May 23: E-Stories
InUkraine SitRep BehindLines Russia-China InEurope InOtherNews Dismantling spyware and spy rings worldwide
Catching up…
For specific news about Trump, his regime and its dealings with Russia, I direct you to Olga’s substack. She and Julie Roginsky publish a weekly podcast, “Pax Americana”, which is highly informative.
For a general view of news from various geopolitical threatres, Scott’s EA Worldview is always superb.
Let’s get going…
Stories we’re following…
2 killed, 23 injured in Russian attacks on Ukraine over past day. Ukrainian air defenses intercepted 63 Russian attack drones and decoy drones launched overnight, the Air Force reported.
Ukraine’s air defense neutralized 112 Russian UAVs overnight, including 74 shot down and 38 jammed via electronic warfare. Russia launched 128 Shahed drones and decoys from multiple directions, along with one Iskander-M missile from Taganrog
Russia plans to connect the occupied Zaporizhzhia NPP to its own energy grid in the coming weeks, per Petro Andryushchenko, former advisor to the Mariupol mayor. Russia built a distribution hub & compressor station near occupied Mariupol & Berdyansk — full-scale use of this new connection is expected within months.
12:02 CET: Ukrainian monitoring channels report a likely preparation for a massive Russian missile strike. The number of Tu-95MS strategic bombers located at airbases used for strikes against Ukraine has increased to 9, and they are being loaded with cruise missiles at multiple airbases: 5 at Olenya, 2 at Engels-2, and 2 at Dyagilevo.
Olena Halushka: The realities in Pokrovsk are dire: non-stop russian attacks make people bury their neighbors in the streets and backyards. Real pressure must be put on russia to stop this -- now. The pressure must be on russia. On the terrorist state.
Ivan Fedorov: An underground school for 1,000 students has been opened in Zaporizhzhia, and will be able to also host kindergarten pupils. It is now the seventh such school in Zaporizhzhia Oblast. Ivan Federov, the head of Zaporizhzhia Oblast Military Administration, said the underground school is located in Zaporizhzhia’s Zavodskyi district. It covers an area of over 1,300 square metres and is designed for 1,000 students, who will study in two shifts.
Russia’s GRU has been accused of hacking thousands of security and traffic cameras across Europe to spy on Western aid shipments to Ukraine — including at rail stations, border crossings, and military sites.
The GRU is waging a cyberattack campaign targeting Western logistics entities and technology companies, including those helping deliver arms and other aid to Ukraine, the Cybersecurity and Infrastructure Security Agency (CISA) said in an advisory Wednesday.
UK intelligence says the same unit behind past cyberattacks used phishing, fake IT staff, and even adult content links to gain access to sensitive data like train schedules and cargo routes. Roughly 10,000 cameras were compromised, mostly in Ukraine, but also in Romania, Poland, Hungary, and Slovakia — part of a broader effort to track and potentially disrupt the flow of military assistance.
The message, issued in conjunction with other U.S. intelligence units and intelligence services in Europe, Australia and Canada, warned of an “elevated threat” posed by GRU military unit 26165. It said the GRU hackers were conducting a “cyber espionage-oriented campaign, targeting technology companies and logistics entities” with a “mix of previously disclosed tactics, techniques, and procedures (TTPs).”
The Russian campaign is likely connected to the GRU unit’s “wide scale targeting of IP cameras in Ukraine and bordering NATO nations,” the advisory said.
Combat Situation
Russia is now fielding nuclear-tipped air-to-air missiles, per U.S. intel. Likely based on the R-37M, this Cold War-style weapon marks a rare and dangerous escalation in Moscow’s nuclear arsenal.
Ukrainian forces report a buildup of Russian troops near the state border in the Kharkiv direction — a possible sign of preparations for new assault operations, says the chief of staff of the "Khartiya" unit.
Ukrainian officials deny Russian troop presence in Dnipropetrovsk Oblast. Serhii Lysak, head of the Dnipropetrovsk Oblast Military Administration, called the online claims "fake" and said that the accompanying photograph allegedly showing Russian troops in the area was also fabricated.
ISW: Putin likely orchestrated a meeting with Kursk Oblast officials on May 20 to set conditions to justify the renewal of Russian plans to seize Sumy City and illegally annex Sumy Oblast.
Russian forces are highly unlikely to be able to seize Sumy City in the near- to medium-term given Russia's demonstrated inability to rapidly seize even much smaller settlements in Ukraine in the past three years.
Russian semiconductor plant making missile, jet parts hit in Ukrainian attack, military says. Ukraine's Unmanned Systems Forces struck Russia's Bolkhov semiconductor plant in Oryol Oblast, which is producing parts for Sukhoi warplanes and Iskander and Kinzhal missiles, the General Staff of Ukraine's Armed Forces said on May 21. The plant was sanctioned by the U.S. last year. It supplies at least 19 Russian plants tasked with producing Sukhoi warplanes and Iskander and Kinzhal ballistic missiles, the Independent reported.
Moscow: Armored vehicles and other vehicles equipped with EW have been deployed around the Kremlin as drone attacks enter their third day. Mobile networks are down, the entire perimeter is fortified.
Ukrainian drones struck into Russia overnight, with explosions reported in Moscow, the Moscow region, and Tula. Among the targets was the Bazalt defense plant — known for producing aerial bombs — which had already been hit in a previous UAV raid. In Tula, local authorities reported damage to industrial buildings.
Explosion of a Russian ammo depot after a Ukrainian FPV drone strike in Novotroitske, Donetsk region.
Russia intercepts drone attack on Moscow, prompting flight disruptions and emergency response. As of 5 p.m. local time, Moscow mayor Sergei Sobyanin claimed seven drones to be intercepted as they approached the Russian capital.
The new commander of the Russian ground forces is Mordvichev. Previously op group center commander (Donetsk front and longest in post as op group commander). His troops were involved in the destruction of Mariupol, mass killings of civilians, and repression in occupied areas. He closely coordinated with Kadyrov's forces and took part in assaults on Kyiv, Donetsk, and Zaporizhzhia regions.
CNN published intercepted calls revealing Russian forces directing the execution of Ukrainian POWs: “Capture the commander, kill the others.”
Behind the Lines
Ashifa Kassam—Update Portnov assassination: witnesses heard 5 or 6 shots ringing out.
Authorities said he had been targeted when he was getting into his car, a black Mercedes-Benz. “Several persons shot him in the back and the head and then fled towards a forested area,” said a source at Spain’s interior ministry.
Local media said Portnov had been dropping off his children at the school, where classes had begun 30 minutes before the shooting. He was found dead when medics arrived and had sustained at least three shots to his body, according to Madrid’s emergency services.
Portnov fled Ukraine shortly afterwards. In 2015, he was reportedly living in Russia and later relocated to Austria. In recent years, he had been the subject of multiple investigations.
In 2018, Ukraine’s security service SBU opened an investigation against him on suspicion of state treason, alleging Portnov was involved in Russia’s illegal annexation of the Crimean peninsula. The criminal case was closed in 2019.
In 2021, the US Treasury department imposed sanctions upon him, alleging that “Portnov took steps to control the Ukrainian judiciary, influence associated legislation, sought to place loyal officials in senior judiciary positions, and purchase court decisions”.
Portnov, who was also the subject of European Union sanctions that were later dropped, appeared to have been living in Madrid since at least April 2024, according to a report by Radio Free Europe/Radio Liberty.
Since Russia launched its full-scale invasion of Ukraine, Spain has been the scene of several high-profile crimes involving Russians and Ukrainians.
WSJ: On a call Monday, president Trump told European leaders that Putin isn’t ready to end the Ukraine war because he thinks he is winning, according to three people familiar with the conversation. U.S. president made the acknowledgment after speaking to the Russian leader this week but backed off on additional sanctions. Yet, a new round of talks -with the Vatican as mediator- is expected in June.
Trump says Russia shouldn’t have been kicked out of the “G8.” At a White House meeting with South Africa’s president, he called the G8 format better than the G7 and said it would be better if Russia were still part of it. He also claimed G7 and G20 wouldn’t matter without the US.
Kyiv Indie Interview: With the fading U.S. global leadership under Donald Trump, Russia's ongoing war against Ukraine, and growing populism at home, Europe faces a stark choice: step up or fall into irrelevance. Speaking with the Kyiv Independent on May 16, British historian Timothy Garton Ash paints a picture of a West in transition. Europe is facing its deepest crisis since 1945 – but therein lies an opportunity, he says. Facing down the Russian threat and galvanizing liberal powers around the world will test the viability of liberal democracy in an increasingly multipolar era, according to the Oxford professor.
Interfax: Russia is prepared to defend its vessels in the Baltic Sea by any available means, while adhering to international law. Peskov was responding to a question about the means Russia would use to protect its vessels.
"By all means available to Russia. A fairly wide range of tools is available. Of course, within the framework of international law," he said.
"As recent events – related to an attempted seizure of one of our tankers – have shown, Russia has demonstrated its ability to respond decisively," he added, commenting on recent incidents involving attempts to detain tankers in the Baltic Sea.
Polish Prime Minister Donald Tusk said on 21 May that a Russian shadow fleet vessel had carried out suspicious manoeuvres near a power cable connecting Poland and Sweden.
“A Russian ship from the "shadow fleet" covered by sanctions performed suspicious maneuvers near the power cable connecting Poland with Sweden. After the effective intervention of our military, the ship sailed to one of the Russian ports. ORP "Heweliusz" is sailing to the scene.” (Translation from Polish)
Poland's defense minister, Władysław Kosiniak-Kamysz, said the incident took place on Tuesday, adding that the cable belonged to Polish grid operator PSE. The company said the cable is working.
Kosiniak-Kamysz added that Poland had launched a patrol flight, adding that the suspicious vessel was effectively deterred.
He said that a special meeting, at which Tusk would be present, would take place on Thursday at the Maritime Operations Center at the Polish naval port of Gdynia.
BILD: Schröder's stance on the Russian gas pipeline: "positive"
"Let me begin with my stance on the Nord Stream 2 gas pipeline, because it has been and continues to be positive," it states on page 1. "Why? During my time as Chancellor, I was always aware that Germany is an industrialized country with few natural resources, whose prosperity can only be increased and maintained if this country is and remains competitive on the global market. But this requires affordable and secure energy for our industry."
"I still believe that electricity from natural gas is currently the better solution." A pipeline is also much more environmentally friendly than a tanker powered by heavy fuel oil that brings us liquefied gas.
"And you certainly want to know whether I also spoke with the Russian president about this pipeline project. Yes, of course," Schröder writes. They discussed the status of the project. "And again, I was and am convinced that Germany will still need cheap gas as an energy source in the coming years to avoid further economic decline."
Meanwhile in Russia & China…
The farse continues: Kremlin spox Peskov says a list of ceasefire terms between Russia and Ukraine will be drafted separately by the parties. Work on the memorandum is “moving dynamically,” and “no one is interested in delays.” The venue for upcoming talks is still to be determined.
Lavrov on the ‘ceasefire’: “No more ‘ceasefire – then we’ll see.’ We’ve been there before, we’re not doing it again.” Russia’s FM says EU plans to rearm Ukraine and slams Macron, Starmer and others for “hysterically demanding” the US join tougher anti-Russian actions.
Putin’s adviser: “The USSR legally still exists,” and the war with Ukraine is an “internal process” Anton Kobyakov, an adviser to Putin, claimed that the collapse of the USSR was allegedly carried out with violations, since the union was not dissolved by the same body that created it — the Congress of People’s Deputies.
Therefore, in his view, the USSR still “legally exists.” On that basis, Kobyakov describes the war in Ukraine not as an international conflict, but as an “internal process.” This statement echoes the ideas of the “USSR citizens” cult, whose members refused to recognize the Russian Federation, didn’t pay taxes or utility bills, and claimed to live in the Soviet Union. In 2022, Russia’s Ministry of Justice declared the group extremist.
Kamil Basaj: The GRU has been conducting an espionage campaign since 2022, obtaining information on supply routes, transshipment locations, and company data, using hacking into email, documents, and employee accounts, as well as private and public IP cameras, to gain operational intelligence to use against Ukraine and its allies.
The SKW and ABW, in cooperation with foreign partners, issued a warning regarding cyberattacks by the Russian GRU (military unit 26165) directed against logistics and technology companies involved in providing assistance to Ukraine, including in Poland.
The report includes recommendations to strengthen security, such as: email protection, strong passwords and two-factor authentication, software updates, and secure management of IP cameras and remote access; the services emphasize that the GRU campaign will continue and poses a real threat.
NYT: The Spy Factor. An investigation into the deep cover Russian spies in Brazil and how the Brazilian authorities have been dismantling it. The Russians located spies in Brazil to take on a Brazilian ‘legal identity’ and build their legacies—illegals. From Brazil, the Russian spies travelled around the world. Video on the NYT article at minute 3:00.
New York Post: Meet Russia’s real-life ‘Americans’ — spies hiding in plain sight
It took decades for the FBI to unravel Russia’s most secret spy program. Now author Shaun Walker, in “The Illegals: Russia’s Most Audacious Spies and their Century-Long Mission to Infiltrate the West” (Knopf), has written a riveting and revelatory history of the Soviet Union’s spy program that asks the reader — do you really know who your neighbors are?
Moscow’s illegals program advanced the concept of using a business executive or other innocent-seeming professional as a spy — sent abroad to embed themselves in Western societies to influence politics, military strategy, international affairs and global security.
“Anyone who met a Russian diplomat asking lots of questions would certainly wonder if their new contact was a spy. But who would suspect a Canadian real estate agent of being a deep-cover KGB operative,” observes Walker, who was able to track down and interview many who were part of the illegals program.
Forbes: Chinese tourism to Russia is booming. In 2024, four times as many Chinese nationals visited Russia through tour operators as in the previous year. Official data show that 106,700 Chinese travelers arrived in the first quarter of 2025 — a 7.9 percent year-on-year increase. Groups of Chinese tourists have become a common sight again, from iconic spots like the Moscow Metro and the Hermitage Museum to less traditional destinations such as the Far North and Far East.
A Chinese intelligence ring, which was active for the past 5 years, has been shattered in Turkey. Its operatives eavesdropped on Uyghurs and Turkish officials using IMSI-catchers, which function as fake base stations to collect data, phone logs, conversations and other information from nearby phones. All 7 Chinese suspects were caught red-handed when their vehicles were found carrying IMSI-catcher devices.
The cell’s leader, citizen identified by the initials ZL, allegedly arrived in Turkey five years ago to establish the groundwork for the intelligence operation. This included setting up shell companies, such as a logistics firm and an import-export company, and learning Turkish to better coordinate the efforts.
The suspects established a sophisticated operation that was self-funded by preying on regular Turkish citizens. They hacked into bank accounts to drain savings for operational expenses, while their primary aim was to collect personal information belonging to Uyghurs and Turkish officials.
The intercepted data, including communication details and location coordinates, was sent directly to a handler in China, whom the spies referred to as the "big boss".
While authorities believe ZL was a specially trained spy, other members did not appear to have specific talents.
France24: A major accident occurred at the launch ceremony for a new North Korean naval destroyer, state media reported Thursday, with leader Kim Jong Un calling the mishap a "criminal act".
At a ceremony to launch a new 5,000-ton vessel in the eastern port city of Chongjin on Wednesday "a serious accident occurred", the official Korean Central News Agency (KCNA) said.
South Korea's military said North Korea also fired "multiple unidentified cruise missiles" on Thursday, which were detected near the North's South Hamgyong province after being "fired toward the East Sea", also known as the Sea of Japan.
Blaming "inexperienced command and operational carelessness" for the destroyer's botched launch -- which was observed by Kim -- KCNA said there was a mishap which left "some sections of the warship's bottom crushed".
Georgia's largest bank, Bank of Georgia (BoG), has banned its Russian clients from making purchases in luxury stores around the world for more than 300 euros. This follows from a letter from the credit institution, which RBC has reviewed. The document states that the restrictions are being introduced in accordance with international sanctions that prohibit the supply of luxury goods to Russia above the specified amount. At the same time, BoG asked to contact it if the client has changed his residency.
Civil.Georgia: On May 22, the Ministry of Internal Affairs announced that 15 foreign nationals had been expelled from the country.
The statement says the citizens of Turkey, Nigeria, Turkmenistan, China, India, Jordan, Egypt, Romania, Bangladesh, Lebanon, Iran, and Russia were expelled and barred from re-entering Georgia in accordance with national legislation.
This announcement comes amid the ruling Georgian Dream party’s legislative push to tighten immigration controls. On May 13, the party passed the legislative package in its first reading with 81 votes in favor and none against. The package introduces expulsions and a ban on reentering the country for a wide range of administrative offenses, including petty hooliganism, disobeying police orders, violating rules on public assembly and rallies, assaulting public officials, and breaking internal travel regulations.
In Europe…
EU officially agrees on 150-billion-euro defense fund. "SAFE is an advantageous, low-interest, multi-year loan guaranteed by the EU budget," the Council of the EU said.
Two-thirds of the 2 million artillery shells pledged by the EU for Ukraine by the end of 2025 have already been secured, says Ukraine’s FM Andriy Sybiha after meeting EU’s High Representative Kaja Kallas. Work continues to close the final third. Talks also covered Ukraine’s EU accession.
The EU unveiled plans to cut red tape for medium-sized companies and abolish barriers for businesses to sell goods across the bloc’s single market as part of its efforts to catch up with China and the United States, AFP reported.
President Macron said Thursday he told his Chinese counterpart Xi that companies from both countries “must enjoy fair competition,” AFP reported.
“Chinese investment is welcome in France. But our companies must enjoy fair competition in both countries,” Macron wrote on X following talks with Xi.
“We agreed to move forward as quickly as possible on the issue of cognac, which is essential for our producers.”
The EU Parliament voted to impose prohibitive tariffs on fertilisers and certain farm produce from Russia and its ally Belarus.
The European Parliament overwhelmingly voted to impose progressive tariffs on nitrogen fertilizers from Russia and Belarus, starting July 1. While current tariffs of 6.5% will remain initially, additional duties of €40-45 per ton will be added by mid-2026. Trade is expected to continue at this level, but tariffs will gradually increase to €430 per ton by 2028, making imports economically unviable.
Chancellor Merz: Germany to deploy troops to Lithuania
The new heavy combat unit, the 45th tank brigade, will be comprised of 4,800 German soldiers and 200 civilian staff. It was announced in response to Russia’s full-scale invasion of Ukraine in 2022 and is scheduled to reach full operational capacity by 2027.
Merz said: “Together with our partners, we are determined to defend the alliance territory against any aggression. The security of our Baltic allies is also our security.”
The deployment, unprecedented for the Bundeswehr, is aimed at shoring up the defence of Lithuania and fellow Baltic republics Estonia and Latvia, former Soviet states that have become Nato and EU members and which fear a Russian attack.
Chagos Islands Deal Blocked: A high court judge has blocked the UK government from concluding its deal to hand over the Chagos Islands with an injunction granted in the early hours of Thursday. The agreement to hand sovereignty over the Chagos islands to Mauritius was due to be given the green light by ministers on Thursday.
The injunction granted at 2.25am on Thursday, brought against the Foreign Office, Mr Justice Goose granted “interim relief” to Bertrice Pompe.
Under the agreement, Britain will cede control over the islands to Mauritius but lease Diego Garcia for 99 years to continue operating a joint US-UK military base there. Ministers have refused to disclose the cost of the lease but it is has been reported to be about £90m a year.
Romania’s Constitutional Court has rejected the defeated ultranationalist candidate’s request to annul the presidential vote as a result of foreign interference. Despite conceding the defeat on Sunday night, George Simion later filed his challenge in a bid to overturn the result which saw him lose to liberal Bucharest mayor Nicuşor Dan.
26 MEPs have urged the EU Commission to halt funding to Hungary over rule-of-law violations by Orbán. “We call on the Commission to increase pressure on Orbán’s government to stop violating EU values and laws,” they wrote to Budget Commissioner Piotr Serafin.
President Aleksandar Vučić addressed questions from EU foreign affairs chief Kaja Kallas regarding his trip to Moscow for the 80th Victory Day anniversary. Vučić emphasized transparency and readiness to discuss the issue, saying: “She was the only one to publicly condemn my trip to Moscow. I had a clear conversation with her and unambiguously explained Serbia’s position. I did not hide. I am sure she will raise this question again. I will not hide under the table or avoid it.”
In other news…
Iran's parliament ratifies 20-year strategic agreement with Russia. While the pact does not include a mutual defense clause, it outlines commitments for both countries to cooperate against common military threats, enhance military-technical collaboration, and participate in joint military exercises, according to Reuters.
NYT: Two Israeli Embassy aides were shot and killed outside an event at the Capital Jewish Museum in Washington, as an event hosted by the American Jewish Committee took place inside, government officials and others said.
Josh Rosenthal: This is from the event at the Capital Jewish Museum, taken by Katie Kalisher. The man being led out by police yells, “free free Palestine.” Kalisher said she did not witness the shooting, but that this man took responsibility for it.
The US has accepted a jet from Qatar for use as Air Force One, the Pentagon announced Wednesday, overriding objections from Capitol Hill about the financial and ethical implications. According to Reuters and other outlets, legal experts have questioned the gift in light of U.S. laws restricting gifts from foreign governments.
Trump Golden Dome and US missile defence with Rus Rumbaugh, Fellow in Missile Defense Project at CSIS.
CNN: US and China are already feuding again after unexpected trade truce
Over the past week, Beijing has repeatedly lashed out at Washington for warning companies against using AI chips made by national tech champion Huawei. It has even accused the Trump administration of “undermining” a consensus reached at recent trade talks in Geneva, where both sides agreed to temporarily roll back tariffs and use a 90-day window to hash out a broader deal.
The conflict over Huawei’s most advanced chips serves as a reality check that despite the positive words shared by US and Chinese negotiators last week, there are still sharp differences between the two sides on a variety of subjects that may be difficult to bridge.
On Wednesday, China’s Commerce Ministry fired its latest broadside, accusing the US of “abusing export controls to suppress and contain China” and engaging in what it called “typical acts of unilateral bullying and protectionism.”
China was responding to the Trump administration’s announcement last week rescinding a set of Biden-era curbs meant to keep AI chips out of the hands of foreign adversaries.
The Cipher Brief: President Trump and Vice President JD Vance berated Ukrainian South African President Cyril Ramaphosa had a tense exchange of his own in the same setting Wednesday. President Trump upbraided Ramaphosa for what he described as the South African government’s failures to protect white farmers from attacks and land grabs.
“We have many people that feel they’re being persecuted, and they’re coming to the United States,” Trump said, according to the Washington Post and other outlets. “They’re white farmers, and they’re fleeing South Africa, and it’s a very sad thing to see.”
Ramaphosa answered the charge – gently but directly. “What you saw in the speeches that were being made — that is not government policy,” he said. “We have a multiparty democracy in South Africa that allows people to express themselves. Our government policy is completely, completely against what he was saying.” Ramaphosa also noted that black South Africans are being killed in large numbers – and suggested that he, Trump, and other leaders seek solutions to all the violence.
Trump has halted foreign aid to South Africa over this issue, and permitted Afrikaners, descendants of Dutch, German and other settlers who speak the Afrikaans language, to immigrate to the U.S. as refugees. The first group of several dozen Afrikaners arrived this month.