MOVEit Exploit - Clop Ransomware Gang
In Global Guardian's monthly Risk Barometer, our Intelligence Team highlights current global hotspots with the potential to impact your business operations and travels. Read below for analysis on the threats we are closely monitoring this month and click here to subscribe for regular intelligence updates, including this monthly report.
The start of June ushered in a new phase of the Russo-Ukrainian conflict creating geopolitical uncertainty and elevating the prospects of escalation risks. In Russia, Ukrainian and Ukrainian-affiliated groups have stepped up attacks. In Ukraine, the Armed Forces of Ukraine (AFU) ostensibly began its much-anticipated summer offensive in Zaporizhihia and Donetsk Oblasts leveraging some of its new Western hardware. Meanwhile, the Kremlin is readying the deployment of tactical nuclear warheads to Belarus set for July delivery and the Russian Ministry of Defense (MoD) is taking its first steps to subordinate the Wagner Group.
In what appears to be an intentional demolition, on 06 June, the Nova Kakhovka dam was destroyed in a move to ostensibly consolidate Russian lines and prevent Ukraine from mounting cross-river landings in Kherson Oblast ahead of the Ukrainian counteroffensive. On 07 June, the AFU launched a major push in its counteroffensive against Russian forces across an approximately 150km long front on three axes: the Vuhledar axis, the Velyka Novosilka axis, and the Orikhiv axis. The presumed intent of the counteroffensive is to break Russia’s land bridge which spans from Rostov-on-Don to Crimea along the Sea of Azov. This surge marks the most combat activity since the summer of 2022.
In the first four days of the operation, the Ukrainians liberated more than 60 square kilometers of territory.
The war is now entering its fifth phase and most important phase. The first four phases comprised Russia's ill-fated attempt at regime change at the start of the war, an attritional artillery campaign in the Donbas, Ukraine’s two-pronged counteroffensive in Kharkiv and Kherson oblasts, and the reconstitution of both forces: Russia conscripted, trained, and dug-in while maintaining pressure focusing on Bakhmut; and Ukraine received tanks, artillery, and air defenses and were trained how to use them.
The stakes are high for both sides as Ukraine needs to prove to its Western benefactors that all the military aid is moving the needle and can facilitate Ukraine achieving its strategic goal of breaking Russia’s land bridge. Failure in the counteroffensive will have dire consequences for the Zelensky regime in terms of the scope of future aid and the political future of the current cast of disparate actors leading Ukraine. Meanwhile, the regime in Moscow is highly brittle. Should failures continue to compound, and fissures widen between the Ministry of Defense and Wagner, the cast of oligarchs whom President Putin presides over may turn their sights on each other.
We can expect the following in the near-term:
Key TakeawaysThe summer counteroffensive has begun and there is no indication how long it will last or how successful it will be. What we do know is that, both sides are manufacturing chaos – attacks within Russia and the destruction of the Kakhovka dam – bringing more short and long-term uncertainty into the mix. Without air superiority, Ukraine’s mechanized attempts to break Russian lines will be challenging. The outcome of this summer offensive will have an impact on political stability in both nations, and more serious nuclear threats can be expected. |
Deadly unrest has broken out across Senegal following the conviction of leading opposition figure Ousmane Sonko. Several protesters and members of the security forces have been killed or wounded by live ammunition. While the situation has stabilized somewhat since the height of clashes late last week, the potential for an escalation of violence or severe travel and communication disruptions remains very high. The situation is likely to deteriorate rapidly should Sonko be taken into custody.
So far, at least 15 people have been killed, 350 injured - 78 of whom are in serious condition – and more than 500 people have been arrested. Multiple people have been killed or wounded by live ammunition, and security forces have made heavy use of teargas. Internet and mobile communications are being regularly suspended by the government to disrupt the organization of protests via social media. Under the Macky government there has been an increase in police killings and lack of accountability.
Demonstrations erupted across the country after news broke of Ousemane Sonko’s conviction on charges of “corrupting the youth,” which carries a two-year prison sentence and precludes him from standing in the upcoming elections slated for February of 2024. The government of President Macky Sall has responded to the unrest by mobilizing riot police and the army to quell the demonstrations. The government has also been imposing an internet “curfew” from 13:00 to 02:00 (local time) since 06 June.
Sonko supporters have burned, looted, or otherwise destroyed dozens of buildings, including banks, supermarkets, and – notably – the law faculty of Dakar University, which demonstrators pointed to as a symbol of a judiciary that has lost their confidence. Protesters blocked several major thoroughfares, including the Axis VDN highway leading north from Dakar, although security forces had begun the process of reopening most of these routes by Monday morning. Sonko has repeatedly called on his supporters to engage in anti-government protests since his original detention in 2021.
Tension in Senegal had been steadily rising throughout the trial of Ousmane Sonko, who stood accused of “corrupting the youth,” and the rape of a 20-year-old woman employed at a massage parlor. Sonko was convicted on the charge of “corrupting the youth” which entails using one’s position to have sex with someone under 21 years of age. However, he was acquitted of the rape charge, as well as of charges of intimidation and death threats. Sonko maintains that all the charges against him are politically motivated and part of Macky Sall’s attempt to remain in office unconstitutionally.
While Senegal’s presidency is constitutionally limited to two terms, President Sall has indicated that he may be planning to run for a third term. Sall argues he is eligible on the grounds that constitutional changes made in 2016 that shortened the presidential term unfairly truncated his electoral mandate. Sall’s refusal to dismiss the possibility of his running for a third term and the timing of Sonko’s legal troubles indicate a possible slide towards authoritarianism. Senegal has traditionally been a bastion of democracy and stability in the region. However, the benefits of recent economic growth have failed to materialize for large portions of Senegal’s population, particularly the youth.
Religious leaders have offered to mediate talks between the Sonko and Macky camps. It is possible that these talks, combined with international pressure, may put Senegal on a path towards peaceful resolution of the crisis. Senegal’s democratic institutions are relatively robust and a descent into outright authoritarianism is not probable. The Senegalese judiciary has stated that Sonko could appeal his conviction from prison.
Key TakeawaysThe security situation in Senegal is likely to rapidly deteriorate if Sonko is taken into custody. If Sonko is not allowed to stand in the upcoming election there is a high likelihood that another wave of unrest will materialize and intensify in the run up to the election. |
Violence erupted between ethnic Serb protesters and Kosovar security forces on 29 May in northern Kosovo. Diplomatic pressure from the U.S. and EU has stabilized the situation for now. But maximalist demands on the parts of both Kosovar Prime Minister Albin Kurti and Serbian President Aleksandr Vucic, compounded by intense political pressure in Serbia, threaten to upend a fragile regional stability.
Clashes took place in the overwhelmingly ethnically Serb municipalities of Zvecan, Leposavic, Zubin Potok and Mitrovica where at least 50 Serb protesters, and 30 NATO troops assigned to the Kosovo Force (KFOR) peacekeeping mission were injured in the confrontation. Demonstrators armed with rocks, tear gas, Molotov cocktails, and police batons attacked Kosovar security forces and NATO peacekeepers, ten of whom were left in serious but stable condition with several suffering gunshot wounds. NATO has since augmented its presence in the area with a contingent of several thousand Turkish commandos. Serbia’s armed forces are on combat alert with elements stationed near the Kosovo border. Travel within northern Kosovo and crossing between Kosovo and Serbia will be hampered by increased security presence and the probability of future clashes.
The unrest was precipitated by Kosovo’s decision to proceed with municipal elections following the mass resignation of Serb representatives in November of 2022 in response to a controversial mandate requiring Kosovar license plates throughout the country. Serbian Kosovars boycotted the election with support from officials in Serbia who demanded the recognition of the Association of Serb Municipalities (ASM), before elections take place. As a result of the boycott, a cohort of largely ethnically Albanian representatives was elected to the Serb majority municipalities by less than five percent of the electorate. The clashes occurred when Serb demonstrators attempted to gain access to municipal buildings where the new mayors had taken up their posts.
Kosovo, which is predominantly ethnically Albanian, unilaterally declared independence from Serbia in 2008 with NATO support. Serbia does not recognize Kosovo’s independence, and Kosovar Serb’s consider themselves citizens of Serbia. A brutal 1999 war between Kosovar Albanians and Serbia characterized by ethnic cleansing and other crimes against humanity culminated in a NATO bombing campaign centering on Serbia’s capital, Belgrade. A NATO contingent has been present in Kosovo since the end of the war, and both countries aspire to EU membership, facts which lend significant leverage to the U.S. and EU.
Substantial diplomatic pressure from the U.S. and EU – including the immediate cancellation of a planned NATO military exercise and threats to freeze Kosovo’s path to EU and NATO membership – resulted in Prime Minister Kurti stating an openness to redoing the municipal elections. However, President Vucic, a hardline nationalist, has reiterated his demand that Kosovo recognize the ASM before any new elections are held. Recognition of the ASM is a key component of the EU path to normalization proposal tentatively agreed to by Kosovo and Serbia in March. Kurti – whose political position is characterized by uncompromising Kosovar sovereignty – has voiced continued opposition to the recognition of the ASM, citing the Republika Srpska in neighboring Bosnia and Herzegovina which leverages its legal status and threats of secession to exercise an outsized level of influence in Bosnian politics.
The domestic political situations in both Kosovo and Serbia may exacerbate the current crisis. Vucic’s political position is dire. Two high-profile mass shootings in Serbian society have resulted in tens of thousands of Serbians taking to the streets in opposition of Vucic’s government. Large scale protests have occurred weekly since 08 May. In response, Vucic, in keeping with past nationalist leaders, is very likely to lean more heavily on energizing his nationalist base through increasingly provocative stances in Kosovo. The amelioration of the situation is further hampered by Kurti’s hardline politics, which feed into Vucic’s in a self-perpetuating cycle of vilification, rhetorical escalation, and ethnic tension.
KEY TAKEAWAYSThe situation is likely to destabilize as opposition to Vucic mounts and his party comes to rely more heavily on banner waving in defense of Kosovar Serbs. Further instances of violence in northern Kosovo are probable, and large-scale protests in Belgrade may become violent as the crisis develops. |
"This is an attritional war for Russia, which thinks it can outlast Kyiv with its superior ability to manufacture artillery and quantitative advantage in potential manpower."
In USA Today, Global Guardian Senior Intelligence Analyst Zev Faintuch discusses the collapse of the Nova Kakhovka dam, including the implications this significant event will have on the movement of Ukrainian forces and Russia's strategy in the war.
“The shaping of the battlefield is happening now for the counteroffensive. We see the attacks behind enemy lines, we see the attacks in Russia by those militias. We see the drone attacks in Moscow. That is all shaping what is coming next.”
In Al Jazeera, Global Guardian Vice President of Client Risk Management Seth Krummrich discusses the on-the-ground realities in Bakhmut—and how a Ukrainian counteroffensive is building next in the Russia-Ukraine war.
"If you can be perceived as an intelligence asset of any kind…you simply shouldn’t get on the plane. That’s the new calculus."
With Bejing's new anti-espionage law and the rise in other business travel-related risks, Global Guardian CEO Dale Buckner weighs in with advice in The Wall Street Journal for executives—especially those who have previously worked for the U.S. government—who plan to visit China.
“As procurement of drones have become far simpler, tools once exclusively available to modern militaries and cutting-edge developers are now falling into the hands of dangerous non-state actors, forever altering the national and corporate security landscape.”
In an article for ASIS International’s Security Management Magazine, Senior Intelligence Analyst Zev Faintuch discusses the eminent security threat of commercially available drones (CADs)—as highlighted in Global Guardian's Worldwide Threat Assessment—including how these devices can potentially be used by nefarious actors and why it may take years to close the countermeasure gap.
On 17 May, President Guillermo Lasso dissolved Ecuador’s National Assembly using a constitutional rule known as muerte cruzada (“mutual death”). Lasso was facing an impending impeachment vote over alleged corruption that he was likely to have lost. In a statement, the military pledged to support the embattled President, affirming the constitutionality of Lasso’s move and warning against those who pledged to protest the move, stating that it “won’t accept any attempt to alter the constitutional order through violence.” Snap elections for both the Presidency and the National Assembly are now required to be held within three months. Though President Lasso can now rule by decree for up to six months.
“Have a backup plan on how to get to your destination, whether that means taking a car instead of traveling by rail, or a secondary airport to fly into/out of if a strike is planned during your vacation.”
With the summer travel season around the corner, Global Guardian Director of Intelligence Michael Ballard sat down with HuffPost to discuss how strikes can impact your travel plans and offered guidance in the event you encounter protests in the middle of a trip.
In Global Guardian's monthly Risk Barometer, our Intelligence Team highlights current global hotspots with the potential to impact your business operations and travels. Read below for analysis on the threats we are closely monitoring this month and click here to subscribe for regular intelligence updates, including this monthly report.
On 14 May, Turks will go to the polls to elect both their president and parliament in the highest stakes election in a generation. A second round between the two top presidential contenders will take place on 28 May unless the 14 May poll produces a clear presidential winner with more than 50% of cast votes. Due to the tightness of the presidential and parliamentary races and high projected turnout, few expect the losing bloc to accept the election result. Not only is the outcome likely to be disputed, but there is also an elevated risk of security incidents in the final days through election day and the potential run-off process.
The incumbent, Recep Tayyip Erdogan and his Justice and Development Party (AKP) have won the last five parliamentary elections, two presidential polls, and three referendums. He even thwarted a military coup in 2016. Yet this election could spell an end to Erdogan and the AKP’s tight grip on power for the last 20 years. Per Türkiye’s historical record, a peaceful transfer of power would be unprecedented: no modern Turkish president has been ousted by way of the ballot.
29 April – The leader of the Islamic State (IS) militant organization, Abu Hussein al Qurashi, was killed in a Turkish security raid in Syria.
25 April – Police in Diyarbakır, Diyarbakır arrested 110 individuals in a counter terror raid that the pro-Kurdish People's Democratic Party (HDP) decried as an act of voter suppression.
22 April – Two shooters opened fire at an AKP election campaign office in Gungoren district, Istanbul.
20 April – The Supreme Election Council of Türkiye (YSK) ruled to exclude the opposition coalition, the Republican People's Party (CHP) and Iyi Party, from participating in the 14 May general election under the "Nation Alliance" banner in an ostensible effort to confuse voters.
20 April – A shooting was reported at the Cukurova AKP district office in Adana Province.
06 April – A shooting was reported outside an opposition Republican People's Party (CHP) office in Istanbul.
Economic
Humanitarian
Political
A Close Race – preliminary results should come in overnight on 14-15 May, and the Supreme Election Council are expected to declare unofficial results within the following two or three days. But certain delays can be expected, especially with the logistical challenges associated with polling in the earthquake affected areas and over a million early expatriate ballots being collected from abroad. What’s more, with a three-man presidential race, there is a high likelihood that neither Erdogan or Kılıcdaroğlu can secure more than 50% of the vote without a run-off. Tensions will be higher in provinces where no single presidential candidate or political party have a clear dominance, fueling allegations of election fraud or voter suppression.
Acute Security Incident(s) – Largescale terror attack(s) targeting voters or political rallies cannot be ruled out. Jihadist groups (including IS), Kurdish independence groups, or government-connected actors (false flag operation) all have the motivation and capability to conduct an attack. In this scenario, martial law would be declared and the election tabulation will be put on hold until the government can reestablish law and order. A major attack could be used to justify a renewed military operation in Syria or Iraq and could be used to indefinitely suspend the election process.
Violent Protests – In the event of an inconclusive poll, all parties may demonstrate even amid a heightened and heavy-handed security posture. Furthermore, Syrian (and Afghan refugees) fearing a Kılıcdaroğlu/National Alliance win and possible deportation, could begin to take to the streets to either intimidate potential voters or protest the initial vote counts.
Key TakeawaysPolitical tumult will be a feature, not a bug of Türkiye’s upcoming general election. Unless the election is won by a landslide – which appears unlikely – a disputed outcome and associated unrest can be expected at best. No Turkish president has been ousted by way of the ballot and Erdogan is unlikely to step down without a fight. Once accepted, the outcome of this election will impact great power competition with China and Russia, European domestic politics, Middle Eastern regional politics, global refugee, and investment flows. |
Both the regular Sudanese Armed Forces (SAF) and the paramilitary Rapid Support Forces (RSF) consider themselves capable of military victory, have few incentives to negotiate, and are actively seeking support from outside actors. The conflict – which has already seen more than 700,000 people displaced and thousands of casualties - will likely develop into a protracted struggle and threatens to destabilize an already delicate region.
Talks being held between the two factions in Saudi Arabia have failed to yield progress as fighting and looting continue. Saudi and American diplomatic sources have indicated that neither side sees a political solution as viable, and both sides consider themselves capable of achieving their political aims through outright military victory. The goal of the talks is to negotiate a ceasefire – not a peace agreement – to facilitate the exodus of foreign nationals and allow for desperately needed humanitarian supplies.
On 15 April, fighting broke out between RSF and SAF forces in the capital Khartoum and other strategic locations throughout the country. The fighting has been characterized by the use of heavy weapons on both sides, SAF airstrikes in populated areas, and indiscriminate robbery and looting as the supply situation becomes dire. Thousands of foreign nationals have been forced to undertake dangerous evacuations with minimal supplies, the threat of robbery and violence, and in some cases, crossing thousands of kilometers of desert.
General Abdel Fattah al-Burhan of the SAF and General Mohamed Hamdan Dagalo – better known as Hemedti – of the RSF took control of Sudan in a 2021 coup. Burhan and Hemedti agreed in late 2022 to restore civilian leadership within a two-year timeline. However, as part of the transition plan Hemedti’s RSF was slated to be integrated into the regular army. Hemedti’s substantial personal fortune was built through the RSF and its loss would likely entail his exclusion from politics and possible prosecution for crimes against humanity perpetrated by the RSF.
Key TakeawaysIt is very unlikely that Hemedti and Burhan will be able to come to a political solution in the absence of overwhelming international pressure. For both Hemedti, Burhan, and their cadres, control of the regime is a life-or-death situation. As both factions seek outside support to tip the balance, elements of the conflict could spill over, affecting Ethiopia, South Sudan, the Central African Republic, and Libya. |
The nationwide protests that began in December 2022, following the impeachment and arrest of former president Castillo, and lasted for months have since subsided across most of the country as the protest movement loses energy. The government has lifted curfews and states of emergency in most areas. However, risks of future unrest cannot be ruled out as acting president Dina Boluarte and Peru’s Congress remain unpopular and have yet to capitulate to the protesters’ demands, including resignation and moving up elections from the original 2026 date.
Faced with the third attempted impeachment since his inauguration, President Castillo attempted to dissolve Congress and set up a provisional system of rule by decree on 07 December 2022. However, Congress successfully removed Castillo from office, charged him with rebellion and conspiracy, and installed his former vice president Dina Boluarte as President. Castillo’s supporters took to the streets in Lima and across the country demanding his release, an accelerated election schedule, the dissolution of Congress, the resignation of Boluarte, and constitutional reform.
Demonstrations caused severe disruptions to travel throughout the country. Protesters established roadblocks on main highways in the departments of Puno, Cusco, Arequipa, Madre de Dios, Apurimac, Ucayali, and Tacna. Pro-Castillo supporters also stormed airports across several regions, and thousands of tourists were evacuated from sites, including Machu Pichu, after being stranded by transportation disruptions.
So far, the government has ceded little in relation to the protesters’ demands. Congress has voted down multiple bills put forth by Boluarte to move up elections to early 2024 from 2026 when originally scheduled. At the same time, Castillo was sentenced to 36 months of pre-trial detention by a judge in Peru, up from the original 18 months of pre-trial detention. These actions, combined with Boluarte and Congress’ dismal approval ratings mean anti-government protests could erupt in the future. However, protest fatigue and lack of success from the first several months of demonstrations and unrest mean that widespread, coordinated protests are unlikely.
Additionally, increased migration at the borders with Chile, Bolivia, Brazil, Ecuador, and Colombia has led to clashes at border crossings and states of emergency declarations. This is driving much of the security-related focus in Peru and distracting from anti-government protests.
KEY TAKEAWAYSThe disorganization of Peru’s political system and its classes and parties means that a deeply unpopular president and Congress are likely to remain in office until 2026 elections. Congress will neither impeach and remove Boluarte nor move up elections. For the time being, travel to Peru can resume as normal. |
On the morning of 09 May, Pakistan's former Prime Minister and Pakistan Tehreek-e-Insaf (PTI) political party leader, Imran Khan, was arrested while in court in Islamabad. A small team of the Pakistan Rangers paramilitary force detained him on multiple charges. Shortly afterward, large-scale protests by PTI activists erupted in several areas nationwide including in Lahore, Faisalabad, Islamabad, Karachi, and Peshawar. Protests have turned violent in several cities as security forces clash with Khan supporters. All protests and political rallies should be avoided.
