CogDef Brief - April 6, 2026

Summary of recent major cyber incidents, information operations, foreign influence, and espionage activities affecting national security and international relations.

Cyber Operations

FBI declares China-linked hack of surveillance system a “major cyber incident.” The FBI notified Congress that suspected Chinese hackers breached a government surveillance system by leveraging a commercial ISP’s vendor infrastructure, a method consistent with previously documented Chinese cyber tradecraft. The breach poses risks to U.S. national security, potentially exposing details about operatives and assets under active FBI monitoring. HSToday reported the FBI described the group’s tactics as “sophisticated” and consistent with known Chinese state-sponsored operations.

European Commission breach worse than initially disclosed. CERT-EU attributed a major cyberattack on the European Commission’s cloud infrastructure to the TeamPCP threat group, with the notorious ShinyHunters gang responsible for leaking the stolen data. Approximately 90 GB of data was published online, impacting at least 30 EU entities. CERT-EU said the breach originated from a vulnerability in the Trivy platform that cascaded across Commission systems.

Iran-linked cyber operations escalate against U.S. targets. An Iran-linked group calling itself Handala claimed responsibility for a cyberattack on Stryker Corp., a Michigan-based medical device maker, carried out on March 11 in claimed retaliation for the U.S.-Israel conflict with Iran. The attack disrupted Stryker’s Microsoft systems, affecting order processing, manufacturing, and shipping. Stryker now faces federal lawsuits alleging cybersecurity gaps that exposed employee data. Separately, BankInfoSecurity reported that Iran-linked actors are using ransomware as cover for disruptive operations, while a TrueConf zero-day was used to target Southeast Asian governments.

Trump FY27 budget proposes cuts to CISA, restructure of DHS intelligence. The administration’s fiscal 2027 budget would cut hundreds of millions from CISA and fold DHS’s Office of Intelligence and Analysis into the secretary’s office, a move that would require congressional approval and could reshape oversight of domestic intelligence collection. The administration had already halved I&A staffing last year.

Information Operations

Fake videos spread online following U.S. aircraft losses over Iran. After two U.S. military aircraft — an F-15E Strike Eagle and an A-10 Warthog — went down during operations near Iran, fabricated and misleading videos began circulating across social media. Separate unverified claims that Iran shot down a search-and-rescue helicopter also spread. The information environment around the ongoing U.S.-Israel-Iran conflict continues to be heavily polluted by unverified footage and competing narratives from state and non-state actors.

Russia conducted covert disinformation campaign against Argentina’s Milei. An international media consortium reported that a network linked to Russian intelligence services carried out a secret campaign against President Javier Milei’s government in 2024, based on leaked documents. Russian agents reportedly infiltrated Argentine media outlets to disseminate anti-Milei narratives. The operation is consistent with broader Russian information warfare targeting governments perceived as Western-aligned.

Romania faces sustained cyber and disinformation campaigns. A BankInfoSecurity weekly roundup noted that Romania continues to experience coordinated cyber and influence operations, though attribution details remain limited. This follows a pattern of Russian-linked interference documented during Romania’s 2024 election cycle.

Foreign Influence

Chinese firms market AI-derived intelligence on U.S. forces in Iran. The Washington Post reported that private Chinese technology companies — some with ties to the Chinese military — are marketing intelligence on movements of U.S. forces in Iran, even as Beijing officially seeks to maintain diplomatic distance from the conflict. The activity highlights the blurring line between commercial Chinese AI capabilities and state intelligence collection.

China and Russia position themselves diplomatically on Iran conflict. China put forward a five-point proposal with Pakistan to mediate the Iran crisis and rallied Gulf support, while opposing a UN proposal to authorize force in the Strait of Hormuz. Russia, China, and France vetoed a Security Council resolution that would have authorized military action to reopen the strait. Russia and China also joined Iran for naval drills near the Strait of Hormuz, signaling solidarity with Tehran.

Hungary espionage suspicions roil Brussels ahead of April 12 elections. Le Monde reported that a leaked phone conversation between a journalist and a European Commission spokesperson has fueled mistrust toward Budapest, whose positions closely align with the Kremlin’s. A former Czech intelligence chief described Hungary’s conduct as “disgusting and incomprehensible”, citing leaked recordings showing Hungarian Foreign Minister Péter Szijjártó receiving instructions from Moscow. The revelations raise concerns about Budapest sharing sensitive EU information with Russian intelligence.

FISA Section 702 reauthorization deadline looms. Congress faces an April 20 deadline to reauthorize FISA Section 702, the electronic surveillance authority central to U.S. foreign intelligence collection. The debate continues to pit national security imperatives against civil liberties and privacy concerns.

U.S. lawmakers press DHS on ICE use of foreign spyware. Rep. Summer Lee and colleagues issued a joint statement criticizing DHS’s response to inquiries about Immigration and Customs Enforcement’s use of foreign-made spyware, vowing continued congressional oversight of the practice.

Espionage

Israeli citizen indicted for espionage via Al Jazeera recruitment. Israeli security services disclosed that Mekdad Natour, a former police interpreter, was indicted for espionage after being recruited through the Qatari channel Al Jazeera to relay sensitive information to hostile channels during wartime.

India’s NIA raids in Pakistan-linked espionage probe. India’s National Investigation Agency conducted raids in Haryana, detaining eight suspects as part of a Pakistan-linked espionage investigation.

CIA journal: AI may push return to old-school spycraft. An article in the CIA’s Studies in Intelligence journal argues that AI may erode trust in electronic communications, potentially driving intelligence officers back toward traditional, human-centric espionage tradecraft as deepfakes and AI-generated content undermine confidence in digital channels.