The Buddha’s LaughForeign Desk · Letters to the Abbot from the Laughing BuddhaSpy against spy: expulsions, leaks, bugged embassies, recruitment adverts and the denials that follow. Everything here was reported in the open, which is the joke.
Polish police say they have detained a Russian national suspected of acting for a foreign intelligence service, after officers providing security at a football match in Swidnica spotted him near a railway, Reuters reported. He held thousands of images of key sites from several countries, police say, and a court has ordered three months’ detention. Security staff are the only people at a football match paid to watch everything except the football.
US intelligence agencies suspected a woman linked to Megaspeed, a Singapore buyer of Nvidia chips, of informing for Beijing and, watching her, found her in contact with Nvidia’s chief executive, The New York Times says. The president was briefed about a year ago; the chief executive got no “defensive briefing”. Nvidia denies the allegations, and China’s embassy calls them groundless slander. The one person never briefed has now been briefed by the newspaper.
China’s foreign ministry spokesman Guo Jiakun on Friday called the reports “groundless speculations and purely smears and slanders against China,” SBS News reports. The New York Times reported that US intelligence agencies concluded a former executive at Megaspeed International, a Singapore data centre firm and Nvidia customer, acted as an intelligence provider for China, citing their own monitoring of her contacts. In a story about spying for Beijing, the only watching described in detail was done by Washington.
South Korea’s National Intelligence Service told the National Assembly’s intelligence committee that Kim Jong-un may have used his one-day trip to Dandong to convey his intentions on talks with Washington, the committee’s two secretaries said. Its evidence: the North Korean delegation was mainly diplomats, and its foreign minister was seen talking with Wang Yi several times. The agency has deduced diplomacy from the presence of diplomats.
Researchers at TrendAI say the Israeli ad firm Discover-Tech, already linked by Citizen Lab to spyware delivered through adverts, was the top bidder for ad space shown to Starlink users in 105 countries, winning 442 million auctions for about $109,000 and no recorded conversions, Gizmodo reports. No infected Starlink device has been confirmed, and the article carries no response from the firm. Any other advertiser with those results would fire the agency.
America’s Federal Communications Commission has made the first ban under its new rules, barring a wireless video transmitter and a dashboard camera that contain chips from HiSilicon, a Huawei subsidiary on its covered list, The Record reports. Chairman Brendan Carr called such products potential spyware; Huawei did not immediately respond. HiSilicon markets the chips as “designed for the surveillance market.” The commission’s evidence came printed in the sales brochure.
Citizen Lab says the rector of the University of Belgrade had his iPhone infected with NSO Group’s Pegasus this year, through a zero-click exploit, a finding published six days before Serbia’s 25 October election. Pegasus, the Serbian group SHARE notes, is sold only to governments. In September Serbia’s security agency called earlier spying claims “purely trivial sensationalism.” On that sales policy, the sensationalism came with an end-user certificate.
In France’s National Assembly, LFI accused the government of turning intelligence against it, citing a Mediapart report in which a territorial intelligence official said he was told to write that LFI was behind the unrest. Interior Minister Laurent Nuñez called this false and said intelligence services do not work on political parties. Prime Minister Sébastien Lecornu said it had been false since the 1990s. Few denials arrive with a start date.
Austria has expelled four Russian diplomats for “activities incompatible with their diplomatic status,” The Moscow Times reports, bringing expulsions to 18 in six years. In May, Vienna cited an “antenna forest” on Russian diplomatic roofs. Deputy Foreign Minister Dmitry Lyubinsky said “A response will follow inevitably.” The antennas, having no diplomatic status to be incompatible with, are staying.
Russia has declared an unspecified number of Hungarian diplomats persona non grata, Defence24 reports, in retaliation for Hungary’s expulsion in September of 10 of the 47 Russian diplomats accredited in Budapest, for activities “incompatible with the Vienna Convention.” Budapest says its expulsions “do not signify a severance of diplomatic relations with Russia.” Thirty-seven Russian diplomats remain in Budapest to confirm it.
The Pentagon is planning a deep-cover spy program, using nonofficial cover officers for economic warfare against China, the Washington Post reports, as republished by ChinaTechNews. Congressional committees do not appear to have been briefed. A Pentagon spokesman said the query “appears to be built on information that is simply not true.” For a deep-cover program, an official denial is the nearest thing to a launch.
Britain’s MI5 told academics to cut ties with the China General Technology Research Institute, which it says funds research improving the espionage of China’s Ministry of State Security and has reached more than 100 UK-based academics. Beijing, which has denied such accusations before, made no immediate response. The fields included steganography, the art of hiding a message inside something innocent, such as a research grant.
Symantec has tied intrusions at a naval shipbuilder, an engine maker and a police agency in two NATO states to APT28, which The Record links to Russia’s GRU; the report has no word from Moscow. Intruders sometimes stayed “for a few weeks”; one tool’s purpose is unclear. A European defence project with an unclear purpose and an open-ended stay: the GRU has gone native.
The US Justice Department has seized seven domains it says helped hackers working with China’s Integrity Technology Group scan critical infrastructure, its second public move against the firm, after one in 2024. Beijing’s foreign ministry replied that it firmly opposed hacker activities and would seek to tackle such risks jointly with Washington. Washington, in fairness, has been doing its half since 2024.
Germany’s armed forces procurement office signed on 15 October for A1-Falke drones that fire nets at intruding drones, which are increasingly used to spy on military facilities. German media put the deal at about €1.1 billion. A Bundeswehr spokeswoman declined to say how many will be bought, citing “military and operational security.” So far the net has caught only the quantity.
Britain’s innovation agency has given Infleqtion £9 million for the second phase of a quantum direction-finding project: a sensor, built with Italy’s Leonardo, that uses excited atoms to work out where radio signals come from, with uses including electronic intelligence. The companies have not disclosed a timeline for operational deployment. It will pinpoint any signal, once someone pinpoints a date.
The US Department of Transportation says it built “some really robust AI tools” to vet grant applicants, then checks researchers for direct links to Chinese Communist Party leadership or Russian oligarchs. Its AI adviser says it does not want to “go on a fishing expedition.” The tool is missing from the department’s own AI use-case inventory. The system that checks everyone’s disclosures has yet to disclose itself.
August Hanning ran the BND, Germany’s foreign intelligence service, from 1998 to 2005, and is now in pretrial detention, strongly suspected of treasonous espionage. Prosecutors say that from 2010 a former aide, later chief of staff to several of his successors, supplied him with about 2,000 documents over 12 years, for payment, and that Hanning used them in his private consulting work. His lawyer says he is being wrongfully prosecuted. In intelligence nobody truly leaves the service. Some simply start invoicing for it.
Cisco Talos and Recorded Future link a hacking group to Kazakhstan with medium confidence, in part because its activity matches Kazakh working hours. Since January 2025 it has run at least eight campaigns across nine countries, targeting, among others, Uzbekistan’s Smart Forestry initiative. There has been no Kazakh government response. The spies were identified by their punctuality.
Researchers at Citizen Lab and Confiant say an Israeli ad agency, Discover-Tech, used online adverts on more than 120,000 websites and 75,000 apps to track users and help plant spyware, and that a variant of Candiru spyware delivered this way compromised 45 Al Jazeera devices. Malicious ads also appeared on networks linked to the Pentagon, NATO and the UN. Neither company responded; Google removed the firm from its platforms. The adverts were, in the industry’s own word, targeted.
The US embassy in Fiji says “hackers with links to China” breached an unnamed “regional organization in Suva” in July and August. The Pacific Islands Forum says it was not the organisation hacked. China’s foreign ministry said it was not aware of the case and “firmly opposes hacking activities.” The only party nobody has yet identified is the victim.
Britain’s MI5 chief, in his annual threat update, counted “almost 1,000 expulsions” of Russian personnel across the West since the invasion of Ukraine and called “the Kremlin’s global toolkit” weak. He added that MI5 is “devoting more resources to countering state threats than during the Cold War.” A weak opponent, requiring the largest effort in two generations.
The US Justice Department says raids on more than 40 Texas homes seized 187 laptops and other devices used by North Korean IT workers who allegedly earned more than $3 million from about 70 American companies in 17 states. The schemes, a senior official said, “threaten the security of the IT systems and data of the deceived U.S. employers.” Seventy companies, and not one asked to meet the staff in person.
RFE/RL reports that a Russian diplomat Bulgaria expelled in 2021 now serves as assistant military attaché in Serbia, and that leaked records show he once listed a dormitory at the GRU’s Military Diplomatic Academy as his home address. Russia’s embassy and trade mission in Serbia employ 78 people. Neither Belgrade nor the Russian embassy commented. Expulsion, in the Balkans, is a transfer with references.
Germany’s interior minister says the country faces a “shadow war” reaching “far beyond anything seen during the Cold War,” and that Germany “cannot be a second- or third-rate player” as its intelligence service seeks broader powers. Berlin blames Russia for a drone incident at Leipzig airport in August; the Kremlin calls the accusation fabricated, part of an anti-Russian hysteria. The shadow war’s first front is the rulebook.
Montenegro is expelling the founder of the Russian pro-war Telegram channel Rybar, his wife and three employees, saying police “prevented potentially dangerous activity.” He is on EU sanctions lists and entered the country anyway, which he himself put down to a border guard’s incompetence. The sanctions worked perfectly, once he was inside.
This site uses Google Analytics to count visits. No ads, no tracking across sites.