Geopolitical and cyber intelligence.
Daily briefings on the United States, United Kingdom, France, Germany, Ukraine, and Turkey, with continuous monitoring of global cyber threats.
- ▸ Ukraine hits Russian airbases with Storm Shadow missiles; Germany slashes 2026 growth forecast to 0.5% amid Gulf crisis. EU watchdog targets far-right party
Top Stories
Highest-priority developments worldwide
Ukraine Strikes Russian Airbases; Germany Cuts Growth Forecast
The world's two active wars sent escalate-and-negotiate signals in tandem. Ukraine struck three Russian military-aviation sites overnight as Russian fire killed civilians in Kherson and Odesa. In the Gulf, Iran's Guards said 23 ships crossed Hormuz against 109 the US redirected, and threatened a 'graveyard' for attackers as talks edged closer, while Trump's cabinet vowed it could still 'finish the job.' Europe absorbed the strain: German advisers cut 2026 growth to 0.5%, a record heatwave killed at least seven in France, and leaked files exposed a Russian plan to stage provocations in Paris.
Ukraine strikes three Russian military-aviation sites in one night, burning the Black Sea Fleet's air headquarters in Sevastopol
Ukraine hit three Russian military-aviation sites in a coordinated overnight operation on 27 May 2026 -- the Baltimor airbase at Voronezh that hosts Su-34 fighter-bombers, the 325th Aircraft Repair Plant at Taganrog, and the Black Sea Fleet's air-force headquarters in occupied Sevastopol, where a missile left the command building badly burned. OSINT monitors and a Russian occupation official attributed at least part of the assault to British-French Storm Shadow cruise missiles, while Moscow's commanders insisted air defences had repelled the attack and blamed "falling debris" for the damage. The strikes extend a deep-strike campaign that has hit Russian refineries, oil terminals and Black Sea Fleet vessels over the preceding week.
Leaked files detail a Russian plan to stage anti-Muslim and antisemitic provocations in Paris and pin them on Ukrainians
Documents obtained by Delfi Estonia and shared with the OCCRP investigative network detail Russian hybrid-warfare operations planned for 2025-2026, including planting pig heads near Paris mosques, vandalizing a Holocaust museum, and defacing a monument to Charles de Gaulle while framing "Ukrainian nationalists." Publicized by Ukraine's Center for Countering Disinformation, the files attribute the operations to the sanctioned Social Design Agency, said to be overseen by officials in the Russian presidential administration, and include a disinformation campaign over real estate allegedly owned by Volodymyr Zelensky. The Center called the network evidence of a systematic, long-term hybrid threat to Europe.
Hegseth vows a National Guard 'surge' in Washington as Trump's cabinet signals it could 'finish the job' in Iran
At a 27 May cabinet meeting, Defense Secretary Pete Hegseth vowed to "surge" National Guard troops in Washington this summer after President Trump told officials "don't lower the number," and framed a US "world-class blockade" as having forced Iran to "cry uncle" at the negotiating table. Secretary of State Marco Rubio said Iran would "never" obtain a nuclear weapon and called diplomacy "the first option," while stressing that Trump retained "other options" if talks fail within "the next few hours and days." Trump dismissed concern over Iran-linked gas prices, claiming US output now doubles Russia and Saudi Arabia combined, and pivoted to domestic claims on fraud and drug prices.
Ukraine launches 'Logistical Lockdown' program to scale up deep strikes on Russian rear
Ukraine's Defense Minister Mykhailo Fedorov announced on May 27 a new program called 'Logistical Lockdown' to systematically destroy Russian logistics and infrastructure at operational depth. The first phase allocates UAH 5 billion ($113 million) directly to top-performing drone brigades, while a second phase will launch centralized tenders for medium-range strike systems. Fedorov said results from the centralized procurement should be felt on the battlefield by summer.
Country Coverage
Daily snapshot across all six nations
Washington Edges Toward Iran Deal Amid War Rhetoric
Russia Dominates UK Security Debate Amid Vetting Scandal
France Faces Russian Subversion, Boosts Defence Spending
Germany Eases Energy Rules as Economic Gloom Deepens
Ukraine Strikes Russian Airfields as Civilians Die in Shelling
No briefing for this date.
Cyber Threat Intelligence
Daily snapshot of attack categories, threat actors, and country exposure.
- Ransomware Netherlands 27 MayDunas Groen falls victim to Dragonforce ransomware
- Data Breach Thailand 27 MayAlleged data breach of Total Digital Innovation Co Ltd
- Threat Alert Mexico 27 MayAlleged offering of fraudulent identity document services in Mexico
- Ransomware United Kingdom 27 MayRefreshment Systems Ltd falls victim to Dragonforce ransomware
- Databasehooligan 36 ev
- DragonForce 19 ev
- BROTHERHOOD CAPUNG INDONESIA 11 ev
- NoName057(16) 8 ev
- Sorb 4 ev
Recent CTI Daily Briefs
Browse past daily cyber threat intelligence briefs.
- 27 May 2026· Latest148eventsDatabasehooligan Dominates as AI Supply-Chain Attacks SurgeDatabasehooligan drove 36 of 148 tracked incidents in a global data-sale spree, while CrowdStrike disrupted GlassWorm and AI coding-agent attacks spread.
- 26 May 2026178eventsData Breach Wave Hits Government, Education as DDoS SurgesA 178-incident day: NoName057(16) drives DDoS while alleged breaches hit NASA, Santander, Ukraine's defense ministry and Indonesian government bodies.
- 25 May 2026170eventsDatabasehooligan Breach Spree Meets Ghost CMS Mass ExploitDatabasehooligan claimed 27 breaches across Europe and the Americas as a Ghost CMS flaw (CVE-2026-26980) was exploited to hijack 700+ sites.
- 24 May 2026164eventsScattered LAPSUS$ Hunters Posts Defence-Database Sale SweepScattered LAPSUS$ Hunters claims database sales targeting NATO RTA, UK Government, US Navy, NASA Glenn, Spain MoD and 17 more in a single spree.
- 23 May 2026140eventsPro-Russian DDoS dominates; Lazarus hits Tashkent educationNoName057(16) led 14 listings, Lazarus leaked Westminster International University in Tashkent, and Drupal Core SQLi plus Laravel-Lang join CISA KEV.