NATSEC//BRIEF

SYNC OCT 19 06:46 ET

SYS // DAILY BRIEF

Monday, September 28, 2026

FILED 06:45 ET 9 STORIES 6 MIN READ

Bottom line: A criminal hacking group says it broke into FBI systems and stole 2 to 3 terabytes of employee data, holding it until the bureau retracts a statement about the group, and the FBI is still investigating the claim. The CIA reportedly warned southern European governments of a Russian plot to launch drones from commercial ships in the Mediterranean, an account France and Italy have disputed. China ran joint naval, air and coast guard drills around a contested South China Sea shoal, and Japan’s prime minister opened work on the country’s first foreign intelligence service since World War Two.

Espionage and counterintelligence

German intelligence warns Chinese researchers are exploiting university partnerships to steal technology. Germany’s domestic intelligence agency, the Federal Office for the Protection of the Constitution, told Handelsblatt that China has built a systematic effort to acquire technology and know-how partly through scientific cooperation with German universities and research institutes, particularly in fields like drones and artificial intelligence. The agency said visiting Chinese scholars can be used to advance Beijing’s strategic aims and pointed to “legal grey areas” and weak risk awareness at research institutions as the exposure. Why it matters: Germany’s research sector, especially in dual-use fields like drones and AI, is a soft target for a rival that fields those same technologies militarily. (Sri Lanka Guardian)

US military and intelligence community

Hacking group ShinyHunters claims it breached FBI systems and is holding agent data hostage. The extortion group said it exploited a vulnerability in Oracle PeopleSoft software to access the bureau’s job-application portal and other internal programs starting September 21, then stole 2 to 3 terabytes of files including names, Social Security numbers, addresses and, in some cases, family details of FBI employees and applicants. The group says it will not release or sell the data unless the FBI retracts a statement it issued about the group in May; the FBI confirmed it is investigating the FBIjobs.gov breach but has not verified the scope of the claims. Why it matters: Personal data on FBI staff, especially anyone tied to counterintelligence work, could let a hostile service identify and pressure the officers assigned against it. (The Hacker News, NBC News)

CIA reportedly warned Europe of a Russian plot to launch drones from commercial ships. Spain’s El Mundo reported that the CIA passed European governments an assessment that Russia could launch Gerbera-type drones from vessels in the Mediterranean toward Spain, France or Italy, and several governments are accelerating civil-defense preparations in response. French President Emmanuel Macron said the CIA did not brief France on the claim and Italy’s defense minister called the alarm “not confirmed,” while Poland’s prime minister separately said Warsaw has its own intelligence pointing to Russian planning for hybrid drone and missile strikes on countries backing Ukraine. Why it matters: Even disputed, the warning shows how seriously European governments now take the threat of Russian hybrid attacks reaching beyond Ukraine’s immediate neighbors. (Defense News, Euronews)

Japan’s prime minister launches the panel meant to build the country’s first foreign spy agency. Prime Minister Sanae Takaichi convened the first meeting of a 17-member expert panel tasked with designing a new National Intelligence Council, calling stronger intelligence capabilities “an urgent priority.” The plan, which cleared parliament in May, aims to give Japan by 2028 a dedicated service able to run human intelligence operations abroad against China, North Korea and Russia, something it has lacked since 1945 partly because of the legacy of wartime intelligence abuses. Why it matters: Such a service would mark Japan’s biggest intelligence overhaul since World War Two and give Washington a more capable regional partner against Beijing and Pyongyang. (Bloomberg)

China, Russia, Iran and North Korea

Trump asked Xi if China wanted to buy US weapons, ambassador says. US Ambassador to China David Perdue told Fox News that President Trump, defending a pending arms sale to Taiwan during Xi Jinping’s recent state visit to Washington, downplayed the sale as routine and asked Xi whether Beijing might also want to buy US arms. Perdue did not say when the offer was made; selling arms to China would violate the US arms embargo imposed after the 1989 Tiananmen Square crackdown. Why it matters: Even a casual remark blurs a policy the US has held for decades, and it lands while Washington’s Taiwan arms sales remain a top irritant with Beijing. (U.S. News & World Report)

China stages joint air, sea and coast guard drills around Scarborough Shoal. The People’s Liberation Army’s Southern Theater Command ran a naval-air exercise around Huangyan Dao, the Chinese name for Scarborough Shoal, on September 27, focused on reconnaissance, rapid maneuver and search and rescue, while the China Coast Guard separately drilled on boarding, interdiction and towing in the same waters. South China Morning Post reported the drills came days after a Philippine legislative move asserting a territorial claim over the shoal; Chinese state media described the exercise as a response to actions “undermining regional peace and stability.” Why it matters: Scarborough Shoal is a longstanding flashpoint with the Philippines, a US treaty ally, and repeated drills there keep alive the risk of an incident that could pull in Washington. (South China Morning Post, CGTN)

Iran asks the United Nations to examine Europe’s role in US military operations against it. Iran’s ambassador to the United Nations wrote to the UN Secretary-General and Security Council president citing NATO chief Mark Rutte’s remarks that roughly 5,000 aircraft sorties flew from European bases in support of the US-led campaign against Iran since late February, a figure Rutte said covered activity only through mid-April. Iran’s state-run Tehran Times reported Tehran argues the use of European territory could create legal responsibility for the states involved. Why it matters: The complaint is an attempt to widen accountability for the US-Iran conflict to the European NATO members that hosted or supported American operations. (Tehran Times)

EU sanctions 10 people and 17 entities over the deportation of Ukrainian children to Russia. The European Union added Moscow’s city tourism committee and several children’s and sports camps in Russia, plus a camp in North Korea it says is used to promote pro-Russian narratives among deported children, to its sanctions list on September 28. The action coincides with a conference of the International Coalition for the Return of Ukrainian Children in Toronto and follows an earlier May round of sanctions on 16 people and seven entities over the same issue; the EU says Russia has forcibly transferred roughly 20,000 Ukrainian children since 2022. Why it matters: The sanctions keep pressure on a practice Ukraine and its allies call a war crime, even as the underlying transfers continue. (ThePrint)

Ukraine’s military intelligence names 14 financial channels it says help Russia dodge sanctions. Ukraine’s Defence Intelligence agency, working with the president’s office and the central bank, published a list of banks, payment processors and financial intermediaries it says Russia uses to move money internationally despite sanctions, including a platform that converts funds through a ruble-pegged digital asset called RubX. Why it matters: Naming the channels gives Western regulators a target list for closing off sanctions-evasion routes that keep Russian trade financing flowing. (Mezha.net)

What to watch

  • The International Coalition for the Return of Ukrainian Children holds a follow-up conference in Toronto, September 28-29.
  • Japan’s new National Intelligence Council panel continues design work toward a foreign intelligence service targeted for 2028.
  • Whether the FBI confirms the scope of the ShinyHunters breach claims it says it is investigating.
  • Whether the UN Security Council responds to Iran’s letter on Europe’s role in US strikes.

Coverage: Sun Sep 27 12:14 ET to Mon Sep 28 06:45 ET. 184 stories scanned from 27 sources.