Daily Security Brief: 3 July 2026

Intelligence Brief: 3 July 2026

Sources cross-checked: Reuters, BBC World, Breaking Defense, The Defense Post, War on the Rocks, The Record. Coverage window: 24 hours prior to 08:00 CET. Pro-EU and NATO-aligned sources only.

Global Threat Landscape

• Ransomware campaign hits defence logistics sector [corroborated]
  At least four defence-adjacent logistics and supply-chain firms in Germany, Belgium and the Netherlands report operational disruption after a co-ordinated ransomware campaign. Reuters and The Record have corroborated it independently. The TTPs are consistent with a financially motivated Eastern European group with a known history of targeting the defence sector. The immediate operational risk is disruption to defence procurement pipelines. The secondary risk is exfiltration of sensitive data from firms that handle classified or controlled logistics. Organisations in this supply chain should review supplier access controls, network segmentation and incident response readiness before the next contract cycle.
• APT campaign targets satellite communications across four NATO states
  The Record reports a coordinated intrusion campaign against SATCOM ground-station operators in four NATO member states. The threat actors are seeking persistent access to ISR and command-relay infrastructure. Attribution is preliminary, but the TTPs suggest a state-sponsored actor. Going after ground infrastructure rather than the satellites themselves is a deliberate choice: ground stations are softer targets with the same strategic effect. Organisations that rely on SATCOM for secure communications in sensitive operations should audit the security of their ground-station vendor.
• OSINT-enabled C-suite targeting confirmed as coordinated pattern
  Threat actors are systematically mapping executive travel schedules, residence patterns and social connections through open-source channels in multiple European jurisdictions. They pull LinkedIn, corporate websites, conference speaker lists and social media together into detailed targeting packages. Operational security reviews are recommended for all high-profile principals, starting with those due to travel to high-risk regions.

NATO & Allied Sphere

• Diplomatic CPO demand spikes ahead of summer calendar
  Multiple embassies and multilateral organisations have brought forward close-protection procurement ahead of the July–August diplomatic calendar, and vetted teams are scarce across Western Europe. Minimum lead times are now 10–14 days for standard mandates and 18–21 days for high-profile or complex multi-leg assignments. Missions that have not yet secured protection for summer travel should treat this as urgent.
• BKA, DGSI, and AIVD issue joint advisory on executive targeting [corroborated]
  A joint advisory from German (BKA), French (DGSI) and Dutch (AIVD) intelligence services confirms a coordinated OSINT campaign mapping executive whereabouts across three jurisdictions. It recommends counter-surveillance measures, a reduced digital footprint and operational security audits for every principal assessed as a high-value target. Trilateral publications from intelligence services are rare, and this one assesses the threat as credible and active.

Active Operational Environments

• Iraq: PMF drone activity elevated near Kirkuk energy assets
  Pro-Iran PMF-linked drone activity near Kirkuk energy infrastructure has increased over the past two weeks, and The Defense Post reports confirmed incidents at two separate sites. The pattern is persistent low-altitude surveillance followed by sporadic kinetic probing, which is consistent with pre-attack reconnaissance. Operators with assets in northern Iraq should assess force protection and drone-detection coverage at every fixed site. Physical security reviews are recommended for energy and corporate facilities in the Kirkuk corridor.
• West Africa: convoy security assessments requested pre-Q3 humanitarian ops
  Two NGO security offices have requested logistical corridor threat assessments ahead of Q3 humanitarian operations in the Sahel. Since the French withdrawal, demand for armed escorts has risen in the northern Mali and Burkina Faso corridors. Established route-security arrangements are no longer reliable and have to be rebuilt. Organisations planning Q3 operations in the region should begin hostile-environment safety planning now, because credible convoy-security assessments currently carry lead times of 3–4 weeks.

Request a Tailored Threat Briefing

Mission Support prepares classified-grade threat assessments for governmental and Tier-1 corporate clients working in high-risk environments. Relevant capability: Cyber & Technical Security.