SPY NEWS: 2022 — Week 5

Summary of the espionage-related news stories for the Week 5 (1–6 February) of 2022.

1. Dutch Police Reopens Investigation Over Death of Retired MIVD Intelligence Officer

Last year retired Dutch Military Intelligence and Security Service (MIVD) officer Hans van de Ven, an expert on wiretapping techniques, was found dead in his home, initially considered to be from natural causes. On February 1st, news appeared that the Public Prosecution Service of Amsterdam exhumed his body and re-started the investigation due to gaps identified in the original assessment. According to AD news outlet, investigation may also involve assessing the poisoning scenario.

2. FBI Director on Chinese Espionage Threat to the United States

On Tuesday, February 1st, FBI published a news story from its Director, Christopher Wray, who gave a speech at the Ronald Reagan Presidential Library and Museum in Simi Valley, California, on January 31, 2022. The talk was detailing the vast amount of threats the Chinese government poses to the United States, extensively covering espionage topics and stating that China “uses every available resource to try to steal it” referring to economic and industrial espionage.

3. Iranian Cyber-Espionage Actor Linked with Memento Ransomware

Cyber-security firm Cyber Reason published an analysis of new technical capabilities of an Iranian nation-state sponsored actor dubbed as “PHOSPHORUS.” Among others, the researchers also identified links between this actor and a ransomware that first appeared in 2021, called “Memento.”

4. United Nations Report Taliban Have Executed Over 100 Former Security/Intelligence Personnel

On February 1st, J. Fitsanakis of Intel News published a news story based on a recent United Nations Security Council (UNSC) confidential report. According to the UNSC report, over 100 former Afghan government members have been executed by the Taliban, the majority being from the security forces and Afghans working with foreign intelligence and military entities that were operating in Afghanistan.

5. Ukraine’s SBU Released 2021 Counter-Intelligence Operations Statistics

On February 1st Ukraine’s Security Service (SBU) did a press release on counter-intelligence operations of 2021. Numbers included 130 criminal proceedings for espionage-related crimes, exposing 17 spies operating under diplomatic cover, detaining over 20 agents of Russia’s intelligence agencies, and more. The press release names a few specific cases per region too. This was followed up, the next day, with another similar press release on successful military counter-intelligence operations executed in 2021 by the SBU.

6. Iran’s MOIS Conducts Cyber-Espionage Operations Targeting Turkish Government and Private Entities

Bleeping Computer reported (based on Cisco Talos Intelligence Group’s research) a new cyber-espionage campaign targeting Turkish public and private sector entities. The campaign was attributed to a nation-state actor dubbed as “MUDDYWATER” which was, in January 2022, officially linked with Iran’s Ministry of Intelligence (MOIS) by the Cyber National Mission Force of the U.S. Cyber Command (CYBERCOM).

7. Russian National Arrested in Sweden in Relation to Illegal Drone Flights

Brett Tingley of The Warzone published a news story on a development after the recent drone flights over restricted locations in Sweden which is investigated by the Swedish Security Service (Säpo). A Russian national was arrested for flying a drone over the Royal Palace. Reporting is unclear with the detained individual stating he is a tourist, and Swedish authorities stating he was violating Sweden’s Protective Security Act which relates to “espionage, sabotage, terrorist offences and other crimes that might threaten their operations.” A police spokesperson stated on Sverige Radio that the Russian is suspected of “unauthorised access to protected objects.’’

8. Update on Rajeev Sharma’s Espionage Case Against India

On February 2nd, the Delhi High Court dismissed the plea of journalist Rajeev Sharma who was arrested in September of 2020 along with his handler, Qing Shi (32) — she was associated with China’s main intelligence agency, the Ministry of State Security (MSS), along with her Nepali associate, Sher Singh (32) who used the alias Raj Bohra. R. Sharma was covering defence and foreign affairs and was, reportedly, recruited by the MSS as an agent in 2010.

9. Ongoing Intelligence Community Crisis in Denmark

On Wednesday, February 2, SIGINT/COMSEC researcher “Electro Spaces” published a detailed blog post on the recent arrest of Lars Findsen, former Head of the Danish Defence Intelligence Service (DDIS, or FE in Danish). The post discusses the intelligence crisis in Denmark which also led to criminal charges against the former Minister of Defence, Claus Hjort Frederiksen, the Operation Dunhammer, and more.

10. FBI Confirmed the Evaluation of NSO Group’s Phantom in 2019

New York Times (NYT) and the Washington Post released stories confirming that the U.S. Federal Bureau of Investigation (FBI) purchased cyber products from the Israeli NSO Group in 2019 with costs going up to $5 million. According to the reports, NSO Group’s main mobile software implant (called Pegasus) does not allow covert surveillance of U.S. mobile phone numbers, so the company created a new version, named Phantom, for the FBI to use. According to NYT, NSO Group presented Phantom to the FBI in 2019 demonstrating that it “could hack any number in the United States that the F.B.I. decided to target.”

11. PTM Chairman Manzoor Pashteen Reports that Pakistani ISI Attacked Activists

On February 2nd, Pakistani human rights activist and chairman of the Pashtun Tahafuz Movement (PTM), Manzoor Pashteen, publicly stated that Pakistan’s Inter-Services Intelligence (ISI) agency orchestrated a “terrorist attack” in Zhob, South Pakhtunkhwa wounding one, and detaining two more PTM activists.

12. Partnership of Ukrainian/Israeli Companies to Enable Interception Technologies for Indonesia’s Intelligence Agencies

As reported by Intelligence Online on February 3rd, the Israeli firm Cognyte has partnered with Ukrainian firm Infozahyst to fulfil a contract for Indonesia’s intelligence services related to communications interception technologies. Reportedly, this was due to Infozahyst’s expertise in satellite communications interceptions.

13. 60 Greek Parliament Email Accounts Compromised by Unidentified Actor

According to a leaked Greek Parliament Briefing “on 20 January, 2022, during the midday hours, the Informatics Directorate detected an effort from an external IP to gain access to Parliament email accounts.” The same sources stated that the unidentified cyber operators obtained access to 60 accounts of Parliament Members, Parliament employees, as well as journalists covering parliamentary affairs in Greece.

14. Israeli QuaDream Offered 0day Capabilities and iOS Implants to Intelligence Agencies

Christopher Bing and Raphael Satter of the Reuters published an exclusive story for the lesser known QuaDream. It’s an Israeli company established by 3 individuals in 2016 and offering 0day capabilities, software implants, and other cyber-espionage solutions to governments, including that of Saudi Arabia. The company, among others, was offering the same Apple iOS 0day exploit that NSO Group was offering at the same time in 2021.

15. Ukraine’s SBU Dismantled a Spy Network in Kharkiv

The Security Service of Ukraine (SBU) officially released an announcement and a video of a successful counter-intelligence operation against an espionage network in the region of Kharkiv, orchestrated and handled by a Russian Federal Security Service (FSB) intelligence officer. The network was tasked to collect intelligence on military and law enforcement movements, as well as tactical reconnaissance of new Ukrainian weapon systems.

16. U.S. Intelligence Exposes a Plan for Russian False Rescue Operation

On February 3rd, the New York Times published a news article showing how U.S. intelligence officials uncovered an Information Operation (IO) of Russian intelligence agencies which would enable a False Rescue Operation. According to the article, Russia was planning to release a fake video and a series of communications/chatter around an imminent invasion of Ukrainian special operations forces to disputed areas, which would enable Russian military to use this as a trigger for a “rescue” operation. Russia denied the accusations with Foreign Minister Sergei Lavrov calling them “nonsense.”

17. Iranian Information Operation Targeting Nationalist and Ultra-religious Jews in Israel

Based on an exclusive BBC investigation, the Facebook and Telegram group “Aduk” is operated by a suspected Iranian disinformation unit with the objective to “stoke division and inflame tensions with Palestinians.” The group was uncovered by Israeli disinformation watchdog “FakeReporter” who suspects it’s an Iranian state-sponsored Information Operation (IO).

18. New Chinese Cyber-Espionage Operation Targeting Financial Institutions in Taiwan

On February 3rd, Broadcom’s Threat Intelligence team published a report on a Chinese nation-state actor dubbed “Antlion” who during 2020-2021 performed advanced cyber-espionage operations targeting financial institutions in Taiwan. According to the analysts, this actor has been performing cyber-espionage operations for China at least since 2011.

19. Egyptian President’s Son Became Deputy Head of Mukhabarat

As reported by Intelligence Online, the son of Egyptian President Abdel Fattah el-Sisi, became the Deputy Head of Egypt’s General Intelligence Service (GIS), better known as Mukhabarat, under Director Abbas Kamel. The President’s son, Mahmoud el-Sisi, was previously (2019) ejected from GIS and placed temporarily in the Military Intelligence Agency with a diplomatic position in Moscow, Russia.

20. NSO Group Attempted to Bribe Mobileum in Return of Access to Mobile Telecommunication Networks

Whistleblower Gary Miller filed a case with the U.S. Department of Justice where, reportedly, he provided evidence demonstrating that during a meeting of NSO Group with Mobileum (a U.S. firm a providing security services to cellular companies where G. Miller was the Head of Security) in August 2017, executives of the Israeli NSO Group attempted to bribe Mobileum in return to access to their customer information as well as direct access to the mobile telecommunications signalling network (SS7) which could enable tracking and identifying almost any cell phone device in the world. NSO Group stated that they never had any business relationship with the mentioned company.

21. Analysis of ISIS Leader Abu Ibrahim al-Hashimi al-Qurayshi’s Killing

Following the U.S. President Joe Biden’s briefing from February 3rd on the successful counter-terrorism Direct Action (DA) special operation in Der Ballout, Atmeh, Syria that resulted in the killing of ISIS leader, Abu Ibrahim al-Hashimi al-Qurayshi, the Director of SITE Intelligence and expert in Islamic terrorism, Rita Katz wrote a twitter thread/analysis on the case and what should be expected after this development from ISIS. U.S. Army veteran Will Killmore also compiled a video of the operation with footage collected from witnesses, and Syria reporter “Woofers” published a lengthy Twitter thread with more footage and media from the DA operation.

22. Chinese Advanced Cyber-Espionage Operation Targeting EU Governments and Media

On February 3rd, threat researchers Steven Adair and Thomas Lancaster of Volexity cyber-security firm published a research on a recent (December 2021) advanced cyber-espionage operation by actors associated with China targeting European governments and media. The Chinese cyber operators utilised a 0day exploit for Zimbra, a popular webmail service used by several European governments.

23. Succession Plan for French DGSE’s Head Bernard Emié

On February 4th, Intelligence Online reported that as French President Emmanuel Macron’s five year term is about to end, France’s main foreign intelligence agency, the Directorate-General for External Security (DGSE), is also currently preparing plans for the succession of its Head, Bernard Emié, a senior French diplomat who, among others, has also served as French Ambassador in Algeria (2014–2017), U.K. (2011–2014), Turkey (2007–2011), Lebanon (2004–2007), and Jordan (1998–2004) before getting nominated and becoming the Head of DGSE in June 2017.

24. Technical Analysis of 3 Russian Clusters of Cyber Operations Against Ukraine Related to FSB’s SCO

Palo Alto Networks threat research team, known as Unit 42, published a technical summary of 3 clusters of cyber activities they identified relating to Russian offensive cyber operations against Ukrainian targets. The report attributes those clusters of activity to an actor dubbed as “Gamaredon” or “PRIMITIVE BEAR” which based on past intelligence reporting, is related to Russia’s Federal Security Service (FSB). More specifically, according to Ukraine’s intelligence services, this actor is part of FSB’s Service for Counter-Intelligence Operations (SCO), and in particular, the 4th Section of the SCO for the Department of the Russian Federation in the Republic of Crimea and the city of Sevastopol, whose main mission is to perform cyber operations to support FSB’s counter-intelligence activities in that region. On February 4th, Microsoft Threat Intelligence Centre (MSTIC) published more details about cyber operations conducted by the same actor against Ukraine.

25. French Navy Mission for Close Surveillance of Russian Spy Ship in the Mediterranean Sea

The French Ministry of Defence announced a large-scale naval operation including numerous navy vessels and aerial assets in the Mediterranean region for surveillance on the Russian Vasiliy Tatishchev (SSV-231) Vishnya-class intelligence gathering ship and, allegedly, accompanying Russian submarines while its transiting from the Gulf of Lion to Corsica.

26. U.S. Navy Gets its First Multi-Intelligence MQ-4C Triton UAS

U.S. Navy obtained its first Northrop Grumman MQ-4C Triton Unmanned Aircraft System (UAS). The new UAS was delivered at the Naval Air Station (NAS) Patuxent River in Maryland on February 1st and it supports the, so-called, Multi-Intelligence (Multi-INT) configuration which enables the MQ-4C for Signals Intelligence (SIGINT) capabilities such as classification and geolocation of radar and other signals, low and high-band software-defined signal receivers, and more.

27. NSA Released 2021 Cybersecurity Year Review

The United States National Security Agency (NSA) announced the release of their 28-pages long 2021 review published by the Agency’s newly formed (in 2019) Cybersecurity Directorate (CSD) and the positive impact it had in improving U.S. cybersecurity status throughout 2021.

28. Danish Court Convicted Three ASMLA Members with Espionage Charges for Saudi Intelligence

On February 4th, the Danish District Court in Roskilde convicted 3 members of the Iranian separatist group Arab Struggle Movement for the Liberation of Ahwaz (ASMLA) with charges relating to espionage on behalf of an unnamed Saudi Arabian intelligence agency and promoting terrorism acts in Iran. According to the report, they were tasked with collecting intelligence on “individuals and organizations in Denmark and abroad and on Iranian military affairs.” The 3 were arrested in February 2020 and now face up to 12 years in prison. The verdict will be announced next month.

29. News Corp. Discloses Cyber Espionage Activity Linked with Chinese Actor

U.S. mass media owner News Corporation made a Securities & Exchange Commission (SEC) filing for a data breach they discovered in January 2022 which, according to experts from Mandiant cyber-security firm who worked on the investigation, is associated with cyber-espionage activity from nation-state actors related to China. David Wong, Vice President of Incident Response at Mandiant, stated “Mandiant assesses that those behind this activity have a China nexus, and we believe they are likely involved in espionage activities to collect intelligence to benefit China’s interests.”

30. Arms Dealer Nuri Bozkir Abducted from Ukraine by Turkish MİT After Disclosing MİT Corruption and Covert Arms Deals

On February 3rd, Lewis Sanders IV and Birgitta Schülke-Gill of Deutsche Welle (DW) published a news story for former Turkish special forces captain Nuri Bozkir who was working as an arms dealer in Ukraine. At the end of 2020 N. Bozkir became a whistleblower disclosing clandestine arms transfers to militant groups in Syria and Libya by Turkey’s National Intelligence Organisation (MİT), in which the MİT operatives were taking “cut from the deals” according to Bozkir. Later, N. Bozkir applied for political asylum in Ukraine but recently he was abducted by MİT and transferred back to Turkey through a covert extraordinary rendition operation.

31. Dutch Air Force Obtains its First MQ-9 Reaper UAV

As announced by the Dutch Ministry of Defense, the first (out of the 4 total) General Dynamics MQ-9 Reaper Block-V Remotely Piloted Aircraft System (RPAS) passed the initial acceptance tests was delivered to the Royal Air Force of the Netherlands. It will be moved (along with 2 ground stations) to Hato Airport in Curaçao for the time being. Additional test and operational flights will take place in the Caribbean Sea, supporting United States’ counter-drug Intelligence, Surveillance, and Reconnaissance (ISR) operations. Two more ground stations will be placed in the Leeuwarden Air Base, Netherlands which will be the home of the rest of the MQ-9s.

32. NRO Launched New U.S. Spy Satellite(s) with NROL-87

The 143rd launch of SpaceX on February 2nd was for a 2019 U.S. Air Force contract the company had. The launch was in fact for the U.S. National Reconnaissance Office (NRO) who made a press release for the success of the NRO Launch 87 (NROL-87). The payload was classified spy satellite(s) with , currently, the only publicly known information being that it’s for “USA 326” satellite payload, with a launch call for 512 km orbit of 97.4° inclination Sun-Synchroneous Orbit (SSO).

33. Report of Israeli SOF Covert Intelligence Gathering Operations in Lebanon

On February 4th, the official Twitter account of Intellinews reported that via a confidential source they discovered two recent covert operations conducted by Israeli Special Operations Forces (SOF) in Lebanon. The report claims that the SOF unit infiltrated from the sea and conducted an intelligence gathering operation in a building associated with Hezbollah in Sahel El-Jiyeh, and another operation in the area of ​​Bir-Hassan, near Beirut, as well as the residence of the Iranian embassy in the Lebanon, all of them to obtain documents and other intelligence-related material.

34. The Story of U.S. Army COMTECH Michael Froede

On February 5th, Jack Murphy published a story on Yahoo! News about the life and death of Michael Froede. M. Froede committed suicide after a series of mental health problems related to his clandestine profession as a Human Intelligence (HUMINT) and cyber warfare operations expert in the secretive Communications Technology Research Activity (COMTECH) of the U.S. Army Intelligence Command (INSCOM). Those issues became more pronounced in January 2019 after his COMTECH colleague and friend, Shannon Kent, was killed in Syria, followed by a clandestine operations deployment in Vietnam just before President Donald Trump’s summit with North Korean leadership. M. Froede also served in Iraq (2007), Afghanistan (2011), Chad (2015), Vietnam (2019), and other countries in Middle East and North Africa region. The article highlights the mental challenges of the clandestine operations and potential reasons that led to this tragic event.

35. Clues of High-Ranking Penetration by Israel’s Mossad in Iran

On Sunday, February 6, Jiyar Gol of BBC Persian published a news story giving a summary of recent suspected Mossad operations inside Iran, as well as quotes of Iranian officials indicating they have evidence that high-ranking Iranian officials might be working for Israel. A former intelligence officer for the IRGC’s Quds Force told BBC “foreign agencies have gathered evidence against a number of Iranian ambassadors and IRGC commanders […] it includes information about relationships with women, which could be used to blackmail those officials to force them to co-operate with foreign spies.” The report references the 2020 nuclear scientist Mohsen Fakhrizadeh assassination, the 2018 infiltration and stealing of Iran’s clandestine nuclear archives (later showcased publicly by Benjamin Netanyahu, the then Israeli Prime Minister), and more.

36. Court in Crimea Sentences Ukrainian Spy Konstantin Shiring to 12 Years in Prison

In March 2020 Russian Federal Security Service (FSB) counter-intelligence officers detained Konstantin Shiring in the Crimea region with accusations of conducting espionage on behalf of the Main Directorate of Intelligence of the Ministry of Defence of Ukraine (HUR MOU). In October 2021, Ukraine’s Ministry of Foreign Affairs demanded his release, but on Friday (February 4th 2022), the Third Court of Appeal of General Jurisdiction in Crimea rejected this appeal and confirmed his 12 year in prison verdict for espionage charges.

37. China’s MSS Arrest of Electromagnetic Railgun Designer Zhang Jiange for Espionage in 2020

On February 2nd, the Hong Kong-based “China New Observation” reported on the case of military electromagnetic weapons expert Zhang Jiange, who was arrested by China’s Ministry of State Security (MSS) in 2020 and soon after that sentenced to 15 years in prison. According to the report, Z. Jiange was recruited by an unnamed Western intelligence agency’s handler named “Jack” during an academic trip in 2011. Later on, Zhang Jiange provided several classified information on electromagnetic weapons to his handler. The MSS detected some similarities between U.S. electromagnetic weapons and Z. Jiange’s projects and this led to a counter-intelligence operation which led to his arrest at the Zhengzhou airport, while carrying a briefcase full of classified documents in attempt to leave China.

38. OSINT-Discovered ELINT/SIGINT Flights

This is a brief summary of ELINT/SIGINT flights identified by aviation enthusiasts during this week:

• 01FEB2022: Summary of at least 9 ISR flights over Ukraine-Russia border. Source
• 01FEB2022: U.S. Air Force RC-135W Rivet Joint (62–4134, callsign JAKE11) flight from RAF Mildenhall, UK to Ukraine-Russia border. Source
• 01FEB2022: U.S. Army Beech RC-12X Guardrail (88–00325, callsign YANK01) and (91–00516, callsign YANK02) flight from Šiauliai Air Base in Lithuania, to the borders with Kaliningrad. Source
• 01FEB2022: U.S. Army Challenger 650 ARTEMIS (N/A reg. number, callsign: CL60) flight over the Black Sea-Ukrainian/Russian borders. Source
• 01FEB2022: Swedish Air Force Gulfstream IV SP S102B Korpen (102003, callsign SVF623) flight from Malmen Airbase to over the Gulf of Gdansk and Kaliningrad. Source
• 01FEB2022: U.S. Air Force Boeing RC-135S Cobra Ball (61–2662, callsign SHINR40) flight from Greenville Municipal Airport Majors Field (GVT) to over Texas-Mexico border. Source
• 01FEB2022: U.S. Air Force U-2S Dragon Lady (68–10331, callsign XRAY11) flight from Palmdale Regional Airport, California. Source
• 01FEB2022: Thales (UK) Diamond Surveillance DA62 MPP (OE-FMF, callsign OEFMF) flight from FMB Airfield Magdeburg mbH, Germany to Schwarze Heide Airport, Germany. Source
• 02FEB2022: Summary of at least 8 ISR flights over Ukraine-Russia border. Source
• 02FEB2022: U.S. Army Beech RC-12X Guardrail (88–00325, callsign YANK01) and (91–00516, callsign YANK02) flight from Šiauliai Air Base in Lithuania, to the borders with Kaliningrad. Source
• 02FEB2022: Minnesota State Patrol Cirrus SR-22 (N115SP, callsign N/A) over Longfellow Park. Source
• 02FEB2022: U.S. Air Force Boeing E-8C JSTARS (95–0121, callsign REDEYE6) flight from Ramstein Air Base, Germany to eastern Ukraine border. Source
• 02FEB2022: U.S. Air Force Boeing RC-135W River Joint (62–4139. callsign PYTHN53) took off from Al Udeid Air Base in Qatar. Source
• 02FEB2022: Austrian Diamond Surveillance DA62 MPP (OE-FMF, callsign OEFMF) flight from Schwarze Heide Airport, Germany to ISR over Mannheim/Lorsch, and landing on FMB Airfield Magdeburg mbH, Germany. Source
• 03FEB2022: Open-source aviation enthusiast Amelia located 3 U.S. government aircrafts (BD2002, 5CD00D, and D9F006), likely UAVs (MQ-9A Reaper or MQ-1C Gray Eagle), flying in ISR patterns over al-Qurayshi’s house in Idlib, Syria at roughly the time of the raid. Source
• 03FEB2022: U.S. Air Force RC-135W Rivet Joint (62–4134, callsign JAKE11) flight from RAF Mildenhall, UK to Ukraine-Russia border. Source
• 03FEB2022: Qatar Air Force Bayraktar TB2 (QA605, callsign N/A) flight from the Al-Shamal UAV base to ISR pattern over Abu Sidrah. Source
• 03FEB2022: RAF Boeing RC-135W River Joint (ZZ665, callsign RRR7210) flight from RAF Waddington to Black Sea at the Russian border. Source
• 03FEB2022: U.S. Air Force Boeing RC-135V Rivet Joint (63–9792, callsign OLIVE56) flight from RAF Mildenhall, UK to Crete, Greece. Source
• 03FEB2022: U.S. Air Force Boeing RC-135V (64–14843, callsign N/A) flight over the South/North Korea borders. Source
• 03FEB2022: 2 Excel Aviation (allegedly covert MI5) Beechcraft Super King Air 200 (G-WCCP, callsign BRO26) flight between Doncaster Sheffield Airport, London Biggin Hill Airport, Glasgow Airport, and Isle of Man Airport. Source
• 04FEB2022: Summary of at least 16 ISR flights over Ukraine-Russia border. Source
• 04FEB2022: U.S. Air Force RQ-4 Global Hawk (AE5421, callsign FORTE12) observed flying close to Israel. Source
• 04FEB2022: Swedish Air Force Gulfstream IV SP S102B Korpen (102003, callsign SVF623) flight from Malmen Airbase to patrol over Kaliningrad. Source
• 04FEB2022: U.S. Air Force Boeing RC-135W Rivet Joint (62–4138, callsign N/A) flight over the South/North Korea borders. Source
• 04FEB2022: Russian Air Force ELINT Ilyushin Il-20M (90924, callsign IL18) flight from Chkalovsky Air Base near Moscow, Russia on racetrack pattern Southeast of Moscow, Russia. Source1 Source2
• 04FEB2022: Japan Air Self-Defense Force Kawasaki RC-2 (18–1202, callsign N/A) flight inside Japan (Tokyo-Niigata). Source
• 04FEB2022: U.S. Navy Lockheed EP-3E ARIES II (160764, callsign MI29) flight from Crete, Greece to North Sea of Crete. Source
• 04FEB2022: NATO AWACS Boeing E-3A Sentry (LX-N90451, callsign NATO07) flight South of Cyprus, across the Russian fleet docked at the Russian Naval Base in Tartus, Syria. Source
• 04FEB2022: U.S. Army Challenger 650 ARTEMIS (N/A reg. number, callsign: CL60) flight over the Black Sea-Ukrainian/Russian borders. Source
• 04FEB2022: U.S. Air Force Boeing E-8C JSTARS (95–0121, callsign REDEYE6) flight from Ramstein Air Base, Germany to eastern Ukraine border. Source
• 04FEB2022: 2 Excel Aviation (allegedly covert MI5) Beechcraft Super King Air 200 (G-CIFE, callsign BRO24P) flight between London Biggin Hill Airport, Manchester Airport, and Doncaster Sheffield Airport. Source
• 04FEB2022: RAF Boeing P-8A Poseidon MRA Mk1 (ZP804, callsign STGRY01) flight from RAF Lossiemouth to ISR over the English Channel. Source
• 04FEB2022: Skyborne Aviation Diamond Surveillance DA42 MPP (G-SADB, callsign GSADB) take off from Gloucestershire Airport, Cheltenham, UK and and ISR flight in the general region and over the nearby RAF Chedworth. Source
• 04FEB2022: U.S. Air Force U-2S Dragon Lady (80–1069) spotted at RAF Fairford, UK. Source
• 05FEB2022: Summary of at least 9 ISR flights over Ukraine-Russia border. Source
• 05FEB2022: U.S. Air Force Boeing E-8C JSTARS (95–0121, callsign REDEYE6) flight from Ramstein Air Base, Germany to eastern Ukraine border. Source
• 05FEB2022: U.S. Army Challenger 650 ARTEMIS (N488CR, callsign: CL60) from Mihail Kogălniceanu International Airport, Romania to the border of Belarus. Source
• 05FEB2022: Swedish Air Force Gulfstream IV SP S102B Korpen (102003, callsign SVF623) flight from Malmen Airbase to over the Gulf of Gdansk and Kaliningrad. Source
• 05FEB2022: Russian Ministry of Defence ZALA Aero Group drone was spotted in South Idlib, Syria over Jabal Zawiyah. Source
• 05FEB2022: Thales Diamond Surveillance DA42 MPP (OE-FMF, callsign OEFMF) take off from FMB Airfield Magdeburg mbH, Germany on flight over the general vicinity of Giessen, Germany and returning to Magdeburg. Source
• 05FEB2022: U.S. Air Force Boeing RC-135V River Joint (63–9792, callsign HOMER61) flight from Crete, Greece to Black Sea around the Russian border. Source
• 05FEB2022: U.S. Navy EP-3E Orion (16–1410, callsign MN806) flight close to Dubai, UAE. Source
• 05FEB2022: U.S. Air Force Boeing RC-135W Rivet Joint (64–4139, callsign PYTHN56) flight from Kuwait over target compound at the South of Al Bunyah al Janubiyah, Iraq. Source
• 06FEB2022: Summary of at least 4 ISR flights over Ukraine-Russia border. Source
• 06FEB2022: U.S. Air Force RQ-4 Global Hawk (AE5420, callsign FORTE12) flight from Al Dhafra Air Base, UAE towards the Aegean Sea, and eventually in Ukraine. Source1 Source2
• 06FEB2022: U.S. Army Challenger 650 ARTEMIS (N488CR, callsign: CL60) from Mihail Kogălniceanu International Airport, Romania to the border of Belarus. Source
• 06FEB2022: U.S. Air Force Boeing RC-135V Rivet Joint (64–14844, HOOVR44) arrived at RAF Mildenhall, UK. Source
• 06FEB2022: U.S Army De Havilland Canada RO-6A ARL-E AISR (16–00276, callsign N/A) on racetrack pattern close to Amerli, Iraq. Source
• 06FEB2022: Israeli Air Force 676 Gulfstream V G550 SIGINT Nachshon-Shavit (676, callsign N/A) flight over the West Bank as part of the 122nd Squadron (Nahshon Squadron). Source
• 06FEB2022: Israeli Air Force Gulfstream V G550 CAEW Nachshon-Oron (452, callsign N/A) flight over the West Bank as part of the 122nd Squadron (Nahshon Squadron). Source
• 06FEB2022: Israeli Air Force Gulfstream V G550 CAEW Nachshon-Aitam (569, callsign N/A) flight over the West Bank as part of the 122nd Squadron (Nahshon Squadron). Source
• 06FEB2022: Israeli Air Force Gulfstream V G550 CAEW Nachshon-Aitam (537, callsign N/A) flight over the West Bank as part of the 122nd Squadron (Nahshon Squadron). Source
• 06FEB2022: U.S. Navy Boeing P-8A Poseidon (AE6898, callsign N/A) from Sigonella, Italy to flight over the Black Sea. Source
• 06FEB2022: U.S. Army Beech RC-12X Guardrail (88–00325, callsign YANK01) and (91–00516, callsign YANK02) flight from Šiauliai Air Base in Lithuania, to the borders with Kaliningrad. Source