Geopolitical and cyber intelligence.
Daily briefings on the United States, United Kingdom, France, Germany, Ukraine, and Turkey, with continuous monitoring of global cyber threats.
- ▸ Iran's supreme leader orders enriched uranium kept in country
- ▸ contradicting US-Israel deal terms. War costs include $29B in US aircraft losses
Top Stories
Highest-priority developments worldwide
Iran Hardens Nuclear Stance as War Costs Mount
Iran's Supreme Leader ordered the country's near-weapons-grade enriched uranium kept inside Iran, breaking with a clause Trump had committed to Israel. A Congressional Research Service tally put US aircraft losses in the war at 42 worth $29 billion as Ukrainian forces claimed 400 sq km — the largest gains since Kursk — and Washington's $1.776 billion 'anti-weaponization' fund drew a Capitol Police lawsuit. Germany charged two Quds-Force operatives over a Berlin assassination plot; EasyJet booked a £552m loss; and Australia's productivity minister named rogue AI as a leading extinction risk.
Ukraine claims 400 sq km of southern territory and most of Kupiansk since winter, largest gains since Kursk
Ukrainian counterattacks have retaken more than 400 square kilometres in southern Ukraine since winter, recaptured most of the eastern city of Kupiansk, and seized settlements in western Zaporizhzhia Oblast since late April, according to a 20 May Institute for the Study of War assessment. Commander-in-Chief Gen. Oleksandr Syrskyi told the defence outlet Militarnyi in a 15 May interview that, as of 14 May, the count of Ukrainian offensive actions exceeded Russian ones — a shift Ukrainian officials are pairing with intensified deep-strike drone operations. The advances are the largest Ukrainian territorial gains since Kyiv's incursion into Russia's Kursk Oblast in August 2024.
DOJ creates $1.776 billion 'anti-weaponization' fund for Trump allies; bipartisan backlash, Capitol Police lawsuit
Acting Attorney General Todd Blanche announced a $1.776 billion "anti-weaponization" compensation fund Monday as part of a settlement in President Trump's $10 billion lawsuit against the IRS over a leak of his tax returns, drawing immediate bipartisan opposition over its scope, its likely beneficiaries, and the absence of congressional authorisation. Capitol Police Officer Harry Dunn and Metropolitan Police Officer Daniel Hodges sued Wednesday to block the fund, calling it "the most brazen act of presidential corruption this century"; Senators Bill Cassidy (R-La.) and Dick Durbin (D-Ill.) demanded congressional review, and Rep. Brian Fitzpatrick (R-Pa.) said House Republicans will "try to kill" it. Money will flow from the Treasury Judgment Fund — the dollar figure marks the year of American independence — until December 1, 2028.
Ukrainian drones strike Russian FSB headquarters in occupied Kherson, Zelensky says 100 casualties
Ukrainian drones struck a Russian Federal Security Service (FSB) headquarters in the occupied village of Henicheska Hirka in Kherson region on May 21, 2026, President Volodymyr Zelensky reported. The attack, carried out by the SBU's Special Operations Center 'A', also destroyed a Pantsir-S1 air defense system. Zelensky said Russian losses amounted to around 100 killed and wounded, a figure not independently verified.
German prosecutors charge two Iranian-Quds agents over Berlin plot to assassinate Volker Beck and Josef Schuster
The Federal Prosecutor in Karlsruhe charged two men on Thursday — Ali S., a Danish national arrested in Aarhus in June 2025, and Afghan national Tawab M., arrested in November 2025 — with intelligence activity and attempted murder on behalf of Iran's Revolutionary Guard, in a plot to assassinate Volker Beck, head of the German-Israeli Society, and Josef Schuster, president of the Central Council of Jews in Germany. Investigators say Ali S. was directed by the Quds Force in early 2025 to surveil the two men and two Jewish food retailers in Berlin, and in May 2025 recruited Tawab M., who agreed to procure a weapon for an unnamed third party. The indictment, filed before the Hanseatic Higher Regional Court in Hamburg, originated with a Mossad tip and lands amid heightened Iran-linked threat activity in Europe, including a 10 April arson attack on an Israeli restaurant in Munich.
Country Coverage
Daily snapshot across all six nations
Trump's $1.776B Fund Collides With Iran War Costs
HS2 Cost Triples as EasyJet Posts £552M Loss, UK Migration Falls
Air France, Airbus Convicted in AF447 Crash; Lecornu Unveils Fuel Aid
Quds Force Indictment Lands as Berlin Recalibrates Iran Strategy
Ukraine Recaptures 400 Sq Km, Hardens Northern Border
Ankara Court Annuls CHP Congress, Reinstates Kılıçdaroğlu
Cyber Threat Intelligence
Daily snapshot of attack categories, threat actors, and country exposure.
- Data Leak Israel 21 MayAlleged data sale of Israeli Government Database
- Access Brokerage Netherlands 21 MayAlleged unauthorized access to unidentified cctv cameras in Netherlands
- Ransomware Australia 21 MayThe Shepparton Adviser falls victim to BrainCipher ransomware
- Web Defacement Thailand 21 MayYRA404 targets the website of Song Phraya Wittaya School
- NoName057(16) 11 ev
- Hax.or 10 ev
- BABAYO EROR SYSTEM 6 ev
- DieNet 5 ev
- HellR00ters Team 5 ev
Recent CTI Daily Briefs
Browse past daily cyber threat intelligence briefs.
- 21 May 2026· Latest120eventsLAPSUS GitHub, NoName Ukraine DDoS Lead 120-Event Forum DayLAPSUS-GROUP claims a GitHub data sale; The BlackH4t MD-Ghost names NATO; NoName057(16) hits Ukraine with 11 DDoS; 32 of 120 events are data-breach claims.
- 20 May 2026157eventsGitHub Breach, npm Supply Chain Attack, and Mass Data Leaks Dominate May 20GitHub confirms internal repo theft via VS Code extension; Microsoft disrupts Fox Tempest signing service; 53 critical data exposure events hit US, France, India.
- 19 May 2026137eventsExchange Markets Targets Gulf Finance; Fox Tempest DisruptedExchange Markets claims breaches at Qatar, Kuwait financial entities. Microsoft disrupts Fox Tempest malware-signing service. Drupal warns of critical patch. JAX7 targets Indonesian govt data.
- 18 May 2026159eventsData Leak Surge Targets Government, Telecom, and Healthcare Globally159 events tracked; 48 critical exposures. Qilin, NoName057(16) active. India, US, Indonesia top victims. Healthcare, telecom, government sectors hit. Supply chain threats escalate.
- 17 May 2026140eventsKazu Actor Strikes Healthcare, Government; NGINX Zero-Day Exploited47 critical data exposures logged, with Kazu targeting health and government sectors globally. NGINX CVE-2026-42945 exploited in the wild. Grafana GitHub token breach disclosed.