SPY NEWS: 2022 — Week 12

Summary of the espionage-related news stories for the Week 12 (20–26 March) of 2022.

1. Israeli Shin Bet Arrests Hezbollah Espionage Network

On Sunday, March 20th, it was announced that Israel’s internal security agency, Shin Bet (also known as Shabak), arrested 4 Israeli nationals “working for the Lebanese Hezbollah under Iranian supervision.” The report says that the arrested individuals “met with their handlers a few times in Turkey and they were assigned the task of smuggling weapons to Israel” and the report continues that “Hezbollah asked the defendants to identify targets for missile strikes and to locate appropriate paths for crossing and smuggling across the Israel-Lebanon border.” IDF spokesperson, Avijaa Adraei, published further details including ISR videos, maps, and organisational charts of the disrupted spy network which was, reportedly, controlled by Iran.

2. Russian FSB Reports Ukrainian Naval Mines Drifting to Bosphorus and the Mediterranean Sea

On March 20th, the Russian Federal Security Service (FSB) stated that the Ukrainian Navy had deployed roughly 420 naval mines on routes approaching the ports of Odessa, Ochakiv, Chornomorsk and Yuzhne. Due to the obsolete design and insufficient maintenance, FSB reports that they identified broken anchor cables on some of them (claiming it was due to the recent storm), and those have been detected drifting in the western part of the Black Sea, and based on the weather reports, it cannot be ruled out that they might head towards Bosphorus and the Mediterranean Sea. On Saturday, March 26th, this intelligence was confirmed since Turkish Navy had to defuse a Soviet-era naval mine discovered drifting north of Istanbul, Turkey.

3. Spy Collection: Greek KYP 1966 WTO Intelligence Report

On Monday, March 21st, we published a 5-minute long video about a 1966 intelligence report by the, no longer existing, Greek Central Intelligence Service (KYP — ΚΥΠ). The document was from a classified lecture on the Warsaw Treaty Organisation (WTO) and Ground Forces of the USSR and Satellite States.

4. Analysis of an Automated Iranian Cyber Espionage Operation

The DFIR Report published a technical analysis of how an actor dubbed as “APT35” (who has been previously associated with the Iranian state) automated the initial access (for cyber espionage) to vulnerable systems in December 2021. The analysis says that the “activity occurred in two bursts within a 3 day time frame.”

5. Hermes Starliner UAS Certified to Fly in Civilian Airspace

On Sunday, March 20th, the Israeli Elbit Systems announced via a video that their Hermes StarLiner Unmanned Aerial System (UAS) became the first UAS platform to be “certified to fly in a civilian airspace as any other civil airplane.” According to the company, this will enable its users to “fly over populated areas allowing governments and commercial organizations to have a long endurance UAS to execute missions that until now were performed only by manned aircraft, including border security, anti-terror operations, securing mass public events, maritime search and rescue missions and perform commercial aviation and environmental inspection missions.”

6. CIA DS&T: The Office of Scientific Intelligence (OSI), 1949–68

On Monday, March 21st, the Government Attic published some declassified Central Intelligence Agency (CIA) documents they obtained through FOIA. It’s a total of 680-pages from CIA’s Directorate of Science & Technology (DS&T), part of the Historical Series publications. It’s titled “The Office of Scientific Intelligence (OSI), 1949–68” and includes volumes one, two and three as well as annexes I through X, published by the CIA in 1972.

7. Norwegian Photographer Held on Spy Charges in Greece Released

On Monday, Norwegian photographer Knut Bry who was arrested last week on espionage charges in the Greek island of Lesbos (see week 11, story #39) was released after testifying for over 3 hours to provide evidence for his activities in the island.

8. Overview of the 2003 NRO Espionage Case of Brian Patrick Regan

United States Central Intelligence Agency (CIA) veteran Christopher Burgess published a short article for the National Reconnaissance Office (NRO) espionage case of Brian Patrick Regan who was sentenced to life in prison on March 21, 2003 for selling and attempting to sell classified NRO material to the governments of Iraq, Libya, and China.

9. Former DGSE Head Identifies Molenbeek as Terrorism Base in EU

Retired French counter-terrorism intelligence officer and former Head of the Directorate-General for External Security (DGSE) in the period of 2000–2001, Alain Chouet, described Sint-Jans-Molenbeek, Belgium as an islamic terrorism base inside Europe in his latest book.

10. Polish President Met With the Director of the CIA

On Monday, March 21st, Poland’s President, Andrzej Duda, officially met with William Burns, Director of the Central Intelligence Agency (DCI) in the Polish President’s Office. The statement says that “the meeting was also attended by US ambassador to Poland Mark Brzezinski, and the head of the presidential International Policy Bureau, Jakub Kumoch.”

11. Ukrainian SBU Update on Counter-Intelligence Activities

On March 21st Ukraine’s Security Service (SBU) published a short summary of counter-intelligence activities of the last 24 hours. Those were: Investigation against Ivan Filiponenko, spokesman for the Luhansk People’s Republic (LNR), for saying that Rubizhne was handed over to Russia. The arrest of an individual in the city of Dnipro for sharing online Russian propaganda content and collecting intelligence on Ukrainian Armed Forces’ capabilities. Detainment of a Belarusian citizen in Volyn who was collecting and reporting to his handler information about the location and movement of Ukrainian Armed Forces in the region. And lastly, detainment of a Ukrainian national who openly supported a large-scale Russian invasion and expressed his interest to support Russian actions.

12. Unknown Cyber Actor Targets French Entities for Espionage

Cyber security firm Proofpoint published a threat research for an ongoing cyber espionage operation targeting construction, real estate, and government organisations in France, with the objective to covertly exfiltrate internal documents. The actor used a wide variety of advanced detection evasion and infiltration methods, and a range of tailored-made and off-the-shelf components to perform the cyber operations. According to Proofpoint researchers, they were not able to “associate this threat with a known actor or group.” Among others, Bleeping Computer stated that “the tactics point towards espionage.”

13. Use of HawkEye 360 Spy Satellites to Find Cocaine Shipments

Private RF satellite intelligence provider HawkEye 360 (HE360) published a short post with a video featuring Lynn Wright, member of HE360 Advisory Board and former United States Deputy Director of Naval Intelligence. The post/video describes how HE360 satellites can be used against cocaine shipments by tracking the ships through their signals. Quoting L. Wright “Even the bad guys have to communicate. Even the bad guys need to know where they are in the world. Even the bad guys in bad weather need to make sure another ship isn’t going to run into them. So, at that point, the ship is emitting RF energy. At that point, the ship is vulnerable.”

14. The 1994 Assassination of Cypriot Georgiadis by the Turkish MİT

The 20th of March marked 28 years from the assassination of Cypriot Theofilos Georgiadis who was the President of the Cyprus Kurdistan Solidarity Committee. News articles about it were posted this week in Greek media. Georgiadis was shot 5 times outside his house in Thukydidou Street in Aglantzia District, Nicosia, Cyprus. Later, it was discovered that his assassination was orchestrated by the Turkish National Intelligence Organisation (MİT) from an officer named Abdullah Çatlı who contacted a Cypriot leader of a drug gang, Andreas Aristodimos, to pay a hitman to execute this mission. Eventually, Andreas Aristodimos used his brother, Kypros Aristodimos, who shot Georgiadis in the evening of March 20th, 1994. Just a few months later, in June 1994, Aristodimos was also found dead near the city of Limassol, Cyprus and the case was closed.

15. New US Army CMIG for CYBERCOM’s Intelligence Operations

Mark Pomerleau of FedScoop published an article for a new US Army unit. It’s the Cyber Military Intelligence Group (CMIG), responsible to “direct, synchronize and coordinate intelligence support for cyber, information and electronic warfare operations while also providing support to U.S. Cyber Command and other combatant commands.” According to the article, before this announcement the US Cyber Command (CYBERCOM) was “the only service component command without a military intelligence brigade for intelligence support.” This was done as part of the US Army’s 10-year transformation plan to expand to the wider information warfare scope of cyber, in pursue of what is refer to as “information advantage.”

16. Ukrainian HUR MOU Claims Russian Elite Presses Putin and Alleged Successor Will Be from FSB’s Leadership

According to Kyiv Independent, the Main Directorate of Intelligence of the Ministry of Defence of Ukraine (HUR MOU) claims that Russian elites are trying to overthrow Russian President Vladimir Putin to recover from the economic impact, and that the former KGB, then FSK, and until 2008 Director of the Federal Security Service (FSB), Alexander Bortnikov, is considered as Putin’s successor according to HUR MOU sources.

17. Former Panamanian President Martinelli’s Response on Espionage Accusations for Ongoing Investigation in Spain

Former President of Panama Ricardo Martinelli (2009–2014) responded on the accusations that he was “spying on his alleged partner with the help of agents of the Spanish Civil Guard.” Over Twitter he described this accusation as “soap opera.” The article highlights that based on official announcements the “Spanish Civil Guard is investigating Martinelli and four agents of this security force for apparently being part of a criminal group to spy on the island of Mallorca (Mediterranean) on a woman who has been identified as an alleged partner of the Panamanian politician“ and it continues that “the operation has so far resulted in six detainees: four Guardia Civil agents in the Balearic Islands, a worker of a security company and a private individual, allegedly involved in these events, which occurred in 2020. In addition, 5 other people, including Martinelli, are being investigated for their alleged association with this criminal gang, which called itself Group Kougar.”

18. Russian Journalist Marina Ovsyannikova Charged in Russia and Publicly Accused of Being British Spy

As reported by The Telegraph, Russian journalist Marina Ovsyannikova, 43, who worked as an editor at Russia’s Channel One TV station has been charged with “organising an unauthorised public event” when she used her position in live TV to promote anti-war protesting without prior notification of her employer or the state, as required in Russia. According to BBC she later said that “the interrogation lasted for more than 14 hours, I wasn’t allowed to get in touch with my family or friends, I was denied access to a lawyer.” On Monday, March 21st, Kirill Kleimyonov, the Head of Channel One’s news division, publicly accused her she for operating as a British spy, specifically saying that “not long before [the protest], according to our information, Marina Ovsyannikova spoke with the British embassy. Who among you has had a telephone conversation with a foreign embassy?”

19. Pakistani Cyber Espionage Operation Targeting India’s Military

On March 21st, the “Shadow Chaser Group” of the GcowSec team published technical indicators of a cyber espionage operation, active at least since February 2022, targeting military personnel in India by impersonating it contains photo albums which, if opened, will covertly install a custom software implant known as AllAkore which is used for cyber espionage purposes. The operation was attributed to an actor dubbed as “SideCopy” who has been previously associated with Pakistan’s government and military.

20. New Spy Technologies at DIMDEX 2022 in Qatar

On 21–23 March the 2022 Doha International Maritime Defence Exhibition (DIMDEX) took place in Doha, Qatar. You can find the list of all the exhibitors here. Some of the intelligence-related technologies presented were ESETRON’s unmanned ground vehicles, Qatar’s MALE Q02 intelligence gathering aircraft, STM’s mini-UAV and cyber products, Horizon Technologies’ new BlackFish and FlyingFish SIGINT systems, General Atomics MQ-9B Sea Guardian, and others.

21. NATO New Declassified Content on Espionage in Cold War

On Tuesday, March 22nd, NATO released new content as part of its “NATO Declassified” online series. The new web content consists of videos, documents, and articles focusing on espionage targeting NATO from the Cold War era.

22. Italian Day of Remembrance of the Fallen Intelligence Officers

March 22nd marks the Remembrance Day for the Fallen Intelligence Officers in Italy, which included a special ceremony in Forte Braschi, Rome to honour those people. At 09:00 in the offices of DIS, AISE and AISI a moment of silence was held to honour the fallen. This year four fallen Italian intelligence officers were mentioned by the Undersecretary to the Prime Minister, Franco Gabrielli, during the commemoration ceremony and a document was also released about them. Vincenzo Li Causi joined SID in 1974, then moved to SISMI (later AISE) and died on November 12, 1993 in Somalia while covertly supporting Operation Restore Hope. Nicola Calipari started as the Head of Foreign Research in SISMI in 2002 after a career in the police. He was in Baghdad, Iraq to support the rescue of journalist Giuliana Sgrena, kidnapped on February 4th, 2005. While travelling to the international airport on March 4, 2005 he was misidentified by a local US military checkpoint who opened fire to their unmarked vehicle. Calipari used his body to protect Sgrena and he later died from his injuries. Lorentzo D’Auria was a SISMI officer sent in Afghanistan for intelligence gathering as part of the Italian ISAF mission. On September 22, 2007 while conducting reconnaissance North of Farah, near the Shindand District, he and a colleague were kidnapped by the Taliban. During the hostage rescue operation he was injured and died on October 4th, 2007 at the Celio Military Hospital in Rome at the age of 33. Pietro Antonio Colazzo was an AISE officer, expert in Afghanistan, who died on February 26, 2010 in a coordinated Taliban attack with suicide bombers targeting 3 hotels frequently used by foreign operatives in Kabul, followed by raids in the hotels by Taliban fighters. 18 people died and over 30 were injured. Initially, Italian Prime Minister had reported Colazzo’s casualty as a “diplomatic adviser.”

23. Belarus Expels 12 Ukrainian Diplomats on Espionage Charges

On March 22nd, the state-media Belarusian Telegraph Agency (BELTA) announced the expulsion of 12 Ukrainian diplomats based in the Minsk Embassy of Ukraine for violation of Article 31 of the Vienna Convention on Diplomatic Relations. The Deputy Head of the Investigation Department of Belarus’ KGB, Konstantin Bychek, announced that they have evidence that the identified Ukrainian diplomats were covertly collecting intelligence about the military of Belarus and had been attempting to establish an extensive informant network. KGB Deputy Head said that his agency tried to “signal” the Ukrainian diplomats that they were discovered to stop their illegal activities but they did not stop, resulting in their expulsion. Ukrainian Ministry of Foreign Affairs spokesperson, Oleh Nikolenko, said “Ukraine will not leave the actions of Belarus without a proper response.”

24. Podcast: Q, Followed By U — WWI British Navy Espionage

SpyScape’s “True Spies” series released a new 52-minute long episode about British Navy’s Captain Gordon Campbell who played a key espionage role in uncovering the secretive German submarine technology of that era.

25. Polish ABW Detains Citizen on Spying Charges for Russia’s SVR

Poland’s Internal Security Agency (ABW) announced the detainment of a Polish citizen working in the Archive Department of the Registry of Civil Status in the Registry Office of the capital city of Warsaw, Poland. According to ABW, he was recruited by Russia’s Foreign Intelligence Service (SVR) and was tasked with making copies and transferring documents to his SVR handler upon his request. ABW spokesperson stated that they have “extensive evidence” from the searches they performed. The suspect was detained on Thursday, March 17, and is now facing espionage charges which can lead to up to 15 years in prison.

26. ASIO Announces NITRO Unclassified Reporting Portal

Australia’s Security Intelligence Organisation (ASIO) announced the Notifiable Incidents, Threats and Reportable Observations (NITRO) secure portal, along with a promotional video from ASIO Director-General of Security, Mike Burgess. The NITRO portal is for “non-clearance holders in the defence industry to report concerns about espionage, insider threats or foreign interference” if they do not want to report them in person or via other means already available.

27. French Activist Discovers Covert Surveillance Equipment

As reported by Sud Ouest, near the home of Julien Le Guet, one of the leaders of the “Bassines non merci!” movement in France, a covert surveillance device was discovered. While the movement was preparing for this week’s protests “against projects for water reserves for agricultural use in Deux-Sèvres and Charente-Maritime” Julien Le Guet discovered a camouflaged long-range surveillance camera pointing to his home, and connected with rugged cases for its batteries and a wireless transmission unit. According to the report, they filed a legal complaint for “illegal surveillance” and they claim that it is conducted by the French government based on the fact that the equipment is from a defence contractor, restricted to governments only.

28. US CISA Call Based on Intelligence for Potential Critical Infrastructure Cyber Attacks from Russia

On March 22nd, the US Cybersecurity and Infrastructure Security Agency (CISA) held a call based on increased intelligence of Russian state cyber activity that could target US critical infrastructure. The next day, March 23rd, the recording of the nearly 3-hours long session was publicly released. The participants of the call were CISA Director Jen Easterly, Deputy Executive Assistant Director for Cybersecurity Matt Hartman, and Tonya Ugoretz, Deputy Assistant Director for the FBI’s cyber division.

29. Greek NIS Suspects 100 Russian Agents Operating in Greece

According to the Greek newspaper “Proto Thema” the National Intelligence Service (NIS) of Greece compiled a list of people suspected to be operating on behalf of the Russian government in the country. This list includes 30 Greek and Russian businessmen, and 100 persons related (directly or indirectly) with diplomats from the Russian Embassy in Athens who fall under the legislation of threats to national security. According to the news story, NIS has increased its operations targeting the people in that list as well as media that propagate Russian state-produced propaganda content.

30. Canada’s NSICOP Reports Spy Agencies Withhold Information from Parliamentary Oversight

Canada’s National Security Intelligence Committee (NSICOP) stated that “some organisations” from Canada’s intelligence community either delayed or rejected NSICOP’s request for information on their activities. Because of that there is increased risk for the government of Canada and a warning was issued that, by law, intelligence agencies have to cooperate with NSICOP that acts as a parliamentary oversight body for reviewing intelligence activities.

31. Soviet Weapons US Sends to Ukraine Allegedly Come from Intelligence Community’s Clandestine Acquisition Programs

J. Trevithick published an article highlighting that recently the United States has been sending Soviet-era weapons and defence systems to Ukraine opening the question of how did the US obtained them in the first place. According to sources mentioned in his article “U.S. military and Intelligence Community have obtained in various ways over the years for intelligence analysis and training purposes.” It is highlighted that based on that, those could be part of Foreign Materiel Exploitation (FME) programs which are typically highly classified due to the “often covert or clandestine methods by which foreign military systems are obtained.”

32. Poland Expels 45 Russian Diplomats on Espionage Charges

On Wednesday, March 23rd, Polish Onet media reported through confidential sources that Sergei Andreyev, Ambassador of the Russian Federation to Poland, was summoned to the Ministry of Foreign Affairs and was given a list of 40 names of employees of the Russian embassy in Warsaw, identified as involved in espionage activities, in violation of the Vienna Convention on Diplomatic Relations, and requested their expulsion as Persona Non Grata (PNG). Later, it was confirmed via official statements which said the list was actually for 45 names, not 40 as initially reported. According to Perild “the day before on social media spread photos and videos of smoke over the Russian embassy in Warsaw, which could mean a large-scale burning of official documents. This may occur before a significant reduction or closure of the diplomatic mission.”

33. Human Rights Watch Reports on Uganda’s ISO Torture Black Sites

On Tuesday, Human Rights Watch (HRW) said that Uganda’s domestic intelligence agency, the Internal Security Organisation (ISO), is operating clandestine sites where documented cases of torture have occurred. The report is based on interviews of 51 people from the period of April 2019 to November 2021. HRW calls the government of Uganda to “immediately close all so-called safehouses and other unauthorised detention centres.” Among the documented torture cases, the news story describes “Rambo” which is explained as suspending the detainee from the ceiling from their handcuffs, a case of a pregnant detainee raped twice and beaten, injections with unknown substances, electric shocks, and others. In December 2021, The US placed sanctions against “Uganda’s former military intelligence chief Abel Kandiho over alleged human rights violations committed under his watch” but according to HRW, no change has happened. Actually, the sanctioned former spy chief, Abel Kandiho, was appointed as the “top command of the country’s feared police force” in February 2022.

34. Australia’s SIGINT Agency Announces New Facility in Canberra

This week it was officially announced that the Australian Signals Directorate (ASD) has a new facility dedicated to cyber and foreign intelligence operations in Majura Park, Canberra, Australia. Minister for Defence, Peter Dutton visited the site and in a media release stated that “this state-of-the-art building reflects the Australian government’s determination to defend against and confront our adversaries in what is a rapidly deteriorating strategic environment. ASD is a world-class intelligence, offensive cyber and cyber security agency and this new facility will ensure its dedicated staff can continue to innovate and stay one step ahead of our most cunning adversaries.” The new site will be used jointly by both ASD and ASD’s Australian Cyber Security Centre (ACSC).

35. SBU Detains Ukrainian Citizen for Leaking Sensitive Information Exploited by Russian Special Services via TikTok

The Security Service of Ukraine (SBU) announced the detainment of Ukrainian citizen Artemev Pavel Alexandrevich who uploaded a video showing that Ukrainian forces were covertly moving weapons in a shopping mall in Kiev, Ukraine. According to SBU, Russian special services used this intelligence to target and bomb the site. SBU investigates the detained person for intentional espionage on behalf of Russia via TikTok, and announced SBU’s new mobile application which Ukrainian citizens can use to record any suspicious events that SBU needs to be aware of.

36. Podcast: PSYOPs and Propaganda — Lessons from 7 Tours

On March 22nd, an over 1-hour long podcast was published by Jon McLernon, featuring Tim Heale, retired British Army Colour Sergeant with deployments in Germany, N. Ireland, Norway, Kosovo, Afghanistan, Iraq and elsewhere as a member of the 15th Psychological Operations Group for ten years (1999–2009). He talks about his experiences with propaganda and Psychological Operations (PSYOPs) and how it relates to today’s world.

37. South Korea Push for Declassification of Inter-Korean Talks

According to Yanhap News Agency, the South Korean government is pushing to declassify and reveal historic records of secret inter-Korean talks. Currently, there is an internal review committee of 10 members assessing the request. The first material date to the period of 1971–1991. The article says that “the dossiers that may be unveiled include those on the 1972 meeting in Pyongyang between then North Korean leader Kim Il-sung and Lee Hu-rak, then head of South Korea’s state intelligence agency.”

38. New Cyber Attack Activity in Ukraine with “DoubleZero” Implant

The Computer Emergency Response Team of Ukraine (CERT-UA) disclosed a previously unknown cyber attack operation targeting entities in Ukraine. They identified several Zip archive files targeting government systems. The archives contain a new software implant they dubbed as “DoubleZero” which, if executed, covertly rewrites all non-system files with zeros and then does the same for system files, eventually forcing Microsoft Windows to shut down, making the compromised systems inoperable. This is the fifth unique cyber attack implant observed in Ukraine (see week 11 story #11 for the previous four) and it is not publicly known who is the operator behind it. CERT-UA said they attribute it to an unknown actor codenamed as “UAC-0088”.

39. Latvian Citizen Sentenced to 5 Years in Prison as GRU Spy

On March 23rd, the Vidzeme Suburb Court of the city of Riga, Latvia concluded that Andris Birzgali, born in 1955, is guilty of conducting espionage on behalf of Russia and was sentenced to 5 years in prison. According to Latvian media he was arrested last year after a joint counter-intelligence operation of Latvia’s State Security Service (VDD) and the Military Intelligence and Security Service (MIDD) which resulted in the detainment of two men. The two Latvian spies were travelling to Russia to meet with their GRU handlers and used their “professional contacts to obtain, compile, analyse and pass on to the Russian military intelligence information about the Latvian Armed Forces’ combat capabilities, procedures, plans and training, defence systems procurement, NATO expansion, and activities of the NATO forces present in Latvia.”

40. Video: US Naval Institute — Cuban Missile Crisis

On March 22nd, United States Naval Institute Operations Officer Emeritus Denis Clift gave a 12.5-minute presentation of the 1962 Cuban Missile Crisis, indicating the importance that espionage played in avoiding a nuclear war between the United States and the Soviet Union.

41. SBU Daily Summary of Counter-Intelligence Activities

On March 23rd, the Ukrainian Security Service (SBU) published a summary of their counter-intelligence activities the last 24 hours. Those were the detainment of a Ukrainian national in Kiev for passing information about “strategic and defence facilities” to his Russian handlers and disseminating propaganda. Detained a separatist in Odessa promoting Russia’s actions through the internet. Disrupted an illegal people smuggling network used by those attempting to avoid their conscription service in Lviv. And lastly, two individuals from the Poltava region were detained while trying to bribe a border guard officer with €3000 for reasons not specified in the summary.

42. New Cyber Espionage Implant for MacOS from Chinese Nation-State Actor Targeting Asian Entities

Volexity cyber security firm published a technical analysis of a previously unknown cyber espionage software implant dubbed as “GIMMICK” which is designed to target Apple MacOS systems. According to Volexity’s analysis it was developed and operated by an actor associated with the Chinese government, and used to target entities in Asian countries for espionage purposes. The analysis says that it is a feature-rich multi-platform software implant (there was another version of it for Microsoft Windows) and has several advanced capabilities such as the use of public cloud services, new detection evasion techniques, and more.

43. Smithsonian Busts the Myth of Agent 355 in the Culper Spy Ring

Bill Bleyer published an article explaining how there are no historical evidence that the mysterious female Agent 355 helped George Washington win the American Revolution as a member of the, so called, Culper Spy Ring. There is only one historical reference to her but without any link to espionage activities or a relation to the Culper Spy Ring.

44. Israel Denied Sale of Pegasus to Ukraine in Fear of Russian Retaliation

As reported by The Guardian, the government of Israel blocked NSO Group from selling its products, mainly the Pegasus cyber espionage suite, to Ukraine. The article says that “Israel’s decision reflected a reluctance to agitate Russia, which has a close intelligence relationship with Israel. The sources said Israel feared that granting Ukraine the ability to target Russia-based mobile phone numbers through Pegasus would be viewed as an act of aggression against Russian intelligence services.”

45. Panel: Hayden Centre — Director’s View: Russia & Ukraine

Following last week’s (story #64) panel discussion on the conflict between Russian and Ukraine from the US intelligence community perspective, organised by The Hayden Centre, this week a new 1.5-hour long session was published. The participants were the same: Retired General and former NSA and CIA Director Michael Hayden, 32-year CIA, ODNI and White House veteran Larry Pfeiffer, former CIA Director John Brennan, former CIA Deputy Director Michael Morell, retired Lieutenant General and DNI and DIA Director James Clapper, and former Secretary of Defence, CIA Director, and White House Chief of Staff, Leon Panetta.

46. Belarus Shuts Ukrainian Consulate in Brest on Espionage Charges

Following the expulsion of 12 Ukrainian diplomats from the Ukrainian Embassy in Minsk earlier this week (story #23), Belarusian Ministry of Foreign Affairs announced on March 23rd that Ukraine’s Consulate in the western city of Brest was ordered to shut down. This was done based on intelligence provided by the Belarusian Security Service (KGB) stating that half of the diplomatic mission’s personnel are “staff members of the Ukrainian Defense Ministry’s Main Intelligence Directorate” and that they have evidence that they are “involved in recruiting agents and collecting classified data.”

47. New Spy Technologies at ISDEF 2022 in Tel Aviv, Israel

On March 21–23 the 11th International Security & Defence (ISDEF 2022) event took place in Tel Aviv, Israel. ISDEF is Israel’s largest industry expo and among others there were multiple exhibitors showcasing new intelligence gathering technologies and capabilities (full list here). For example, Heven Drones, Will-Burt interception systems, PhaseOne iXM-GS120 ISR camera, MarisTech video/imaging systems, and others.

48. New Cyber Espionage Campaign by Chinese Nation-State Actor Targeting Diplomats, Telcos, Researchers in EU and Asian Countries

Alexandre Côté Cyr of ESET cyber security firm published a technical analysis for a previously unknown cyber espionage campaign that ESET detected and attributed it to a Chinese nation-state actor dubbed as “MUSTANG PANDA.” The campaign has been active at least since August 2021 and it was still ongoing at the time of the post. The new tailored-made software implant used was dubbed as “Hodur” and has advanced detection evasion and cyber espionage capabilities. The initial entry is done through phishing emails with lure documents with titles such as “Situation at the EU borders with Ukraine”, EU updates on COVID-19 travel restrictions, etc. If opened, “Hodur” software implant will be covertly installed giving the Chinese operators full control of the infected system. The confirmed targets were diplomatic missions, research entities and Internet Service Providers (ISPs) in Mongolia, Vietnam, Myanmar, Greece, Russia, Cyprus, South Sudan and South Africa.

49. Documentary: U-2: How the Legendary Spy Plane was Born

On March 23rd, The Cold War YouTube channel published a 21-minute long documentary on the history of the Lockheed U-2 Dragon Lady reconnaissance aircraft which was operated by the United States Central Intelligence Agency (CIA) during the Cold War era.

50. PLA-N Covert and Overt Spy Vessels in the Sulu Sea

On March 22nd, Rose De La Cruz published an article summarising how China’s People’s Liberation Army’s Naval (PLA-N) force has been using both conventional (like the 792 naval trawler) spy vessels as well as 220 civilian fishing vessels for covert intelligence gathering missions in the Sulu Sea, southwest of the Philippines. During the joint “Marine Exercise 2022” US-Philippines military exercise in late January — early February 2022, it was reported that a PLA-N 792 spy vessel was spotted collecting intelligence.

51. Australian Convict Dies in Iranian Prison, and British-American Convicted Spy Goes on Hunger Strike in Iran

According to BBC, an Australian of Iranian descent, Shokrollah Jebeli, 83, died in Tehran’s Evin Prison Hospital last Sunday. He was arrested in January 2020 on financial crime charges based on reports from Iran’s Ministry of Intelligence (MOIS) officials. According to The Guardian he was suffering from various medical conditions and was not provided the required healthcare services which led to his death. The second case is about British-American national of Iranian descent, Morad Tahbaz, 66, who went on hunger strike. Tahbaz was arrested in January 2018 and was later convicted to 10 years in prison on espionage charges as American spy.

52. German Intelligence Reports Russian GRU Espionage in Preparation for Sabotage Operations Against Critical Infrastructure

Julia Schöneseiffen of Merkur reported that according to German intelligence, Russia’s military intelligence (GRU) is conducting intelligence gathering operations with a likely target being the German Federal Network Agency (BNetzA), the agency responsible for the security of critical infrastructure in Germany. The article explicitly mentions sabotage operations targeting German critical infrastructure industries.

53. Swedish SÄPO Publishes Annual Intelligence Report

On Thursday, March 24th, Sweden’s Security Service (SÄPO) announced the release of its unclassified annual intelligence report. Unlike the previous years, this time it was published only in Swedish. It’s an 80-pages long report.

54. Webinar: Indra Air Solutions Surveillance Portofolio

The Spanish Indra Company published a 54-minute long webinar titled “Everything you always wanted to know about radars, but were afraid to ask” and covering some basic concepts of modern aerial surveillance systems, as well as the company’s Air Solutions surveillance portfolio.

55. NSA Announces WWII “American Dragon” Cryptologic Device Addition to the NCM’s Collection

On March 23rd, the United States National Security Agency (NSA) announced that the (believed to be the) only available “American Dragon” cryptologic device is now in part of the National Cryptologic Museum’s (NCM) collection. This device was constructed by “the Signal Security Agency (SSA) in 1944 to assist the British Colossus — a set of computers created by British codebreakers largely to break the German’s Schlusselzusatz SZ-40 cipher machine.” The rare device will be on display in NCM starting this summer.

56. Mapping of North Korea Cyber Actors to Government Agencies

Mandiant cyber security and intelligence firm published a short article which is mapping codenames industry uses for North Korean cyber actors with the actual government entities they belong to. As mentioned in Mandiant’s official Twitter account “North Korea has taken a page out of China’s cyber playbook to reorganize and consolidate its threat groups within the government — making them extremely mobile now that they’ve consolidated.”

57. New MSAB and Cellebrite CELLEX Promotional Videos

This week both the Swedish MSAB and the Israeli Cellebrite published new promotional videos for their Cellular phones Exploitation (CELLEX) capabilities. MSAB published a 2.5-minute long video on why the British law enforcement adopted their Frontline Solutions products, and Cellebrite released a 30-second clip featuring Corvallis Police Department, Oregon, US.

58. India’s NIA Counter-Intelligence Investigation at Four Locations

On Thursday, March 24th, it was announced that India’s National Investigation Agency (NIA) conducted searches in four locations in the states of Gujarat and Maharashtra in relation to a Pakistani espionage network. The case started in January 2020 when an espionage network of 20 people was dismantled. NIA said that Pakistani intelligence officers recruited individuals in Visakhapatnam, Mumbai, and Gujarat to gather sensitive information and conduct subversive actions on behalf of Pakistan. In the searches NIA seized evidence including digital devices, suspicious SIM cards, and incriminating documents. According to Telangana Today, the investigation was conducted by NIA’s Hyderabad unit, and the SIM cards were fraudulently procured. The communication with the Pakistani handlers was done using the WhatsApp messaging application. No further details were released.

59. Former Spanish King Accused of National Spy Agency Abuse

Former King Emeritus Juan Carlos I of Spain had issued an immunity claim which the UK High Court rejected on Thursday. There were multiple investigations against the former king, including one by Corinna zu Sayn-Wittgenstein-Sayn, a Danish businesswoman with whom the king had a five-year affair, who accused the former king of “getting members of Spain’s spy agency to break into her homes and, in one case, leave behind a book about Princess Diana’s death on her coffee table. She also asserts that they spied on her at her UK home, even drilling a hole into her bedroom window and shooting down her CCTV cameras.”

60. Video: OSINT Using Deep Learning Algorithm to Assess the Impact of the War in Ukraine

On March 22nd, submarine and naval warfare expert H.I. Sutton, published a 12-minute long video based on a deep learning algorithm developed by The Intel Lab, and how this combined with different Open-Source Intelligence (OSINT) sources and methods enables making accurate assessments, like measuring the impact of the conflict on shipping, in this example.

61. New Cyber Espionage Operation Targeting Russian Entities

The “Shadow Chaser Group” of the GcowSec team uncovered an active cyber espionage operation targeting entities in Russia and shared the technical indicators. The delivery was done via email and impersonating the electronic warfare department of the Kaluga Research Institute of Radio Engineering (КНИРТИ) through a lure document, pretending to be a list of sanctioned Russian entities from this organisation. If the target opens the attached file, they will get infected with a cyber espionage software implant. It is currently unknown who is the actor behind this operation.

62. FBI CD Uses Geo-Targeted Online Ads to Recruit Russian Spies Through Social Media

As reported by the Washington Post and the Independent, the Counter-intelligence Division (CD) of the FBI is using online geographically targeted advertisements to attract disgruntled Russian officials to work for the FBI as spies and informants. The geo-targeted ads were disseminated through Facebook, Twitter, and Google targeting individuals matching FBI’s criteria for potential disgruntled Russian officials. The screenshot published by the Washington Post guides Russian officials that the most effective way to combat threats is to provide information to the FBI, accompanied by a snapshot of Russian President Vladimir Putin openly challenging the Director of Russia’s Foreign Intelligence Service (SVR), Sergey Naryshkin.

63. Webinar: Cold War Tech: Spies, Cameras, and Incredible Images

On March 24th, the International Spy Museum together with the Pritzker Military Museum & Library (PMML) published an over 1-hour long webinar focusing on espionage technology developments over the years to capture images. The discussion is among International Spy Museum’s Historian & Curator, and former RAF Intelligence & Communications Branch Photographer, Dr. Andrew Hammond. Former CIA Chief of Disguise and International Spy Museum Advisory Board Member, Jonna Mendez. And PMML’s Chief Military Historian Dr. Matt Muehlbauer.

64. Chinese National Convicted in the US for Attempts to Fraudulently Obtain US Visas for Chinese Government Employees

The US Department of Justice released that Zhongsan Liu, 59, “participated in a scheme to fraudulently procure J-1 research scholar visas for employees of the government of the of the People’s Republic of China (PRC) to enable them to unlawfully work for the PRC government in the United States and to conceal that unlawful work from the United States and its agencies.” This took place in the period of 2017–2019 via a Chinese government office operated by Liu in Fort Lee, New Jersey. His office was part of the China Association for the International Exchange of Personnel (CAIEP). The case was handled by the FBI’s Counterintelligence Division.

65. Belarusian Cyber Espionage Operation Targeting Ukraine

On March 23rd, the Computer Emergency Response Team of Ukraine (CERT-UA) disclosed technical indicators of an ongoing cyber espionage operation targeting entities in Ukraine. The covert software implant was sent via email as a RAR-archive attachment titled “Saboteurs.rar” which, if opened, would install a commercially available software implant known as Cobalt Strike. CERT-UA attributes the operation to an actor dubbed as “GHOSTWRITER” who has been previously associated with a department of the Belarusian Ministry of Defense, based in Minsk.

66. Podcast: 4 New Podcasts by CIA Veteran Andrew Bustamante

This week former CIA case officer Andrew Bustamante published four short podcast episodes. The first was a 23-minute long podcast titled “A Deathtrap in Disguise” sharing a lesson he learned from a MARSOC Raider operator related to learning and growing while he was teaching driving using weight transfer . The second was a 10-minute long podcast titled “Find the Truth When Bad Info is Thrown at You” talking about filtering information when large amounts of information is thrown at you. The third was a 13.5-minute long podcast titled “Separate Real Facts from Slant and Fiction Every Time” talking about logical fallacies and cognitive biases. And the fourth was an 18-minute long episode titled “Fighting the 2 Pitfalls that Killed Modern Day Journalism” continuing in the same subject of controlling and vetting information, in this episode, he’s joined by his wife who is also a former CIA case officer.

67. How the Soviet Union Captured the US D-21B Spy Drone in 1969

Michael Peck published an article on the history of how the D-21B, a reconnaissance unmanned aircraft based on the SR-71 design, captured by the Soviet Union in 1969 and later exploited as part of the Voron (“Raven”) project for the development of a supersonic strategic reconnaissance drone.

68. Article on German Journalist Udo Ulfkotte Saying that the CIA and BND Were Using Journalists for Anti-Russia Propaganda

On Wednesday, March 23rd, B92 shared an article related to the life and death of German journalist Udo Ulfkott who died from a heart attack in 2017 at the age of 56. According to the article, he was an editor of the German Frankfurter Allgemeine Zeitung (FAZ) when he first learned about German journalists getting approached by the United States CIA and the German BND with bribes to “write anti-Russian and extremely pro-Western and pro-NATO articles.” He published several articles on this topic, including a book in 2014.

69. North Korean Cyber Espionage Operation Targeting US Organisations

Adam Weidemann of Google’s Threat Analysis Group (TAG) published a technical analysis of a cyber espionage operation TAG recently detected. The operation was running from as early as January 4, 2022 and it was targeting US based organisations in the sectors of news media, IT, cryptocurrency and fintech. The North Korean cyber operators exploited a vulnerability in Google Chrome web browser allowing them to get access to their targets without any need for user interaction apart from visiting the fake websites they had set up. Google TAG splits the operation to two parts. The first “targeted over 250 individuals working for 10 different news media, domain registrars, web hosting providers and software vendors” with fake recruitment websites in order to obtain covert access to those entities. The second activity “targeted over 85 users in cryptocurrency and fintech industries leveraging the same exploit kit” and this was likely to bring in currency to North Korea since it is suffering from economic sanctions that limit its cash flow.

70. SBU Publishes New Summary of Counter-Intelligence Activities

On March 24th, Ukraine’s Security Service (SBU) published a summary of recent counter-intelligence activities. In Odessa SBU blocked a covert GSM network with dozens of SIM cards used to send mass SMS messages with Russian Psychological Operations (PSYOP) content. In Kirovograd, a group was promoting Russian PSYOP content both online and offline by engaging with local influential persons, this was organised by a male with the handle “Futbolist” who, in February, fled to Rostov where he was recruited by Russia’s Federal Security Service (FSB). In Dnipropetrovsk, specifically in Kryvyi Rih, a Ukrainian national was arrested for selling small arms ammunition provided for free to the black market. In Lviv a citizen tried to bribe an SBU officer to avoid conscription service and was arrested. And in Vinnytsia, SBU detained a supporter of Donetsk People’s Republic (DNR) who openly praised and promoted Russian actions against Ukraine.

71. London’s “Special Forces Club” Ex-Spies’ Private Community

On Friday, March 25th, Intelligence Online published an article for a little known private members club of the United Kingdom known as the “Special Forces Club” or SFC. The club was formed in 1945 so that retired members of the British intelligence agencies and the Special Operations Executive (SOE) could discreetly meet, share their stories and continue their relationships after service. Nowadays this has been expanded to former members of the Special Air Service (SAS), Special Boat Service (SBS) and others from the British special operations and the intelligence community organisations.

72. Saudi Crown Prince Bragged About Obtaining Classified CIA Intelligence Products Used in “Corruption Crackdown”

According to Daily Mail, Mohammed bin Salman (MBS), Saudi Arabia’s Crown Prince bragged about classified United States Central Intelligence Agency (CIA) reports he received from the former Senior Advisor to the President of the United States, Jared Kushner. According to Daily Mail, days after MBS meeting with Kushner in Riyadh, Saudi Arabia, MBS initiated the “corruption crackdown” which ended up in torturing detainees, human rights abuses, even deaths, against hundreds including “princes from rival parts of the Saudi royal family and some of the country’s wealthiest businessmen.” According to Daily Mail, the CIA intelligence played a key role in targeting those individuals with a source saying that “Jared took a list out of names from US eavesdrops of people who were supposedly MBS’s enemies.” Kushner denied that he was the source of the classified intelligence products.

73. US DoJ Indicts 4 Russian FSB Spies for Critical Infrastructure Cyber Attacks and Espionage — UK Places More Sanctions

On Thursday, March 24th, the United States Department of Justice (DoJ) unsealed the indictments for four Russian officials involved in cyber espionage and cyber attack operations against critical infrastructure and other entities in the period of 2012–2018. The defendants are: 1) Evgeny Viktorovich Gladkikh, employee of a Russian Ministry of Defence research institute. 2) Pavel Aleksandrovich Akulov, officer at Russia’s Federal Security Service (FSB) in a Centre 16 operational unit. 3) Mikhail Mikhailovich Gavrilov, FSB officer in a Centre 16 operational unit. 4) Marat Valeryevich Tyukov, FSB officer in a Centre 16 operational unit. The FSB cyber operators were known in the cyber security industry under the codenames “DRAGONFLY”, “BERZERK BEAR”, “ENERGETIC BEAR”, and “CROUCHING YETI”. Following this, the UK government issued a public statement providing additional details on FSB’s cyber espionage and sabotage activities, as well as announcing new sanctions.

74. Botswana’s DIS Hangs Over Presidential Rivalry

On March 24, the Council on Foreign Relations (CFR) published a story about the latest developments on the tensions “between former President of Botswana Ian Khama and his chosen successor-turned-rival, current President Mokgweetsi Masisi.” According to the story, Botswana’s domestic intelligence agency, the Directorate of Intelligence & Security (DIS), established in 2008 by Ian Khama, was brought up as a controversial topic on how it might have be used to influence internal politics, and what should be done about it.

75. NYT COMINT Analysis on Russian Forces’ Struggles in Makariv

On Thursday, the New York Times (NYT) published a 9-minute long Communications Intelligence (COMINT) analysis based video with support from Open Source Intelligence (OSINT) communities, that indicates the challenges and struggles Russian troops faced in the battle of Makariv, a town outside Kiev, Ukraine.

76. FSB Arrested Ukrainian-Polish Spy Targeting Ukrainians Living in Moscow

With an official announcement Russia’s Federal Security Service (FSB) stated that they detained a Ukrainian Security Service (SBU) agent in Moscow as part of “Operation X” (Операция Х). The suspect, Andrei V. Rudas, has dual citizenship (Ukrainian and Polish) and was tasked by the SBU to identify and report Ukrainian political scientists and journalists living in Russia that do not support Ukraine’s positions. According to the FSB, his cryptonym was “Малыш” (Baby/Kid) and was detained along with incriminating evidence of his espionage activities. More recent official statements included that he was arrested as he was “trying to obtain data on military personnel participating in the operation of the Ministry of Defence of the Russian Federation in Ukraine.” He later confessed that he was previously recruited by Poland’s intelligence agency while studying at the War Studies Academy in Warsaw, Poland. The cryptonym Polish intelligence assigned to him was “Лис” (Fox) and he was tasked with providing information for students from Belarus and Ukraine. He’s now facing charges of up to 20 years in prison. On Saturday, March 26th, it was revealed that he had entered Russia as an illegal migrant last year and placed at a camp located in the 64th kilometer of Varshavskoye Highway, in the village of Sakharovo. Initially FSB asked for his deportation but it was later (last March) decided to reject FSB’s recommendation.

77. Authentic8 New Podcast and Promotional Videos Released

The US low-attribution products for professional Open Source Intelligence (OSINT) vendor Authentic8, released 3 new videos this week. A new 11-minute long podcast episode titled “minimizing researcher risk: where trust and safety meets OSINT” followed by two promotional videos. First, a 1.5-minute long video titled “grasping in-region context with appropriate egress and translation” and secondly, an 1-minute long video titled “Silo Training preview” with equivalent content.

78. CERT-UA Uncovers Cyber Espionage Campaign Impersonating Elon Musk on Facebook to Target Ukrainian Citizens

Ukraine’s Computer Emergency Response Team (CERT-UA) published technical details of a new cyber espionage operation. An actor had created a fake Facebook page impersonating entrepreneur and CEO of Tesla, Elon Musk and being promoted via Telegram channels in Ukraine. The page was leading to a fake website set up with Google Sites which was claiming that the visitor was the winner of a new Tesla car, along with pro-Ukraine comments about the ongoing conflict. If the user tries to claim their gift, they are asked to download and install a fake Armor VPN client mobile application which is then used for cyber espionage purposes such as tracking of movements and capture of the victim’s personal information. CERT-UA did not comment on the attribution.

79. FSB Detains Khabarovsk Resident Attempting to Digitally Transfer Classified Documents to Ukraine’s SBU

On Friday, March 25th, Russia’s Federal Security Service (FSB) announced that they detained a resident of Khabarovsk, Russia on espionage charges. According to the FSB, this was part of “Operation X” (Операция Х) — see also story #76. The male suspect had access to confidential information as part of his job and he tried to use the online channels set up by Ukraine’s Security Service (SBU) in an attempt to sell “secret data which could harm Russia’s security and help in carrying out sabotage actions.” FSB reportedly detained the suspect before the transfer of the classified material. Currently he faces charges of up to 20 years in prison for espionage.

80. Allegedly Turkish MİT Used Thugs to Assault Critic in Sweden

On March 22nd, the Nordic Monitor published an article for an assault against Turkish journalist Ahmet Dönmez who lives in Stockholm, Sweden and has been a critic of the Turkish government. Dönmez said that he had received threats from Turkish organised crime leader İhsan Hızarcı and reported them to the Swedish intelligence, but no action was taken to protect him. The article indicates that this was a government-backed covert action to intimidate the journalist with Turkey’s National Intelligence Organisation (MİT) using organised crime actors to execute the operation. That is, based on open threats that Turkish government officials have made over time for MİT to target, and even assassinate, those journalists as well as past cases.

80. NORTHCOM General: Most of Russia’s GRU Spies are in Mexico

On Friday, March 25th, General Glen VanHerck, Head of the United States Northern Command (NORTHCOM) said that Russia’s military intelligence agency (GRU) has most of their spies in Mexico in order to influence US decisions. Quoting General VanHerck, “the largest number of GRU in the world is in Mexico now, they are Russian intelligence personnel, and they pay close attention to opportunities to influence access to the United States.”

81. The 1950s KGB Portland Spy Ring and How They Stole Nuclear Secrets from Dorset, England

Liam Trim of DorsetLive published an article summarising the Cold Ware case of the Portland Spy Ring, how the Soviet KGB managed to steal nuclear submarine secrets from Dorset, UK, how the spy ring that operated from 1951 and until 1960 was disrupted, the 1964 spy swap, and more.

82. Podcast: Application of OSINT in Counter-Terrorism Intelligence

On March 24th Janes’ World of Intelligence published a new 40-minute long podcast episode on the topic of “the application of OSINT in the counter-terrorist role” featuring Don Rassler, Director of Strategic Initiatives at the Combating Terrorism Centre at the US Military Academy at West Point. The hosts of the podcast were Harry Kemsley, President of Government & National Security at Janes, together with British RAF retired Air Vice-Marshal Sean Corbett who is currently the CEO and Founder of IntSight Global Ltd.

83. Russian Spies in Belgium Lie Low Ahead of Biden Visit

On week 10 (story #73) there was an EU call for Belgium’s State Security Service (VSSE) to increase its anti-espionage measures due to increased Russian activity. This week, before US President Joe Biden’s arrival in Brussels, Belgium for a session of NATO, EU and G7 meetings, VSSE reported a decrease of Russian espionage activities. Quoting VSSE, “they are less active, they have become more cautious and observe a lot of security rules.”

84. Australian Journalist Faces Espionage Charges in China

On Friday, March 25th, it was announced that Australian journalist Chen Lei will face court in Beijing, China next Thursday. She was detained in 2020 and formally arrested in 2021 on allegations of using her profession as a cover to infiltrate Chinese officials circles and steal state secrets on behalf of the Australian government. She will be facing espionage charges in relation to illegally transferring of state secrets.

85. Turkish MİT New Crackdown Against 166 FETÖ-Linked People

According to Daily Sabah, prosecutors issued arrest warrants for 166 suspects in four separate investigations related to the Islamic movement of Fethullah Gülen (FETÖ) which is classified as a terrorist organisation in Turkey since it’s accused of being behind the failed military coup of July 2016. The operation was led by Turkey’s National Intelligence Organisation (MİT) which was tasked with finding the FETÖ members. According to Ahval the largest group involved 132 people that worked at the headquarters of the Gendarmerie General Command of the Turkish Armed Forces (TSK). The high-value targets of the group were the, so called, “secret imams” which are FETÖ’s handlers.

86. Podcast: CIA Covert Operations in Ukraine

On week 4 (story #18) and week 11 (story #51) it was revealed that CIA’s Special Activities Centre (SAC) has been conducting paramilitary operations in Ukraine since 2014 to covertly train local forces to fight with Russia. This week, the national security journalist that did most of the investigation behind this, Zach Dorfman, did a 2.5-hour long interview at The Team House covering several details about this CIA covert activity that, likely, had a real impact in the ongoing Russia-Ukraine war.

87. SBU Provides Summary of Counter-Intelligence Operations

Ukraine’s Security Service (SBU) published a new summary of the latest counter-intelligence activities of the agency. They reported “massive exposure” of Russian agents which has resulted in the detainment of over 350 people and killing of 20 DRG (Sabotage & Reconnaissance Group) members since the beginning of the war. They disrupted Russian recruitment channels for militants and agents from the Middle East. Some specific examples mentioned: In Kiev, SBU killed a group of DRG operatives disguised as Ukrainian Territorial Defence troops. Detained a group of Russian agents who were collecting intelligence on Ukrainian military units using commercial drones. In Zaporizhzhia SBU disrupted Russian agents trying to establish the “federalisation” of the occupied region. Lastly, 89 YouTube channels set up to disseminate Russian propaganda were reported and taken down.

88. Updates for India’s and Europe’s MALE Spy Drones

On March 25th, Janes published two articles about the Medium-Altitude Long-Endurance (MALE) Unmanned Aerial Vehicles (UAVs) of India and the European Union. The first article presents India’s new Rustom II MALE UAV which can (based on the public/unclassified technical specs) reach 28,000 feet and operate continuously for more than 18 hours. This UAV has overall length of 9.5 metres, wingspan of 20.6 metres, it weighs 1,800 kg and is powered by two Saturn 36T turboprop engines, each rated at 74.57kW (100 hp). It is also known as TAPAS-BH-201 (Tactical Advanced Platform for Aerial Surveillance-Beyond Horizon 201). The second article was about Airbus’ Eurodrone MALE UAV which will be powered by the Italian Catalyst propulsion system of Avio Aero.

89. Podcast: The Nuclear Doomsday Machine

On 22 March, International Spy Museum’s SpyCast released a new one hour long podcast episode titled “The Nuclear Doomsday Machine” and featuring Sean Maloney, Professor at the Royal Military College of Canada and an Afghanistan war veteran. The host of the podcast was International Spy Museum’s Historian & Curator, and former RAF Intelligence & Communications Branch Photographer, Dr. Andrew Hammond. The episode is about the top secret emergency war plans for WWIII, the role of human intelligence operations in nuclear doomsday planning, some key terms you need to understand the nuclear issue, the policy of “massive retaliation” versus “flexible response” as well as reflections on the subject.

90. NGA Announces FlipBoard for GEOINT News

The United States National Geospatial-intelligence Agency (NGA) announced the creation of its FlipBoard where they will be highlighting the latest “national security, defense and GEOINT news.” The FlipBoard is split to two magazines. The NGA Pathfinder and the Understand The World.

91. New Zealand’s Spy Agencies Uncover Foreign Spy — Release of Annual NZSIS and GCSB Intelligence Reports

On March 22nd, Marc Daalder of the Newsroom published a story based on the declassified annual intelligence reports of the New Zealand Security Intelligence Service (NZSIS) and the Government Communications Security Bureau (GCSB). According to those “the individual uses various public and covert means to collect information on individuals, some of which is likely passed back to the foreign state’s intelligence agency. The NZSIS is seeking to understand the nature of these activities and the interference threat posed by the individual against New Zealand.” You can find the reports released last Monday as NZSIS’s “Annual Report 2021” and GCSB’s “Annual Report 2021”.

92. Estonian Intelligence Warns of Increased Recruitment of Agents Before a Possible Russian Attack

According to The Times, the Estonian intelligence is concerned, as shared by Estonia’s Minister of Interior, over the significant increase of Russian intelligence efforts to influence as well as recruit agents inside Estonia. According to the story “unwitting citizens could be turned into spies working for the Russians inside the country to escalate tensions, destabilise a protest, take photographs of military infrastructure or even gather intelligence on the British-led Nato mission in the country, which has now doubled in size.” The article highlights that this increased activity could indicate Russian tactical preparations for attacking Estonia.

93. Finland Reports Russian Espionage Relating to NATO

On Saturday, March 26th, the Finnish news agency YLE published a story detailing that Finland’s relationship with NATO is of high interest to Russia’s military intelligence (GRU), and as the diplomatic relations are strained, there is increased espionage activity to collect intelligence on those developments. Pertti Haaksluoto, Head of Supo’s counter-intelligence unit, said that “Finland’s foreign and security policy decision-making and relations with NATO have always been the subject of Russian intelligence and influence. Due to the situation in Ukraine, this has been emphasised.” Haaksluoto described the the most common method observed is Human Intelligence (HUMINT) recruitment starting as a natural meeting with the target, developing a friendship, building trust (some times even for years), start requesting information from seemingly unimportant ones, and moving to more sensitive ones. Formally, signing the target as a GRU agent.

94. HawkEye 360 Announces Launch of New Spy Satellites Cluster

On March 25th, HawkEye 360 released a one minute long video announcing the next-generation satellites (known as Cluster 4 and 5) upcoming launch from Cape Canaveral, Florida, US. The launch will take place in the coming month and will result in the addition of six new spy satellites which “will produce twice the data over the current constellation, doubling the insights we deliver to customers.”

95. Swedish Intelligence Assesses the Threat of Expelling Russian Diplomats from Sweden

Swedish newspaper Expressen published an ongoing debate inside the Swedish government between the political leadership and country’s counter-intelligence agency, Säpo. According to Säpo, about 30% of the Russian diplomatic mission in the embassy in Stockholm are known to be related to espionage activities, but their expulsion poses a threat in both political and national security, as the counter-intelligence already knows and monitors those spies and their activities in Sweden.

96. Russian Pandemic Aid Team in Italy Might Have Been a Covert Spying Team Targeting a US Military Base

The Associated Press published a news story relating to a medical aid team that Russia sent to help Italy with the pandemic in March 2020. This week former Prime Minister of Italy, Giuseppe Conte was summoned by an Italian Parliament committee that deals with intelligence matters for a potential espionage case. The Russian mission included around 100 military and medical professionals. The initial Russian offer was for 400 personnel but Italy’s Defence Minister, Lorenzo Guerini, objected. The investigation that is ongoing revealed some “aggressive behaviour” by the Russian mission personnel who were operating around 50 km from a US military base in northern Italy. When Russia volunteered for a similar mission to the South, Defence Minister Guerini declined it. Currently, there is an investigation on whether or not the Russian mission was clandestinely conducting espionage activities related to NATO and the US military base located nearby.

97. Belarusian KGB Detains Polish Citizen on Espionage Charges

On March 25th, it was announced that the State Security Service of Belarus (KGB) detained a Polish citizen in the city of Grodno on espionage charges. According to the KGB, during an investigation at the suspect’s house they discovered incriminating evidence. KGB implied that the detainee was in touch with diplomats from the Polish embassy in Belarus.

98. Podcast: Secrets & Spies — Bio Labs Chemical Weapons and Nukes

This week, the Secrets & Spies podcast series published a 48-minute long episode featuring Dan Kaszeta, retired US Army Chemical Corps officer and chemical, biological, and radiological weapons and warfare expert. He is talking about his 2020 book “Toxic: A History of Nerve Agents, from Nazi Germany to Putin’s Russia” as well as the recent developments and espionage cases related to chemical weapons in the Russia-Ukraine conflict.

99. Nigerian Police Released Woman Convicted as IPOB Spy in 2021

On March 23rd, it was announced that the Nigerian police released Gloria Okolie after fulfilling her bail conditions. Okolie was arrested on June 16, 2021 on espionage charges for the Nigerian separatist organisation Indigenous People of Biafra (IPOB). In November 2021 the court granted her bail in the sum of N10 million with two sureties. In the arrest statement she was accused of being a spy of the Eastern Security Network (ESN) of IPOB and participating in the “series of deliberate and well-coordinated attacks on security formations, other critical national infrastructure including INEC offices and killing of security operatives in the South-Eastern part of the country.”

100. Former Turkish MİT Officer Held in Solitary Confinement for Nearly 5 Years

The Turkish Minute reported that Enver Altaylı, 78 year old former National Intelligence Organisation (MİT) senior intelligence officer with alleged links to FETÖ, has been held in solitary confinement for 55 consecutive months as a “dangerous inmate.” Altaylı was arrested in 2017 and sentenced to 13 years in prison in November 2021 for espionage charges and participation in FETÖ (note that FETÖ is classified as a terrorist organisation in Turkey). The indictment stated that he was in “contact with a number of CIA officials and corresponded with them on social media about political developments in Turkey and gave them reports on the same.” According to the news report, he is a “well-known figure in the country’s recent history who worked closely with former presidents Süleyman Demirel and Turgut Özal.” His lawyer and daughter, Dilara Yılmaz, said that “they may keep him in solitary confinement because his views are found to be dangerous or to intimidate or punish him.”

101. Romanian SRI 32nd Anniversary — Declassification of 2017 Film

This Saturday, March 26, Romania’s Intelligence Service (SRI) celebrated its 32nd anniversary (1990–2022) and part of that included the declassification and release of a 5.5-minute long film about Russian intelligence operations that the SRI produced 5 years ago (in 2017) and shared it with the international intelligence community. Due to its intended audience, the video was in English with Romanian subtitles.

102. North Korean Cyber Espionage Campaigns Impersonating Defence Industry

During this week, Cyber Threat Intelligence (CTI) research Jazi disclosed an ongoing cyber espionage operation attributed to an actor dubbed as “Lazarus” who has been previously associated with the intelligence apparatus of North Korea. The first case was impersonating a job advertisement from Airbus but it was actually a lure document to covertly install a cyber espionage software implant. The second case was using a different lure document, this time impersonating a job listing from General Dynamics Electric Boat. As highlighted by the researcher, in January 26th, the same cyber actors used a similar lure document but impersonating a job position from Lockheed Martin. This could be related, or the same, as the one reported in story #69.

103. Webinar: International Spy Museum — The Real Harriet Tubman

The International Spy Museum published a 57-minute long presentation titled “The Real Harriet Tubman” for the 200th anniversary year of Harriet Tubman’s birth. This is presented by the American historian and Harriet Tubman scholar, Dr. Kate Clifford Larson. As the description says “Tubman is revered for leading her family members and many other enslaved people North to freedom at great personal risk during the American Civil War, but her work as a Union spy and military commander is less well known” and it is what is covered in this session.

104. US FCC Adds Kaspersky to its Covered List of Risks to National Security

Following week 11’s (story #30) concerns of Germany’s BSI and Italy’s NCA on how Russian cyber security firm Kaspersky could be intentionally or unintentionally abused by the Russian intelligence agencies for espionage or sabotage purposes, this week the United States Federal Communications Commission (FCC) added Kaspersky to its “Covered List” stating that it poses unacceptable risks to US national security and that it will help the US be more secure against “entities seeking to engage in espionage and otherwise harm America’s interests.”

105. House Armed Services Committee Looking into Allegations of Inappropriate Online Behaviour in the US Intelligence Community

Following the week 10 (story #76) revelations of inappropriate online behaviour in the internal communications platforms of the US intelligence community, the House Armed Services Committee announced that they are “aware of these allegations” and “working with the relevant agencies to assess the claim.”

106. Why it Was Difficult for the CIA to Operate Covertly in Moscow During the Cold War

On March 25th, Nikolay Shevchenko of Russia Beyond published a short article discussing the challenges the US Central Intelligence Agency (CIA) faced in Moscow during the Cold War era. Something that led to the development of the, so called, “Moscow Rules” within the US Agency.

107. Webinar: GSAT-7B & India’s Military Satellites

On March 26th, YouTube channel BYJU’S IAS published an 11-minute long video presentation discussing India’s military satellite program history, development, and focusing on the GSAT 7 series of advanced military satellites developed by the Indian Space Research Organisation (ISRO). Although their main mission is secure communications, the presentation also briefly touches on India’s intelligence gathering satellite capabilities.

108. SBU Summary of Counter-Intelligence Activities for Saturday

Ukraine’s Security Service (SBU) published a summary of completed counter-intelligence activities from Saturday, March 26th. Those were: Detainment of a man in Kharkiv who was coordinating covert sabotage groups. In Odessa, SBU together with Moldova’s Security and Intelligence Service (SIS) disrupted a smuggling network that Ukrainian conscripts were using to escape the mandatory military service. SBU detained an individual in Dnipro who “collected data on employees of critical infrastructure in Dnieper, their political orientation and level of loyalty to Russia.” In Poltava, SBU discovered an individual operating digital infrastructure used to disseminate pro-Russia content and blocked it. And lastly, in the city of Ivano-Frankivsk SBU detained a Ukrainian national for distributing pro-Russia content on social media and was also found that he had sent a photo of the rocket attack on the Ivano-Frankivsk Airport to a Russian number right after the attack.

109. Podcast: 9/11 and Beyond

On March 26th, the SpyCraft 101 YouTube channel published a new 58-minute long podcast titled “9/11 and Beyond” featuring Toby Harnden, accomplished author and veteran foreign correspondent. The podcast is mainly focused around his latest book titled “First Casualty: The Untold Story of the CIA Mission to Avenge 9/11.”

110. OSINT-Discovered ELINT/SIGINT Flights

This is a brief summary of ELINT/SIGINT/ISR flights identified by aviation enthusiasts during this week:

• 20MAR2022: Summary of at least 7 ISR flights from the US and Sweden near Ukraine. Source
• 20MAR2022: US Air Force RQ-4B Global Hawk (10–2045, callsign FORTE11) flight from Naval Air Station Sigonella to the Black Sea near the Ukraine-Russia border. Source
• 20MAR2022: US Air Force Lockheed EP-3E Orion (16–1410, callsign QW52) flight from Chania, Greece to Romania-Moldova border. Source
• 20MAR2022: RAF Joint Special Forces Aviation Wing Beechcraft Super King Air 350 (ZZ419, callsign RRR7419) flight from Belfast International Airport, Ireland with racetrack pattern nearby, then ISR near RAF Coningsby, landing in Humberside Airport, and return back to Ireland. Source
• 20MAR2022: Swedish Air Force Gulfstream IV SP S102B Korpen (102002, callsign SVF622) flight from Malmen Airbase to over the Gulf of Gdansk and Kaliningrad. Source
• 20MAR2022: Qatar Air Force Bayraktar TB2 (QA601, callsign N/A) flight from the Al-Shamal UAV base to ISR pattern the Al Dayeen Coast Guard Station. Source
• 20MAR2022: US Army Beech RC-12X Guardrail (91–00516, callsign YANK01) and (88–00325, callsign YANK02) flight from Šiauliai Air Base in Lithuania, to the borders with Kaliningrad. Source
• 20MAR2022: NATO AEW&C Boeing E-3 Sentry (LX-N90450, callsign NATO12) flight near Ukraine border. Source
• 20MAR2022: Diamond Executive Aviation (DEA) Special Mission Beech 90 King Air (G-WKTS, WKT14) flight from Birmingham Airport to ISR flights along the Cardigan Bay cities and back. Source
• 20MAR2022: US Air Force U-2S Dragon Lady (1080, callsign N/A) returned to RAF Fairford — Likely in Senior Span SIGINT configuration. Source
• 21MAR2022: Swedish Air Force Gulfstream IV SP S102B Korpen (102002, callsign SVF622) flight from Malmen Airbase to over the Gulf of Gdansk and Kaliningrad. Source
• 21MAR2022: French Air Force Transall C-160G Gabriel (F216, callsign HOOPA21) flight over Romania. Source
• 21MAR2022: NATO AEW&C Boeing E-3 Sentry (LX-N90450, callsign NATO11) flight over Poland-Ukraine border. Source
• 21MAR2022: RAF Boeing RC-135W River Joint (ZZ664, callsign RRR7229) flight from RAF Waddington to Poland. Source
• 21MAR2022: US Air Force RC-135W Rivet Joint (62–4130, callsign JAKE11) flight from RAF Mildenhall, UK to Poland-Ukraine border. Source
• 21MAR2022: US Air Force Northrop Grumman E-8C J-STARS (95–0121, callsign REDEYE6) flight from Ramstein Air Base, Germany to Poland near the Ukraine border. Source
• 21MAR2022: US Navy Boeing P8 Poseidon (AE6793, callsign N/A) flight on East Mediterranean. Source
• 21MAR2022: US Navy Boeing P8 Poseidon (AE679B, callsign N/A) flight from RAF Lossiemouth, UK to the North Sea. Source1 Source2
• 21MAR2022: US Air Force Boeing RC-135U Combat Sent (64–14849, JAKE31) flight from RAF Mildenhall to near Murmansk, Russia. Source1 Source2
• 21MAR2022: US Air Force RQ-4B Global Hawk (09–2039, callsign FORTE10) flight from Naval Air Station Sigonella to the Black Sea near the Ukraine-Russia border. Source
• 21MAR2022: Acrobat Ltd Special Mission Diamond DA-42-MPP Guardian (G-DOSC, callsign GDOSC) flight from Bournemouth Airport to ISR near Blandford Forum, Lyme Bay, Bovey Tracey, Exeter (and landing there and later taking of), ISR near Frome and Salisbury and back to Bournemouth Airport, UK. Source
• 21MAR2022: Acrobat Ltd Special Mission Diamond DA-42 Guardian (G-DOSB, callsign ETP81) flight from MoD Boscombe Down military airport to ISR near Salisbury, southwest of Salisbury and back. Source
• 21MAR2022: German Navy Lockheed P-3C Orion (60+04, callsign GNY4520) from the Nordholz Naval Airbase, Germany to flight near Kaliningrad. Source
• 21MAR2022: US Army Beech RC-12X Guardrail (91–00516, callsign YANK01) and (88–00325, callsign YANK02) flight from Šiauliai Air Base in Lithuania, to the borders with Kaliningrad. Source
• 21MAR2022: US Air Force Lockheed EP-3E Orion (16–1410, callsign QW52) flight from Chania, Greece to Romania-Moldova border. Source
• 21MAR2022: US Air Force RQ-4B Global Hawk (10–2045, callsign FORTE11) flight from Naval Air Station Sigonella to the Black Sea near the Ukraine-Russia border. Source1 Source2
• 21MAR2022: U.S. Navy EP-3E ARIES II (16–1410, callsign MN806) flight near the coast of Dubai, UAE. Source
• 21MAR2022: Turkish Bayraktar TB2 (reg. number N/A, callsign TB2T253) on test flight in the test site of Keşan, Turkey. Source
• 22MAR2022: Summary of at least 13 ISR flights from the US, UK, Italy, and Sweden near Ukraine. Source
• 22MAR2022: US Air Force RC-135V Rivet Joint (64–14844, callsign JAKE12) flight from RAF Mildenhall, UK to Poland-Ukraine border. Source
• 22MAR2022: RAF Boeing RC-135W River Joint (ZZ664, callsign RRR7228) flight from RAF Waddington to Poland. Source1 Source2
• 22MAR2022: Qatar Air Force Bayraktar TB2 (QA601, callsign N/A) flight from the Al-Shamal UAV base to ISR pattern across Khor and Shamal. Source
• 22MAR2022: Swedish Air Force Gulfstream IV SP S102B Korpen (102002, callsign SVF622) flight from Malmen Airbase to over the Gulf of Gdansk and Kaliningrad. Source1 Source2
• 22MAR2022: Swedish Air Force AEW&C Saab S100D Argus (100004, callsign SVF604) flight from Malmen Airbase to Kaliningrad. Source
• 22MAR2022: German Navy Lockheed P-3C Orion (60+04, callsign GNY4500) from the Nordholz Naval Airbase, Germany to flight near Kaliningrad. Source
• 22MAR2022: US Army Beech RC-12X Guardrail (91–00516, callsign YANK01) and (88–00325, callsign YANK02) flight from Šiauliai Air Base in Lithuania, to the borders with Kaliningrad. Source
• 22MAR2022: Italian Air Force Gulfstream C-37B (MM62303, callsign PERSEO71) flight from Rome–Fiumicino International Airport, Italy to Romania-Moldova border. Source
• 22MAR2022: US Air Force RQ-4B Global Hawk (09–2039, callsign FORTE10) flight from Naval Air Station Sigonella to the Black Sea near the Ukraine-Russia border. Source
• 22MAR2022: NATO AGS RQ-4D Phoenix (MM-AV-SA0015, UAVGH000) flight from Naval Air Station Sigonella to the Black Sea. Source
• 22MAR2022: NATO AEW&C Boeing E-3 Sentry (LX-N90454, callsign NATO01) flight over Poland-Ukraine border. Source
• 22MAR2022: US Air Force Lockheed EC-130H Compass Call (73–1581, callsign AXIS41) flight from Souda Bay, Crete, Greece. Source
• 22MAR2022: US Air Force Boeing RC-135V Rivet Joint (64–14843, callsign N/A) flight near Taiwan. Source1 Source2
• 22MAR2022: Turkish Bayraktar TB2 (reg. number N/A, callsign TB21915) on flight out of Keşan, Turkey. Source
• 22MAR2022: Turkish Bayraktar TB2 (reg. number N/A, callsign TB2T252) on test flight in the test site of Keşan, Turkey. Source
• 22MAR2022: Turkish Bayraktar TB2 (reg. number N/A, callsign TB2T254) on test flight in the test site of Keşan, Turkey. Source
• 22MAR2022: Turkish Bayraktar TB2 (reg. number N/A, callsign TB2T255) on test flight in the test site of Keşan, Turkey. Source
• 22MAR2022: US Air Force Lockheed EP-3E Orion (160764, callsign LM36) flight from Chania, Greece to Romania-Moldova border. Source1 Source2
• 22MAR2022: NATO AGS RQ-4D Phoenix (MM-AV-SA0015, UAVGH000) flight from Naval Air Station Sigonella to the Black Sea. Source
• 22MAR2022: US Navy Northrop Grumman MQ-4C Triton (AE5C76, callsign N/A) flight near Taiwan. Source
• 23MAR2022: Summary of at least 10 ISR flights from the US, France, and Sweden near Ukraine. Source
• 23MAR2022: U.S. Navy EP-3E ARIES II (16–1410, callsign MN806) flight near the coast of Dubai, UAE. Source
• 23MAR2022: US Air Force RQ-4B Global Hawk (10–2045, callsign FORTE11) flight from Naval Air Station Sigonella to the Black Sea near the Ukraine-Russia border. Source
• 23MAR2022: US Air Force Boeing RC-135S Cobra Ball (61–2661, callsign BLIMY62) flight from Kadena Air Base, Japan en route to the Japan Sea. Source
• 23MAR2022: Swedish Air Force Gulfstream IV SP S102B Korpen (102002, callsign SVF622) flight from Malmen Airbase to over the Gulf of Gdansk and Kaliningrad. Source1 Source2
• 23MAR2022: Swedish Air Force AEW&C Saab S100D Argus (100004, callsign SVF604) flight from Malmen Airbase to Kaliningrad. Source
• 23MAR2022: US Navy Boeing P8 Poseidon (AE67AE, callsign N/A) flight from Keflavik, Iceland heading to Murmansk/Kola Peninsula, Russia. Source
• 23MAR2022: Qatar Air Force Bayraktar TB2 (QA604, callsign N/A) flight from the Al-Shamal UAV base to ISR pattern across Khor and Shamal. Source
• 23MAR2022: Russian Air Force Beriev A-50U AEW&C seen in the Baranovichi Air Base in Belarus. Source
• 23MAR2022: US Air Force Boeing RC-135U Combat Sent (64–14849, JAKE31) flight from RAF Mildenhall to near Kaliningrad. Source
• 23MAR2022: US Air Force RC-135W Rivet Joint (62–4130, callsign JAKE11) flight from RAF Mildenhall, UK to Poland-Ukraine border. Source
• 23MAR2022: US Army Beech RC-12X Guardrail (91–00516, callsign YANK01) and (88–00325, callsign YANK02) flight from Šiauliai Air Base in Lithuania, to the borders with Kaliningrad. Source1 Source2
• 23MAR2022: Skyborne Aviation Diamond Special Mission DA-42-MPP (GSADB, SYF57) flight from Gloucestershire Airport to ISR near Cheltenham, Worcester, across the Bristol Channel until Axbridge and back. Source
• 23MAR2022: US Air Force Northrop Grumman E-8C J-STARS (95–0121, callsign REDEYE6) flight from Ramstein Air Base, Germany to Poland near the Ukraine border. Source
• 23MAR2022: Diamond Executive Aviation (DEA) Special Mission Beech 90 King Air (G-WKTO, WKT37) flight from Birmingham Airport to ISR flight near the port of Dublin, Ireland and back. Source
• 23MAR2022: RAF Joint Special Forces Aviation Wing Beechcraft Super King Air 350 (ZZ419, callsign RRR7419) flight from Belfast International Airport, Ireland to Bristol Airport, then ISR near RNAS Yeovilton, landing in Bournemouth Airport, UK. Source
• 23MAR2022: French Air Force Transall C-160G Gabriel (F216, callsign HOOPA21) flight over Romania. Source
• 24MAR2022: Summary of at least 8 ISR flights from the US, Sweden and UK near Ukraine. Source
• 24MAR2022: NATO AGS RQ-4D Phoenix (MM-AV-SA0018, UAVGH000) flight from Naval Air Station Sigonella to the Black Sea. Source
• 24MAR2022: US Navy Boeing P8 Poseidon (AE689B, callsign N/A) flight near Taiwan. Source
• 24MAR2022: US Air Force Boeing RC-135W Rivet Joint (62–4131, callsign HOMER41) flight from Souda Bay, Crete, Greece heading North. Source1 Source2
• 24MAR2022: French Air Force Transall C-160G Gabriel (F216, callsign HOOPA21) flight over Romania. Source
• 24MAR2022: Qatar Air Force Bayraktar TB2 (QA605, callsign N/A) flight from the Al-Shamal UAV base to ISR pattern over Suwayhiliyah. Source
• 24MAR2022: RAF Boeing RC-135W River Joint (ZZ664, callsign RRR7230) flight from RAF Waddington to Poland. Source
• 24MAR2022: US Army Beech RC-12X Guardrail (91–00516, callsign YANK01) and (88–00325, callsign YANK02) flight from Šiauliai Air Base in Lithuania, to the borders with Kaliningrad. Source
• 24MAR2022: RAF Boeing Poseidon MR1 (ZP809, callsign HOOVR26) flight over the Barents Sea. Source
• 24MAR2022: Turkish Bayraktar TB2 (reg. number N/A, callsign BYKR01) and (reg. number N/A, callsign BYKR03) on test flight in the test site of Keşan, Turkey. Source1 Source2
• 24MAR2022: US Air Force Boeing RC-135V Rivet Joint (64–14844, callsign JAKE12) flight from RAF Mildenhall to Poland. Source
• 24MAR2022: US Air Force Boeing RC-135U Combat Sent (64–14849, JAKE31) flight from RAF Mildenhall to near Kaliningrad. Source
• 25MAR2022: Swedish Air Force Gulfstream IV SP S102B Korpen (102002, callsign SVF622) flight from Malmen Airbase to over the Gulf of Gdansk and Kaliningrad. Source
• 25MAR2022: US Air Force Lockheed EP-3E Aries II Orion (16–0764, callsign LA59) flight from Chania, Greece to Romania-Moldova border. Source
• 25MAR2022: Italian Air Force Gulfstream C-37B (MM62293, callsign IAM1496) flight from Rome–Fiumicino International Airport, Italy to Poland. Source
• 25MAR2022: US Navy P8 Poseidon (AE6834, callsign N/A) orbiting South of Create, Greece. Source
• 25MAR2022: US Air Force Northrop Grumman E-8C J-STARS (95–0121, callsign REDEYE6) flight from Ramstein Air Base, Germany to Poland near the Ukraine border. Source
• 25MAR2022: US Air Force Boeing RC-135W Rivet Joint (62–4131, callsign HOMER51) flight from Souda Bay, Crete, Greece heading North. Source
• 25MAR2022: RAF Boeing RC-135W River Joint (ZZ664, callsign RRR7245) flight from RAF Waddington to Poland. Source1 Source2
• 26MAR2022: Summary of at least 6 ISR flights from the US, Sweden and France near Ukraine. Source
• 26MAR2022: US Air Force Boeing RC-135W Rivet Joint (62–4131, callsign HOMER61) flight from Souda Bay, Crete, Greece heading North. Source
• 26MAR2022: Swedish Air Force Gulfstream IV SP S102B Korpen (102002, callsign SVF622) flight from Malmen Airbase to near Belarus and Ukraine. Source
• 26MAR2022: US Army Beech RC-12X Guardrail (91–00516, callsign YANK01) and (88–00325, callsign YANK02) flight from Šiauliai Air Base in Lithuania, to the borders with Kaliningrad. Source
• 26MAR2022: French Air Force Transall C-160G Gabriel (F216, callsign HOOPA21) flight from Henri Coandă International Airport to over Romania. Source
• 26MAR2022: US Army Challenger 650 ARTEMIS (N488CR, callsign: BRIO68) from Mihail Kogălniceanu International Airport, Romania to the border of Belarus. Source
• 26MAR2022: Turkish Army Bayraktar TB2 (reg. number N/A, callsign TCS029) flight from Keşan Airport, Turkey and patrolling the entire length of Greece-Turkey border. Source
• 26MAR2022: US Army Challenger 650 ARTEMIS (N488CR, callsign: BRIO68) from Mihail Kogălniceanu International Airport, Romania to the Glasgow Prestwick Airport, UK and landed at the Manassas Regional Airport, Virginia, US. Source