, Mahamoud Ali Youssouf, the Chairman of the African Union Commission, arrived at a house in the upscale neighborhood of Bole Atlas in Addis Ababa, where the union’s secretariat is headquartered. The property is the official residence of Selma Haddadi, the Deputy Chairperson of the Commission, which is the executive arm of the supranational body representing all 55 African countries. But on that afternoon, it was in use by Youssouf and his family, who were then still recent transplants to the Ethiopian capital after arriving days earlier from Djibouti, Youssouf’s native country, where up until the previous month he’d served as its foreign minister. At 3:32 p.m., a vehicle with diplomatic license plates pulled into the parking area outside the main compound of Africa House. Out of it stepped a white man of medium build with short hair, dressed in a button-down shirt and tie. He waited until a car transporting Youssouf’s university-aged daughter entered the premises via an opened security gate and then snuck in on foot before the gate closed behind him. The intruder entered the residence and proceeded directly to the bedroom where Youssouf was staying, remaining inside the building for 4 minutes and 24 seconds. At some point, the unknown intruder ran into the daughter (The Insider is withholding her name) inside the house. A stationed private security detail met the man as he exited the residence at 3:37. They tried to question him, but the detail worried he might have been a VIP who’d gotten lost or entered without the proper checks. Amid the confusion, the intruder drove off at 3:38.”

71. United Kingdom/Russia: New Charges for Royal Navy Sailor Accused of Plotting to Leak Secrets to Russia

Sky News reported on October 23rd that “a junior Royal Navy serviceman is facing additional charges after being accused of plotting to leak classified information to Russia. Able Seaman Teddy Young allegedly abused his high-level security clearance to access secret defence and intelligence data while deployed on a Navy vessel. He is said to have drafted a message in Russian and used the dark web to try to contact authorities in the country. Young joined the Navy in April 2024 and allegedly began offending on his first deployment from 4 November that year. He was serving as a Royal Navy warfare intelligence rating with high-level security clearance and intelligence-system access. The 24-year-old, of Bedford, was first arrested in May 2025 and then rearrested by counter-terror police at his Bedfordshire home earlier this month. Young, wearing a grey tracksuit, appeared at the Old Bailey via videolink from Belmarsh prison for a preliminary hearing on Friday. He is charged with a total of five offences.”