//
OFFLINE — VIEWING CACHED CONTENT
← Back to Archive

IC BRIEF

Current as of 1715 EDT (UTC-04), Saturday 13 June 2026

Contents

10 stories from 36 sources across 32 organizations

KEY JUDGMENTS

Three parallel federal cyber governance tracks, the Senate's Cyber Force legislation, Cybersecurity and Infrastructure Security Agency (CISA)'s Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) incident reporting rules, and Senate Select Committee on Intelligence (SSCI) Chairman Cotton's Foreign Agents Registration Act (FARA) referral on Chinese AI-linked influence operations, will likely produce no binding legal or regulatory outcome before January 2027. Moderate confidence rests on procedural barriers now visible across all three: Senate Armed Services Committee (SASC)'s 14-13 committee rejection foreclosing Senate floor math, CISA's explicit refusal to commit to a finalization timeline, and the absence of Department of Justice (DOJ) enforcement indicators that precede formal FARA action against domestic nonprofits.

A further China-nexus compromise of U.S. critical infrastructure beyond Velvet Ant's decade-long authentication-stack intrusion is very likely before year-end. Moderate confidence reflects Beijing's sustained operational tempo and structural delays in federal response. National Security Presidential Memorandum (NSPM)-12's reconstituted Committee on National Security Systems (CNSS) will likely miss its 90-day cloud security review deadline, and CISA operates at two-thirds capacity after shedding one-third of its workforce. Through December, federal agencies will very likely leave authentication-layer integrity monitoring as a discretionary matter for critical infrastructure operators. World Cup venue operations will very likely proceed without a confirmed state-linked cyber attack through July 19, though Handala's Ministry of Intelligence and Security (Iran) (MOIS) backing preserves operational intent.

IC Oversight & Authorities

Trump Issues NSM Revamping Cybersecurity Governance for National Security Systems

BLUF: Whether the reconstituted CNSS can meet its September 2026 cloud security deadline remains genuinely uncertain, as concentrated NSA authority outpaces the committee's operational readiness.

President Trump signed NSPM-12 on June 12, establishing a cybersecurity governance framework for National Security Systems that rescinds NSD-42 of July 1990 and NSM-8 of January 2022 12. The memorandum reestablishes the Committee on National Security Systems under National Security Council (NSC) staff coordination, with the DOW CIO, IC CIO, Federal CIO, and NSA Director as members, and authorizes the committee to issue binding security directives to all National Security Systems (NSS) owners and operators 13. The NSA Director is designated National Manager for NSS with authority to issue emergency directives and serve as cryptologic authority government-wide 13. The memo sets 90- and 120-day deadlines for CNSS cloud security policy review and cloud service provider configuration baselines, respectively, with the cloud report to be coordinated with NSPM-11 on AI in the national security enterprise 12.

Analyst Note: NSPM-12 installs the NSA Director as National Manager for NSS with emergency directive and government-wide cryptologic authority, creating a formal command tier above agency decisions that had no standing before June 12. The binding CNSS directives close the standards gap adversaries exploited across the prior NSD-42/NSM-8 patchwork. The reconstituted CNSS, dormant 35 years, must produce cloud security policy and configuration baselines by September 10, 2026, while coordinating with NSPM-11's AI roadmap. Whether the secretariat meets that deadline is genuinely uncertain. Moderate confidence in that judgment rests on the memo's clear tasking language against no observable indicator the CNSS secretariat is yet operational. The consolidation may instead formalize NSA's existing de facto role, with practical change contingent on secretariat staffing materializing. NSS cloud program managers who proceed now risk mandatory re-architecture if CNSS delivers compliant baselines on schedule.

Sources:

1: National Security Presidential Memorandum/NSPM-12 - The White House

2: Trump issues memo revising cybersecurity policy for national security systems - Inside Defense

3: Fact Sheet: President Donald J. Trump Defends America's Warfighters and Intelligence Officers Against Cyber Threats - The White House

Trump Hands NSA the Keys to America's Cyber Defense — Here's What Changes - BizzBuzz News

SSCI Chairman Cotton Requests DOJ Probe of Chinese AI-Related Covert Influence Operation After OpenAI Exposure

BLUF: Cotton's FARA referral is unlikely to produce a formal DOJ investigation within six months, but the OpenAI findings lend credible evidence to claims of PRC-directed anti-AI infrastructure influence operations on U.S. soil.

Cotton's June 10 letter to Acting Attorney General Todd Blanche requests a DOJ investigation into a network of U.S. nonprofits he alleges are funded by Shanghai-based expatriate Neville Roy Singham with Beijing as ultimate paymaster, noting no entity in the network has faced Foreign Agents Registration Act charges 123. An OpenAI report published on June 11 identified two China-linked ChatGPT account clusters banned for generating narratives attributing rising electricity prices to AI data centers, with user prompts instructing the content to avoid referencing Xi Jinping 2. Cotton's letter further alleges, citing a Bitcoin Policy Institute report, that foreign-funded entities channeled more than $2 billion into domestic advocacy groups opposing data center construction while China Global Television Network (CGTN), China Daily, Global Times, and RT ran parallel propaganda campaigns against U.S. AI infrastructure 3.

Analyst Note: DOJ formally investigating one or more Singham-network nonprofits under FARA within six months of Cotton's June 10 letter is unlikely. Cotton's letter functions as a political pressure instrument. FARA enforcement against domestic nonprofits with documented foreign funding ties is historically rare even with stronger evidentiary packages than what Cotton presents. The OpenAI account bans, confirming PRC-linked actors tested anti-data center narratives at scale, strengthen the influence-operation case but do not establish the foreign-agent relationship FARA requires for a successful prosecution. Moderate confidence reflects the absence of observable DOJ indicators, such as grand jury activity or voluntary registration requests, that typically precede formal FARA action.

Sources:

1: Cotton to DOJ: Investigate Communist China Influence on Data Center Development - U.S. Senator Tom Cotton

2: Senate intelligence chairman seeks federal probe of Chinese AI-related influence operation - Washington Times

3: Sen Tom Cotton urges DOJ to probe Chinese bid to 'kneecap' American AI - Fox News

Sen. Cotton Alleges Chinese Influence Behind U.S. Data Center Backlash, Demands DOJ Probe - Broadband Breakfast

Senate Armed Services Committee Narrowly Rejects Cyber Force Service Branch in 14-13 Vote

BLUF: Bipartisan opposition and intra-Democratic defections make a standalone Cyber Force very unlikely to advance before this Congress adjourns in January 2027, deferring structural reform to the next legislative cycle.

Sen. Kirsten Gillibrand sponsored the failed amendment, which would have placed the Cyber Force under the Army on the model of the Space Force under the Air Force 12. The 14-13 vote split four Democrats and ten Republicans in opposition and nine Democrats and four Republicans in favor; Gillibrand's spokesperson said the senator "will continue to push" for its creation 12. The committee's National Defense Authorization Act (NDAA) mark instead directs an independent review of U.S. Cyber Command's organization and resourcing and a separate study on Principal Cyber Advisor roles across the military departments 12. The CSIS/FDD Commission on Cyber Force Generation released concurrent findings arguing the branch would address "longstanding structural challenges" in military cyber force management 12.

Analyst Note: Democratic defection, not Republican opposition, is the load-bearing constraint on the floor math: the four Democrats who broke with Gillibrand in committee make a full chamber vote before the 119th Congress adjourns January 3, 2027, very unlikely. High confidence rests on the recorded coalition split, the sponsor's pledge to continue pushing, and substitute language directing United States Cyber Command (CYBERCOM) reviews rather than structural change. Bipartisan opposition may nonetheless target the service-under-Army model specifically rather than the Cyber Force concept, leaving a restructured proposal with different viability in the 120th Congress. Depth rests on a single primary, Defense One, with two outlets echoing without independent sourcing. The NDAA-mandated CYBERCOM review is now the primary policy lever through the next cycle.

Sources:

1: Push for new Cyber Force service branch narrowly fails in the Senate - Defense One

2: Senate rejects Cyber Force push as debate over cyber structure continues - Government Executive

Cyber Force not included in Senate defense policy roadmap - Recorded Future News

CISA Revives Push Toward Long-Awaited Cyber Incident Reporting Rules Under CIRCIA

BLUF: CIRCIA finalization by year-end 2026 is very unlikely, as unresolved scope conflicts and bipartisan skepticism leave the rule in administrative limbo with no credible path to resolution.

CISA this week hosted virtual town halls on draft CIRCIA regulations that would require 72-hour cyber incident reporting and 24-hour ransomware payment notifications across 16 critical infrastructure sectors, per Federal News Network and a May 26 Federal Register notice 12. Acting Director Nick Andersen, speaking at a June 9 conference, declined to set a finalization date pending review of stakeholder feedback 1. The 2024 draft drew criticism for covering an estimated 300,000 entities and conflicting with existing sector-specific regulations; House Homeland Security Chairman Andrew Garbarino called the rules "not good" at a June 10 forum 1. The House Appropriations Committee urged CISA to finalize promptly in its fiscal 2027 homeland security spending report 1.

Analyst Note: CISA is very unlikely to publish a final CIRCIA rule by year-end 2026: Acting Director Andersen explicitly refused to commit to a finalization date, and the draft's estimated 300,000-entity coverage and conflicts with existing sector-specific regulations represent structural problems town halls cannot resolve. Moderate confidence reflects the visible alignment between Andersen's public posture, Garbarino's public opposition, and the absence of any announced scope-reduction framework. Congressional Appropriations pressure is real but insufficient to override the administrative complexity of reconciling conflicting sector regulations. With the Federal Register notice as the sole primary source and Federal News Network providing secondary synthesis, independent visibility into CISA's deliberative posture is limited. A narrowed scope satisfying Garbarino's objections could reopen a 2026 path, but absent that reduction, covered entities across all 16 sectors should treat compliance investment as deferrable until the next rulemaking cycle.

Sources:

1: CISA revives push toward long-awaited cyber incident reporting rules - Federal News Network

2: Town Hall Meetings To Provide Input on Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Rulemaking - Federal Register

Adversary Intelligence

FBI and Google Dismantle China-Based Outsider Cybercrime Network Responsible for $1.9 Billion in Losses

BLUF: Named indictments against Outsider operators remain unlikely within 12 months, as the China-based nexus and unknown identities leave infrastructure seizures as a disruption tool rather than a prosecution pathway.

The FBI, Google, and Lumen Technologies on Friday seized Outsider Enterprise's administrative domains, a Shopify storefront, and approximately $100,000 in payment wallets under Operation Ghost Hook 1. FBI officials attributed 3.87 million stolen credit cards and an estimated $1.9 billion in losses across 55 countries to the China-based phishing-as-a-service platform, which has been operational since July 2023 12. Outsider's kit, sold at $88 per week, provided more than 290 pre-built fake-site templates and guides for using Google's own Gemini and other AI platforms to generate phishing lures impersonating telecoms, financial institutions, and government agencies 23. Google filed a civil complaint in the Southern District of New York the same day, charging racketeering and wire fraud against operators whose real identities remain unknown 24.

Analyst Note: Named indictments against Outsider operators are unlikely within 12 months of Operation Ghost Hook. The attribution barrier is structural: identities remain unknown per the complaint itself, China's nexus forecloses extradition, and the compartmented franchise model disperses attribution signals across jurisdictions. Moderate confidence rests on two convergent indicators: Google's explicit admission and the absence of any US-China extradition framework. All reporting derives from Google's own filing and blog post, constraining confidence in loss figures Google has a litigation interest in advancing. The FBI likely holds more complete actor attribution than disclosed, having chosen infrastructure disruption over charges to protect collection equities. Named indictments would activate Treasury sanctions authority and allied extradition mechanisms against specific individuals. A NO resolution leaves civil injunction as the enforcement ceiling for China-based Phishing-as-a-Service (PhaaS) actors.

Sources:

1: FBI takes down massive China-based cybercrime network that caused $1.9B in losses - CyberScoop

2: Chinese cybercrime operation that used AI to scam 'hundreds of thousands of victims' sued by Google - TechCrunch

3: Google Sues Chinese Smishing Network Accused of Using Gemini AI in Phishing - The Hacker News

4: Google sues China-based scammers over Gemini AI abuse - Help Net Security

How Google is combatting AI scams and dismantling the "Outsider Enterprise"

Chinese APT Velvet Ant Maintained Decade-Long Espionage Access to Critical Infrastructure via Hijacked Authentication Stack

BLUF: Velvet Ant's decade of undetected persistence inside authentication infrastructure exposes a systemic blind spot in air-gapped network defense that formal government attribution is unlikely to address within six months.

Sygnia's incident response team traced Velvet Ant's earliest activity inside a target organization's air-gapped critical infrastructure network to 2016, roughly a decade before detection 12. The China-nexus actor reached the isolated segment by chaining compromised internet-facing Nginx servers with a FastCGI execution bridge, routing commands inward via HTTP POST requests without any direct connection to the segregated environment 12. Sygnia identified nine separately compiled variants of a backdoored Linux Pluggable Authentication Module (PAM) module alongside trojanized OpenSSH binaries that captured authentication credentials and logged session commands across compromised hosts 134. Removal required an offline testing lab because the tampered binaries underpinned remote authentication and direct replacement risked locking administrators out of affected systems 12.

Analyst Note: Nine separately compiled pam_unix.so variants and a custom SSH flag suppressing the actor's own session logging indicate a per-target build pipeline refined over years. The authentication layer is recast as an adversarial attack surface requiring integrity monitoring on par with EDR coverage. That conclusion rests on Sygnia's direct incident response reporting without independent forensic corroboration from secondary sources. The target's air-gap status is an organizational assertion; absent independent verification of that isolation, the technical achievement attributed to Velvet Ant softens materially. Formal public attribution by a U.S. or allied government to a named Chinese state entity is unlikely within six months. Confidence is moderate: the sparse historical record of government attribution against China-nexus actors, even when the technical case is strong, constrains that ceiling, and absent official attribution, sector-wide authentication integrity audits remain discretionary rather than compelled.

Sources:

1: Velvet Ant's Operation Highland: How a China-Nexus Actor Infiltrated an Internal Network Undetected - Sygnia

2: Chinese hackers hijack auth flow, spy on isolated network for a decade - BleepingComputer

3: China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade - The Hacker News

4: China-nexus group hid in Linux login system for nearly a decade - SC Media

Iran-Linked Handala Group Claims Breach of FBI Surveillance Drones and Threatens World Cup Attacks

BLUF: Handala's fabricated evidence and consistent preference for influence over action make a credible attack on World Cup venues before July 19 very unlikely, though MOIS backing warrants continued protective resourcing.

SITE Intelligence Group reported Friday that Handala claimed to have accessed "every image and every suspect" captured by FBI first-person view drones at World Cup venues, including facial recognition and license plate data going back "for months" 12. In the same statement, the group threatened participating teams, warning that First-Person View (FPV) drones "are everywhere" and that one "might end up right in your team's bus" 13. SITE disputed the group's photographic evidence, identifying one released video as a December 2024 promotional clip from a software company demonstrating tornado-damage surveillance for a U.S. police department 123. The FBI is deploying drones around World Cup stadiums for counterterrorism, with a blanket flight ban over U.S. host venues 12.

Analyst Note: SITE's identification of the released footage as a December 2024 commercial clip undercuts any credible claim to FBI drone access. With AFP the sole primary wire and no FBI confirmation, the claim rests entirely on Handala's own release, and the group's established pattern of psychological exploitation over physical follow-through makes a confirmed attributed incident before July 19, 2026 very unlikely. MOIS backing means the group carries operational intent even when tactical evidence is fabricated, so event security resourcing remains warranted. Handala may instead have obtained partial access to contractor-managed drone telemetry and released fabricated visuals to obscure a narrower genuine intrusion. Moderate confidence rests on Handala's documented MOIS affiliation and a consistent record of influence operations over destructive action. FBI confirmation of an actual access event would immediately surface whether pre-tournament warning indicators were treated as actionable intelligence.

Sources:

1: Iran-linked group claims hack of FBI drones, threatens World Cup, monitor says - CBS News

2: Iran-linked group claims hack of FBI drones, threatens World Cup, monitor reports - AFP (via France 24)

3: Iran-Linked Group That Hacked Kash Patels Email Threatens World Cup With Hijacked FBI Drones - Decrypt

Iran-linked group claims hack of FBI drones, threatens World Cup - The Times of Israel

CrowdStrike Finds North Korean Famous Chollima Behind Nearly Half of US Tech Sector Cyber Intrusions

BLUF: Famous Chollima's 47% share of state-sponsored tech intrusions will likely drive DOJ indictments within the next year, but the sector's hiring-verification gap remains the more urgent vulnerability.

CrowdStrike's 2026 Technology Threat Landscape Report attributes 47% of all state-sponsored hands-on-keyboard intrusions against the tech sector to Famous Chollima over the April 2025 to March 2026 period 12. The group poses as remote developers at tech companies in North America, Europe, and Asia, using AI deepfakes and fraudulent identity documents to pass hiring checks while collecting salaries channeled to the regime 123. Infiltrated operatives exfiltrate intellectual property and threaten disclosure upon detection; related Democratic People's Republic of Korea (DPRK) operations stole approximately $2 billion in cryptocurrency during 2025 23. China-nexus actors accounted for 58% of state-sponsored intrusions targeting the sector; a separate DPRK affiliate, STARDUST CHOLLIMA, compromised the Axios npm package in March 2026, downloaded roughly 100 million times weekly 14.

Analyst Note: DOJ will likely unseal additional indictments against Famous Chollima-linked IT worker infiltrators within the next 12 months, as prior attribution cycles have reliably triggered enforcement within that window. Moderate confidence rests on DPRK IT worker charging precedent and the operational scale CrowdStrike has now publicly documented. Drawing solely from CrowdStrike's client telemetry, the 47% figure may overstate Famous Chollima's sector-wide dominance among organizations using competing security vendors. STARDUST CHOLLIMA's March 2026 Axios npm compromise widens the potential victim pool beyond directly infiltrated firms. If indictments materialize, compliance teams gain named-actor intelligence to audit active contractor rosters; absent charges, the enforcement backstop motivating stricter hiring-verification mandates dissolves.

Sources:

1: CrowdStrike 2026 Technology Threat Landscape Report: China's Ambitions Fuel Attacks

2: North Koreans behind nearly half of US tech industry hacks, says CrowdStrike - TechCrunch

3: North Korean Hackers Behind Nearly Half of US Tech Breaches, CrowdStrike Says - Technology.org

4: CrowdStrike: Technology Sector Faces Rising Cyber Threats as eCrime, China and North Korea Drive Attacks in 2026 - InfotechLead

IC Workforce & Organization

CISA Rebuilding After Losing One-Third of Workforce to DOGE Cuts as Cyber Threats Intensify

BLUF: CISA is very unlikely to reach its stated 2,800-person target by end of 2026, leaving the nation's lead civilian cyber defense agency operating at degraded capacity as adversary activity accelerates.

An internal CISA report entered into the House Homeland Security Committee record at a January hearing documented at least 998 employees separated since January 2025, among them red-team specialists lost in the probationary-employee cuts 1. Department of Homeland Security (DHS) Secretary Markwayne Mullin told Congress on June 3 that CISA "probably needs around 2,800 personnel," against the roughly 300 mission-critical hires acting director Nick Andersen had announced in March 2. Richard Forno, associate director of the University of Maryland Baltimore County Cybersecurity Institute, told Broadband Breakfast that federal workforce treatment over the past year makes government service "very unlikely" to attract experienced cybersecurity professionals 2.

Analyst Note: CISA is very unlikely to reach 2,800 personnel by December 31, 2026. The 300 mission-critical hires authorized in March cover less than half the net gain required, and the hiring window is narrowing. High confidence rests on the arithmetic mismatch between authorized pace and the stated threshold, with trade-press expert assessment corroborating that Department of Government Efficiency (DOGE)-era treatment has materially degraded government appeal to experienced cyber professionals, though neither outlet independently verified operational capacity. Red-team capability carries multi-year rebuild timelines that hiring tempo cannot compress. The administration's capability-over-headcount approach, if borne out by incident-response outcomes, would mean 2,800 personnel are not operationally required. Critical infrastructure operators face pressure to accelerate private-sector redundancy rather than rely on CISA surge capacity. Appropriators confront a staffing mandate decision before the 2026 midterm cycle, with CIRCIA obligations covering an estimated 300,000 entities compounding the workload of an agency still at two-thirds strength.

Sources:

1: Acting CISA chief defends workforce cuts, declares agency 'back on mission' - Cybersecurity Dive

2: One Year After DOGE Cuts, Cybersecurity Agency Struggles Over Staffing - Broadband Breakfast

Allied Intelligence

Airbus Leads Five-Company German Consortium for Sovereign Space-Based ISR Capability

BLUF: Germany's five-company Intelligence, Surveillance, and Reconnaissance (ISR) consortium remains a non-exclusive industry positioning play, and a signed sovereign satellite contract by December 2027 is very unlikely absent a visible procurement signal from Berlin.

On June 10 at the Berlin Air Show, Airbus Defence and Space signed a Memorandum of Understanding with Rohde & Schwarz, constellr, Orbint, and High Performance Space Structure Systems (HPS) to develop a sovereign satellite-based ISR solution, with Airbus serving as prime contractor and system integrator 123. All five partners are headquartered in Germany; Rohde & Schwarz supplies RF components and signal processing, constellr contributes thermal infrared satellite systems, Orbint provides geolocation methods and data processing algorithms, and HPS delivers space-qualified deployable mesh reflector antennas 13. Together the consortium addresses the full Earth observation chain spanning multi-sensor tasking, collection, processing, exploitation, and dissemination across RF, Electro-Optical/Infrared (EO/IR), Synthetic Aperture Radar (SAR), and SIGINT-derived geospatial services 12. Via Satellite reported that Airbus did not identify a specific government contract or system architecture target, and Airbus's press release confirms the parties are collaborating on a non-exclusive basis 12.

Analyst Note: A signed Bundeswehr or German federal ISR contract by December 2027 is very unlikely. The Memorandum of Understanding (MOU) names no government customer, no contract vehicle, and no system architecture. Its non-exclusive structure lets all five partners pursue competing arrangements simultaneously, a configuration consistent with trade-show positioning ahead of an anticipated solicitation rather than a mature program with a defined buyer. German defense acquisitions have never compressed a consortium formation-to-contract cycle into 18 months, and Germany's €35 billion space defense pledge has not yet produced a visible ISR procurement signal that would alter that timeline. Moderate confidence reflects Airbus's press release as the sole originating source carrying explicit disclaimers, combined with limited open-source visibility into Bundeswehr acquisition planning. Until a solicitation materializes, European space-ISR dependence on current allied arrangements runs at minimum through 2028.

Sources:

1: A Sovereign Space Intelligence Team: Airbus, Rohde & Schwarz, Constellr, Orbint, HPS

2: Airbus to Lead German Consortium for Sovereign ISR Capability - Via Satellite

3: Airbus Defence and Space sovereign space intelligence consortium with Rohde & Schwarz, constellr, Orbint and HPS - European Security & Defence

Airbus leads German space intelligence consortium - Electronics Weekly

COLLECTION GAPS

UNCLASSIFIED // OPEN SOURCE