NATSEC//BRIEF

SYNC OCT 19 06:46 ET

SYS // DAILY BRIEF

Tuesday, September 29, 2026

FILED 06:46 ET 16 STORIES 9 MIN READ

Bottom line: Estonia says Russian intelligence commissioned an arson attack on a defense contractor supplying drones to Ukraine, and German intelligence has visibly stepped up surveillance of the Russian embassy in Berlin, both part of a wider pattern of Russian pressure on NATO states. Trump denied an Axios report that he offered Iran sanctions relief to end their war, even as the Pentagon’s confirmed troop death toll from the conflict keeps rising and Qatari and Pakistani mediators keep working the two sides. The FBI is absorbing a data breach that a hacking group says covers nearly all its employees and the resignation of its co-deputy director, while Putin ordered his fourth troop increase of the year.

Espionage and counterintelligence

Estonia blames Russian intelligence for arson at a Ukraine-linked drone maker. Estonia’s domestic security service, KAPO, said the August 15 fire at a Tallinn facility used by Milrem Robotics, which supplies unmanned ground vehicles to Ukraine, was “a deliberate and pre-planned act commissioned by Russian security services.” Authorities identified and detained the people who carried it out and warned that Russian intelligence continues recruiting for sabotage against European defense firms that support Ukraine. Why it matters: It’s the latest in a run of Russian sabotage operations against NATO-country defense industry and a warning to other arms makers supplying Kyiv. (United24 Media, U.S. News & World Report)

German intelligence steps up pressure on the Russian embassy in Berlin. Bild reported that German security services have visibly increased surveillance of the embassy, including conspicuous helicopter overflights and unmarked vans parked nearby for days, a public campaign meant to unsettle embassy staff. Germany is also tightening screening of Russian businesspeople and their families holding German visas, including pointed border questioning about their activities. Why it matters: Berlin is choosing to make its counterintelligence pressure visible rather than keep it quiet, a shift in posture toward Moscow’s diplomatic presence. (Caliber.Az, citing Bild)

Russian court sentences Ukrainian man to 19 years for espionage. A court in Russia’s Belgorod region sentenced a 36-year-old Ukrainian citizen, born in Zakarpattia, to 19 years in a strict-regime penal colony, ruling that officers of Ukraine’s military intelligence directorate recruited him over Viber in August 2022 to report on Russian troop and equipment locations for payment. Russian investigators did not disclose his name. Why it matters: Russian courts have issued a string of long espionage sentences against Ukrainian citizens since the invasion, part of a broader domestic crackdown on suspected informants. (Mezha.net)

Former Israeli defense minister discloses new details of Mossad’s Hezbollah pager operation. Yoav Gallant said Israel had to move up the September 2024 operation, which killed or wounded roughly 3,500 Hezbollah operatives, after a Hezbollah operative grew suspicious the pagers were rigged; Israel killed that operative and, separately, struck an X-ray machine Iran had sent to inspect the devices, framing both as unrelated strikes to avoid exposing the plan. Why it matters: The account, confirmed by a former official rather than attributed only to foreign reports, shows how close a signature Israeli intelligence operation came to being discovered before it launched. (The Jerusalem Post, VINnews)

US military and intelligence community

Hackers say they stole data on nearly all FBI employees. The extortion group ShinyHunters told Axios it pulled 2 to 3 terabytes of data from the FBI’s criminal justice, HR and medical-services systems, claiming to have records on nearly every FBI agent and job applicant, including names, Social Security numbers, home addresses and in some cases spouse and emergency-contact information; Reuters said it partially verified a 5,000-record sample against credit-bureau data. The group has said it won’t leak the most sensitive material for now, even as an internal FBI memo reportedly assumes the breach covers its full workforce. Why it matters: Personal data on FBI staff, including those working Chinese and Russian counterintelligence cases, could let hostile services identify and pressure the officers assigned against them. (CBC News, Axios, The Record)

FBI co-deputy director Andrew Bailey resigns after about a year. Bailey, the former Missouri attorney general who took the newly created co-deputy director post in August 2025, announced he is stepping down to return to his family in Missouri, thanking Director Kash Patel and expressing confidence he would “continue to reform the FBI.” His co-deputy, Dan Bongino, left earlier this year and was replaced by career agent Chris Raia. Why it matters: It’s the latest senior departure in a bureau that has churned through leadership under Patel, on top of the week’s separate data-breach fallout. (The Hill, Fox News)

Hegseth orders cyber and intelligence agencies to prioritize election defense. Defense One reported the directive comes even as the administration has dismantled or reorganized offices that previously tracked foreign election influence and cut civilian election-security support. Why it matters: Ordering agencies to prioritize a mission while stripping the offices built to run it raises questions about whether the directive can be carried out. (Defense One)

Submarine USS Connecticut won’t return to service until 2027. The Navy had hoped to have the Seawolf-class attack submarine, damaged after striking an uncharted seamount in the South China Sea in 2021, back in service by 2025 and then this year; repairs are still underway and the boat is now expected to serve only briefly before retirement. Why it matters: A years-long repair on a single attack submarine underscores how thin the Navy’s fast-attack fleet is stretched against China’s submarine buildup. (The War Zone)

China, Russia, Iran and North Korea

Trump denies offering Iran sanctions relief as the war’s death toll climbs. Trump called an Axios report a “HOAX” and said he offered Iran nothing, after it reported he was willing to give sanctions relief and release frozen funds in exchange for concrete steps on its nuclear program; Qatari mediators separately met Iranian Foreign Minister Abbas Araghchi in New York as talks continued. The Pentagon’s disclosed US death toll from the war, which resumed with strikes on southern Iran September 1, stands at 19, though officials say the real number is higher. Why it matters: A public dispute over what Washington has offered complicates any diplomatic off-ramp while American casualties continue to mount. (The Hill, The Washington Post)

Putin orders a fourth troop expansion this year as Zelenskyy warns of more North Korean deployments. Putin signed a decree raising Russia’s armed forces to 2.44 million personnel, including 1.55 million active servicemen, the fourth such increase in 2026 amid mounting war losses. Zelenskyy said more than 8,000 North Korean troops are already in Russia and another 10,000 are being prepared for deployment, adding that North Korea is now producing Shahed-type attack drones with Russian technical support. Separately, Russia’s defense ministry said 2027 military spending will rise 27 percent to 17.1 trillion rubles, or about $202 billion. Why it matters: Russia is scaling up manpower, foreign troop support and defense spending simultaneously, signaling it is planning for a war that continues well past this year. (CNBC, Euronews, Defense News)

China rehearses enforcing its claim to Scarborough Shoal. The People’s Liberation Army’s Southern Theater Command ran drone reconnaissance and boarding drills around the shoal, which Chinese state media claimed extends Beijing’s control over contested maritime features beyond 24 nautical miles. Why it matters: Scarborough Shoal is a longstanding flashpoint with the Philippines, a US treaty ally, and repeated drills there keep alive the risk of an incident that could draw in Washington. (USNI News)

Russia holds Duma elections without real opposition. Russia held elections for the Duma, the lower house of parliament, September 18 to 20; observers said the vote may have helped the Kremlin pause before deciding on a second mobilization wave or a formal declaration of war. Why it matters: Even a tightly controlled vote used to give Russians an outlet for discontent, and analysts say that outlet is now effectively closed. (Jamestown Foundation, Foreign Policy)

Germany and Israel

Pentagon tells Congress Germany’s rearmament is an “extraordinary tectonic shift.” Under Secretary of Defense Elbridge Colby told the Senate Armed Services Committee that Germany has taken credible steps toward NATO’s Hague summit spending commitments well ahead of the 2035 deadline, describing a historic transformation after decades of demilitarization. Why it matters: Public Pentagon praise for Berlin’s buildup signals Washington sees Germany as a model for other allies still lagging on the Hague targets. (bluewin.ch, Tagesspiegel, in German)

Bundeswehr rehearses moving NATO reinforcements through Hamburg. The exercise “Red Storm Charlie,” run September 24 to 26, simulated Russia-Baltic tensions escalating into a NATO Article 5 deployment, with troops and equipment arriving through Hamburg’s port for onward movement to the alliance’s eastern flank; the scenario included simulated drone attacks and sabotage, and involved Hamburg’s fire department and technical relief agency alongside the military. Why it matters: It’s a rehearsal of the logistics Germany would have to execute as NATO’s central hub if a real conflict with Russia broke out. (suv.report, in German)

Shin Bet accuses Israeli broadcaster of endangering Netanyahu after United Arab Emirates visit report. Haaretz reported Netanyahu covertly met the Emirati president Sunday, with sources saying he asked him to deny an earlier Haaretz report that the Emirati leader had warned Netanyahu of a Hamas attack more than a week before October 7. Separately, the Shin Bet filed a complaint with Israel’s military censor accusing Channel 12 of endangering Netanyahu’s life over its report on the visit. Why it matters: A domestic fight over press coverage of a foreign-policy trip is now entangled with the unresolved question of what warnings reached Netanyahu before October 7. (Haaretz)

Ex-Shin Bet chief Ronen Bar says he will sue Netanyahu over October 7 warnings. Bar, who led the Shin Bet on October 7, said he instructed his attorneys to file a defamation suit and is demanding Netanyahu’s schedule and all protocols from before the attack, after Netanyahu alleged Bar had warning signs that night but chose not to call him or order an evacuation of the Nova festival. Netanyahu earlier said such reports were part of a campaign to shift blame for the former Shin Bet chief’s “mistakes and crimes.” Why it matters: It escalates a public dispute among Israel’s security establishment over accountability for the October 7 intelligence failure. (Haaretz, The Times of Israel)

Worth reading

What to watch

  • Qatari and Pakistani mediators continue shuttle talks between the US and Iran in New York.
  • Israel’s High Court is due to rule on a petition to give Shin Bet protection to opposition leader Yair Golan.
  • Ronen Bar’s planned defamation suit against Netanyahu over October 7 warnings.
  • Congress continues reviewing the Pentagon’s Europe force posture, which will shape NATO burden-sharing decisions.

Coverage: Mon Sep 28 05:45 ET to Tue Sep 29 06:46 ET. 606 stories scanned from 38 sources.