NATSEC//BRIEF

SYNC OCT 19 06:46 ET

SYS // DAILY BRIEF

Monday, October 5, 2026

FILED 06:46 ET 14 STORIES 8 MIN READ

Bottom line: The FBI arrested a California woman accused of acting as an unregistered Chinese agent who surveilled Taiwan President Lai Ching-te’s son in the US, a case Taiwan’s government calls transnational repression. Germany’s BND and BfV chiefs told parliament Russia is waging a “shadow war” against the country, while in Israel new reporting shows the National Security Council and Shin Bet warned for a year that the Transportation Ministry was failing to screen foreign flight crews before last week’s attempted flydubai hijacking. Iran kept the Strait of Hormuz closed and Saudi-backed Yemeni forces launched a major offensive against the Iran-backed Houthis.

Espionage and counterintelligence

FBI arrests a California woman accused of spying for China on Taiwan’s president and his family. Wanying “Heather” Zhang, 34, of Irvine, was arrested at Los Angeles International Airport as she allegedly prepared to board a flight to Shanghai. Prosecutors allege Zhang traveled to Seattle in 2025 at the direction of people believed to be Chinese government officials and photographed the residence, vehicles and relatives of Ting-Yu Lai, son of Taiwan’s president, later passing license-plate details and other information to her alleged Chinese contacts. Taiwan’s presidential office called it a “typical case of transnational repression.” Why it matters: Beijing is using its intelligence apparatus against a foreign head of state’s family on US soil, not just against Taiwanese officials at home. (CNN, CBS News)

A joint investigation ties the Leipzig airport drone plot to a Russian military intelligence sabotage unit. The Telegraph and Welt am Sonntag identified Oleg Levushkin, a Russian national who traveled Europe by motorcycle, as the suspected organizer behind last month’s failed drone attack on a Ukrainian cargo plane at Germany’s Leipzig airport, reporting he directed a Belarusian intermediary to carry out the plot. The outlets say Levushkin has long-standing ties to Denis Smolyaninov, a GRU colonel who heads a sabotage department in the agency’s Special Activities Service, and link the operation to the same unit, 29155, accused in the Skripal poisoning. Why it matters: It’s the clearest evidence yet that a known GRU sabotage unit, not just freelance operatives, is behind the plot Berlin has pointed to as proof of Russian hybrid attacks on German soil. (Meduza)

US, Japanese and German agencies tie North Korean hackers to a $10.7 million fake-job crypto theft scheme. A joint advisory from the FBI, Japan’s police and cybersecurity agencies, Australia’s Signals Directorate and Germany’s BND and BfV says a North Korean group called WaterPlum, also known as Contagious Interview, posed as recruiters for AI, crypto and NFT companies to lure software developers into sham job interviews, then infected more than 30,000 devices in over 100 countries with malware disguised as coding tests. The advisory says WaterPlum drained roughly 7,000 crypto wallets and that its operators answer to the same North Korean military bureau as the regime’s overseas IT worker schemes. Why it matters: North Korea is running state-directed cyber theft at industrial scale to fund itself, and enough governments now agree on the attribution to co-sign a joint warning. (FBI/IC3)

A California man is charged with smuggling $300 million in Nvidia-equipped servers to China. Prosecutors indicted Greg Lui, 38, of San Gabriel, who owns Earthmade Computer, an authorized distributor of Super Micro servers built around high-end Nvidia processors, alleging he routed export-controlled hardware through Malaysian and Singaporean freight forwarders before it was reshipped to China. Prosecutors say Earthmade received more than $176 million from two Malaysia-based shipping firms between January and October 2024 as part of the scheme; Lui faces conspiracy, smuggling and money-laundering charges carrying up to 50 years. Why it matters: It’s another case of US export controls on advanced AI chips being routed around through third countries rather than broken head-on. (Justice Department)

An Indian Navy sailor is arrested after a honeytrap led to leaked base and fleet details. Indian authorities arrested Pradeep Mukherjee, a sailor with the Eastern Naval Command in Visakhapatnam, after a months-long social-media relationship with a Pakistani handler allegedly led him to disclose naval assets, fleet movements and operational arrangements at the base; a counterintelligence cell said it had tracked his suspicious digital activity before the arrest. Why it matters: It’s a reminder that Pakistani intelligence keeps finding success recruiting junior personnel through online relationships rather than traditional tradecraft. (Firstpost)

US military and intelligence community

Trump puts his intelligence chief in charge of a new AI task force. President Trump named Director of National Intelligence Jay Clayton to lead a new “Super Intelligence Force,” which also includes FTC Chairman Andrew Ferguson, Pentagon chief technology officer Emil Michael and OPM Director Scott Kupor; Clayton said the group has 120 days to report on AI’s risks and opportunities and recommend a federal role. Why it matters: Putting the nation’s top intelligence official at the head of AI policy signals the administration sees the technology primarily through a security lens. (BBC)

The Pentagon’s new defense strategy doubles down on denying China the Pacific, and says it needs more munitions. A Defense Department report to the Senate Armed Services Committee on the 2026 National Defense Strategy reaffirmed plans for a forward-deployed “area denial” network along the First Island Chain meant to deter China, with officials saying the approach depends on expanding stocks of high-end munitions. Why it matters: The strategy is only as credible as the munitions behind it, and officials are now saying publicly that the stockpile isn’t there yet. (USNI News)

The Army stands up a new command for autonomous systems. Acting Army Secretary Adam Telle signed a memo creating Army Futures and Autonomous Systems Command, or FASCOM, to oversee acquisition of drones and robotic systems. Why it matters: Folding autonomy acquisition into a dedicated command is a structural bet that unmanned systems are now central to how the Army buys equipment, not a side program. (Breaking Defense)

The US pulled every bomber out of RAF Fairford after a security scare tied to an alleged Iranian-linked plot. A Defense Department official confirmed B-1, B-2 and B-52 bombers deployed to the UK base have all returned to the US, days after British police arrested five men, including a dual UK-Iranian national, near the base over suspicious vehicles; UK officials have said there are “strong indications” Iran played a role. Why it matters: Pulling an entire bomber contingent off an allied base, rather than just tightening security, shows how seriously Washington and London are treating the threat. (BBC, CBS News)

China, Russia, Iran and North Korea

Iran says the Strait of Hormuz stays closed until Washington meets its conditions. Tehran said it has offered to reopen the waterway within seven days but accused the US of fixating on the nuclear issue while Iran wants talks focused on Hormuz; Iran has kept the strait closed amid its war with the US. Why it matters: A continued closure keeps a major oil chokepoint off-limits and gives Tehran leverage it is explicitly using to shape what the talks are about. (Haaretz)

Saudi-backed Yemeni forces launch a major offensive to retake Houthi-held territory. Yemen’s government said it is launching a campaign to recapture all areas held by the Iran-backed Houthis, days after Houthi drones and missiles struck a Saudi Aramco facility near Riyadh; the Yemeni president said the operation would continue until the country is “liberated” from the group. Why it matters: A full offensive would mark the most direct escalation of the Saudi-Houthi conflict in years, with Riyadh’s air defenses already strained by other fronts. (Defense News, Haaretz)

Taiwan receives its first new F-16s after a 20-year wait, as China pressure builds. Two F-16V Block 70 fighters, the first of 66 ordered in 2019, landed at an airbase in eastern Taiwan after years of delivery delays. Why it matters: The jets are a small but overdue addition to Taiwan’s air defenses at a moment when Beijing’s military pressure on the island keeps increasing. (Defense News, The War Zone)

Germany and Israel

Germany’s intelligence chiefs tell parliament Russia is waging a “shadow war” against the country. At the Bundestag’s Parliamentary Control Panel, BND President Martin Jäger said Germany “is in danger of being drawn into a violent conflict with Russia,” pointing to the failed Leipzig airport drone attack as evidence, while BfV President Sinan Selen said Russia had “crossed red lines” through hybrid operations ranging from disinformation to attempted attacks and BAMAD chief Martina Rosenberg warned of efforts to erode public trust in the state’s defenses. Why it matters: It’s Germany’s own intelligence leadership, not just politicians, publicly describing Russian hybrid activity as an active conflict rather than a future risk. (Verfassungsschutz.de, in German, ZDFheute, in German)

New reporting shows Israel’s own oversight bodies flagged the flydubai screening gap more than a year before the hijacking attempt. Haaretz reported that Israel’s National Security Council warned last year that the Transportation Ministry had failed to take over screening of foreign airline crews from Shin Bet as planned back in 2021, and that Transportation Minister Miri Regev responded to Shin Bet’s warnings by saying “we are not an intelligence agency.” The dispute is still unresolved: Shin Bet is now demanding new security scanners at Dubai’s airport before roughly ten flydubai return flights planned for Monday can proceed. Why it matters: The screening gap behind this month’s hijacking attempt was identified and left unfixed well before it was tested, and the same dispute is now holding up the flights meant to resume service. (Haaretz, Haaretz)

Worth reading

What to watch

  • Whether roughly ten flydubai return flights to Israel planned for Monday proceed, which depends on resolving the standoff over new Shin Bet-demanded security scanners in Dubai.
  • Whether Iran’s offer to reopen the Strait of Hormuz within seven days of a sanctions deal gains any traction with Washington.
  • Whether Saudi Arabia follows through on the Yemeni-led offensive against the Houthis or shifts toward Turkish- and Pakistani-brokered diplomacy instead.
  • Greg Lui’s arraignment in federal court in Los Angeles over the alleged $300 million export-control smuggling scheme.

Coverage: Fri Oct 02 05:45 ET to Mon Oct 05 06:46 ET. 759 stories scanned from 37 sources.