EMET NEWS PRESS

The Essentials in 30 Seconds

• Poland is not only a NATO front-line state, but an operational pressure space for Russian hybrid warfare against the Alliance’s eastern defence architecture.

• AI does not function as an independent warfighting domain, but as an accelerator for disinformation, target profiling, phishing, social engineering and deception operations.

• Russian operations against Poland do not target only the Polish state. They also indirectly address the sustainment chain of Ukraine’s defence.

• For NATO, the decisive factor is not only defensive capability, but the speed of detection, attribution, communication and response under conditions of strategic ambiguity.

The Essentials in 30 Seconds

Claude Mythos does not mark the confirmed arrival of fully autonomous cyber warfare. It indicates an acceleration of technical vulnerability analysis. The operational core lies in the vulnerability lifecycle: discovery, reproduction, assessment, prioritization and patching become faster, but not automatically reliable. Between a vulnerability finding and a usable attack remain substantial barriers: false positives, target environment, stability, access depth, OPSEC and process knowledge. For hybrid warfare, pressure increases on critical infrastructure, software supply chains, attribution networks and European patch and incident-response structures.

The Essentials in 30 Seconds

Austria’s state protection authority conducted a nationwide focus operation in May 2026 against suspected Islamist-extremist communication and support environments.

Six suspects were arrested, including two minors. Authorities carried out 14 house searches, more than 40 risk-prevention interviews, and additional preventive and control measures.

The allegations include membership in a terrorist organization, dissemination of ISIS propaganda, incitement to terrorist offences, and glorification of terrorist violence.

A concrete attack plan has not been publicly established. The operational focus lies on early intervention, digital evidence preservation, risk-subject management, and the disruption of potential radicalization spaces.

The Essentials in 30 Seconds

Roman Gofman is expected to assume leadership of the Mossad on 2 June 2026, according to international reporting. He succeeds David Barnea, whose five-year term as Mossad director is ending.

Gofman is a major general in the Israel Defense Forces and most recently served as military secretary to the prime minister. He was born in Belarus, immigrated to Israel with his family in 1990 at the age of 14 and later built his military career in the IDF Armored Corps.

His appointment was reviewed by the Senior Appointments Advisory Committee and became subject to High Court proceedings before the transfer of office was allowed to proceed.

The Essentials in 30 Seconds

The French Navy, with tactical support from the UK's Royal Navy, has intercepted the crude oil tanker Tagor in international waters under suspicion of statelessness. The operation was executed based on Article 110 of the UN Convention on the Law of the Sea (UNCLOS) due to irregularities regarding the vessel's flag registration. The tanker, identified as part of the logistics network of the Russian shadow fleet, was diverted to Brest under prosecutorial order for further inspection. This operation signals a transition from passive surveillance to active maritime interdiction and the physical enforcement of sanction-related control measures on the high seas.

Russia’s intelligence services are intensifying operations across the Nordic-Baltic security space. Driven by wartime production pressure, sanctions evasion and technology shortages, Moscow is combining covert procurement, cyber access, proxy logistics and sabotage preparation. Sweden and Finland remain priority targets for aviation, maritime, Arctic and dual-use technologies. Western counterintelligence has improved, but vulnerabilities persist among specialised civilian suppliers, exposed software chains and fragmented response structures. The result is a persistent grey-zone campaign below NATO’s formal escalation threshold.

The Essentials in 30 Seconds

Generative AI transforms open data into operational target profiles: roles, routines, relationships, supply chains, and vulnerabilities become actionable attack vectors.

Spear phishing is shedding its cost barrier. AI automates target reconnaissance, linguistic adaptation, cover story generation, and psychological precision.

Intelligence agencies and military actors utilize AI-driven OSINT analysis for target development, HUMINT recruitment, cyber access, sabotage preparation, and influence operations.

Democracies, armed forces, government agencies, and corporations all face the same risk: open information spaces can be transformed into automated platforms for attacks, deception, and influence operations.

While BfV President Sinan Selen calls for an expansion of the Federal Office for the Protection of the Constitution’s operational capabilities to counter hybrid operations by Russia, China and Iran, Thuringia’s LfV President Stephan Kramer strongly rejects any transformation of the agency into a “real secret service” with executive powers. The disagreement highlights the central operational conflict line: how much preventive capability in the areas of cyber defence and sabotage countermeasures is compatible with the strict information separation principle and Germany’s constitutional foundations.

The Aidinidis case is a security-relevant suspected case involving Iran International. The Munich-based Greek national has been charged in the United Kingdom with allegedly supporting a foreign intelligence service with ties to Iran. Operationally, the case centers on preparatory target reconnaissance—specifically addresses, vehicles, license plates, movement patterns, and allegedly a covert camera. While the connection to Munich does not prove the existence of a German support structure, it opens up investigative lines regarding travel preparations, technical procurement, communications, and financial flows. The presumption of innocence applies.

During Russian Geran-2 mass attacks on Odesa/Danube targets, one UAS violated Romanian airspace and impacted a residential building in Galați. ROAF F-16 QRA and IAR-330 were airborne since 01:19 under Enhanced Air Policing South with weapons release authority. No engagement occurred due to a four-minute low-level reaction window, prohibitive urban collateral risk and restrictive peacetime ROE. Merops C-UAS was not employed in built-up terrain. First confirmed UAS strike with civilian casualties on NATO territory. CSAT reviewing potential ROE adjustments for border Low-Level threats.

A Russian drone strike on a residential high-rise in the Romanian port city of Galați marks an operational turning point on NATO’s southeastern flank. The incident in the border-adjacent urban area highlights the tactical limitations of air defense when facing minimal warning times at low altitudes. While an invocation of Article 5 remains unlikely due to a lack of verifiable military intent, the situation necessitates Article 4 consultations. The event accelerates the strategic debate regarding an extended interception mandate over Ukrainian territory.

Russian sabotage and influence operations are increasing pressure on Europe’s security environment. Robust threat assessments must, however, distinguish between confirmed sabotage, suspicion-based national statistics, intelligence assessments and forensically established attribution. Methodological risk emerges where international case counts, domestic criminal data and political attribution are treated as directly comparable. The issue is not to downplay the threat, but to assess it with operational precision: separating situational suspicion, strategic plausibility and verified hostile responsibility.

In an era of hybrid threats and rapid digital armament, Germany’s Federal Intelligence Service is undergoing a profound transformation. The reform of the BND Act promises greater operational capability — yet how far may a secret service go in a democratic constitutional state without crossing the boundaries of its legal foundations?

On May 22, 2026, Cypriot security forces thwarted a suspected terror attack through an intelligence-driven operation. Two Palestinians, aged 32 and 38, were arrested. Raids near Governor’s Beach and in Kamares, Larnaca, uncovered significant quantities of ammonium nitrate, chemicals, bomb-making components, laboratory equipment, and target maps. The 32-year-old lived legally with his family; the 38-year-old entered illegally. Both remain silent. Authorities are investigating preparation of terrorist offenses and links to criminal networks. The plot targeting a popular tourist area was neutralized in time.

The loss of an untouchable logistical rear echelon forces US Central Command into operational realignment. Permanently hardening the atoll against potential follow-on salvos requires the fixed deployment of strategic high-demand IAMD assets, specifically THAAD and Aegis systems. This forced resource commitment generates critical coverage gaps across other primary axes of conflict, namely the NATO eastern flank and the Western Pacific. Furthermore, it triggers immediate capital expenditures for the accelerated construction of hardened aircraft shelters (HAS) to protect deployed B-2 and B-52H strategic bomber fleets.

The cyber operation against the Los Angeles County Metropolitan Transportation Authority (LACMTA) exhibits classic Iranian-attributed tactics: initial access, systematic lateral movement, large-scale data exfiltration (≥700 GB), and subsequent information operations exploitation. Despite professional execution, the compromise remained limited to administrative IT systems; no penetration of operational technology (OT) environments was confirmed. The group “Ababil of Minab” operated with high discipline and typical proxy-style plausible deniability. The incident highlights the ongoing intensification of hybrid threats against highly visible civilian critical infrastructure.

Russian hybrid operations driven by the GRU are escalating fundamentally across Europe, with incident rates nearly quadrupling into mid-2025. Focused heavily on NATO’s eastern flank, Moscow targets critical infrastructure, logistics, and defense industries. To maintain plausible deniability, the GRU recruits criminal proxies by exploiting migration flows. NATO has shifted to an anticipatory posture: Operation “Baltic Sentry” secures the Baltic Sea, while severe hybrid attacks can now trigger Article 5.

In 2026, Europe reaches a critical inflection point. Under the US National Defense Strategy “Flexible Realism”, Washington prioritises China containment and Homeland Defense, signalling a sharp reduction of conventional forces in Europe. NATO partners must now assume primary responsibility for conventional deterrence against Russia. While US nuclear extended deterrence remains largely intact, Europe faces a five-to-eight-year vulnerability window. This briefing analyses the strategic drivers, critical capability gaps and operational risks of this transition in a high-intensity threat environment.

The independent oversight authority AB-ND issues a stark warning: Switzerland’s Federal Intelligence Service (NDB) has itself become a target of foreign espionage. Serious cyber vulnerabilities, inadequate security controls, and suspected Russian influence operations now threaten the agency’s integrity. Neutral Switzerland is increasingly drawn into the global intelligence war between major powers. Experts demand urgent reforms, stronger protective measures, and tighter controls. Without swift action, the country risks losing highly sensitive data and suffering a serious blow to its national sovereignty. A wake-up call for Bern.

The gradual reduction of U.S. force availability for NATO operations, combined with the strategic shift toward the Indo-Pacific, is reshaping the alliance’s operational planning. At the same time, the war in Ukraine has exposed the growing vulnerability of military logistics, critical infrastructure, and rear-area command structures to hybrid attacks and large-scale drone warfare. European NATO states are increasingly confronted with the challenge of sustaining deterrence, reinforcement capability, and infrastructure resilience under conditions of reduced American high-end support and persistent multi-domain pressure.

A partial U.S. withdrawal from Europe’s security would severely weaken missile defense and early warning capabilities against Russian threats like the Oreshnik IRBM. Europe is accelerating self-reliant solutions: Israel’s Arrow 3 for exoatmospheric intercepts, David’s Sling and SAMP/T for endoatmospheric defense, plus new projects like HYDIS² (Aquila interceptor) and TWISTER. Complementary deep-strike options include the European ELMA cruise missile and FMAN/FMC programs. Fact-checked analysis shows a multi-layered approach combining procurement and indigenous development to close critical gaps and strengthen strategic autonomy.

The Ukraine war represents a structural break in modern land warfare. Unprecedented ISR density, mass employment of FPV drones, and electronic warfare dominance have fundamentally transformed the battlefield. Cheap, expendable systems now outperform traditional platforms, while pervasive surveillance and EW jamming render conventional maneuver nearly impossible. Both sides have adapted through rapid innovation, dispersion, and drone swarms. This conflict signals the end of old paradigms and the dawn of a new era defined by transparency, attrition, and technological asymmetry in high-intensity combat.

Key Finding

The Defense Innovation Unit (DIU) published the "Ground-Based Affordable Mass Prize Challenge" (G-BAM, Project PROJ00672) on 27 July 2026. The solicitation seeks ground-launched long-range weapons with a range of at least 600 nautical miles, a payload of at least 35 pounds, and a flyaway unit cost below $250,000 at scale. The submission deadline is 5 August 2026; a flight demonstration is planned for early November 2026, with scaling into production expected within 12 to 18 months of contract award. The legal basis is the prize-competition authority under 10 U.S.C. § 4025; the DIU states a total budget of up to $250 million for prize execution and follow-on transition activities.

G-BAM joins an already active U.S. portfolio of affordable mass weapons that has bound substantial contract volumes over the summer of 2026 through the Family of Affordable Mass Missiles (FAMM) and Low-Cost Containerized Missiles (LCCM) programs. On the European side, the European Long-Range Strike Approach (ELSA), running since February 2026, and its sub-programme One-Way Effector 500 Plus (OWE 500+) represent a conceptually related but considerably less consolidated undertaking: France has pre-empted the joint study process with a national procurement contract to MBDA. Whether ELSA ultimately produces a shared system or several national solutions under a common name remains open at the current state of knowledge.