Intel Update - August 8 - Hard Days

Hello again everyone and welcome back to the underground. This is the intel update for August 2nd through the 8th, 2026. Fairly standard week this time, but still a lot of lessons learned which can help us moving forward. Around the world, there have been significant developments and milestones reached regarding the various conflicts that we've been tracking for a while, namely Ukraine and Iran. The war in Europe has continued on as always with Russia and Ukraine slugging it out with long-range drones. These drone attacks have expanded to a new nation this week, Germany, with several drone incidents being reported a few days ago at a German airport. In the Middle East, the Iranians are working with the Omanis to establish the administrative structure for controlling the Strait of Hormuz. On the more kinetic front, several ships have been struck in the strait this week, all of which have been hit for trying to sneak in or out via the southern Omani corridor without Iranian permission. Down south in the Red Sea region, the Houthis have been conducting a few strikes of their own, striking Saudi forces within Yemen over in the areas controlled by the Yemeni government, which is backed by the Saudis. These strikes have been comparatively low level, but over 30 Saudi advisers or probably ground troops have been killed over the past week due to the Houthi striking the government held terrain in the north and eastern regions of Yemen. Within the homeland this week, the situation has been pretty busy with many different crises kicking off nationwide. First of all, these cyber attacks on water infrastructure have continued to spread with the level of impact varying widely around the country. Some water districts were barely affected and there was no impact to customers, but other water administrators were taken completely offline and the water supply shut off due to the attacks. I would provide a map of all of the states affected, but interestingly enough, the FBI has not disclosed which specific states have been affected, but they did say that a total of 12 states have been impacted by cyber attacks on the water supply. However, some local utilities and local affiliate media stations have spilled the beans on some of the states. So, we can extrapolate a partial list, which is as follows. Minnesota, Michigan, Georgia, South Dakota, New Jersey, and Wisconsin have all been host to cyber attacks targeting the water supply in at least one water district throughout those states. Minnesota was hit the hardest last week, as we know, so their situation is more public than the others, which vary widely. Some states have disclosed that they have had cyber attack attempts, but not successful infiltrations. So, ironically, the water has been muddied on this topic to the point that it's challenging to nail down exactly what has been affected. The methods of what the cyber attack entails have also not been disclosed with the exception of Minnesota. In that state, the method for infiltration was via a vulnerability and programmable logic controllers or PLC's. These devices are like little computers that are designed to manage various inputs and outputs in the industrial sector such as water treatment facilities. Specifically, this is the device that has been compromised according to CISA, the Rockwell Automation Microlologgics 1400 PLC. This device is used to monitor and control various switches and valves throughout a factory and apparently had a vulnerability that was capitalized on by malign actors who were able to get into this device and change around a bunch of settings and mess with the levels of various fluids and chemicals at random water treatment facilities around the nation. Pretty much whoever was running these devices at their plant. PLC's form the backbone of most Escada or supervisory control and data acquisition management systems which is the general encompassing term for all of the buttons, switches and sensors that monitor and automate most industrial facilities these days. Factories need computers to work. They need automation to work and SCADA systems enable all of that. In the past, the general rule of thumb has been that most SCADA systems should be completely offline, not connected to the internet at all, and only connected to the operation center, the control room, or the IT department maybe for whatever factory or facility they're installed at. So, it should be just an a completely airgapped system from the rest of the internet. But, but like I said last week, this logic has kind of gone out the window and most SCADA systems at most companies around the United States are now connected to the internet in some form or fashion. And now we have major national security problems because of this. In the case of Minnesota, malign actors were able to get into the PLC's and lock the water treatment facility out of its own facility by changing the passwords. So, so they got into these little computers, changed the password, and they had free reign of the whole facility. So, for those who might think that this is just a bit of an inconvenience, this is actually incredibly dangerous. And this is a major national security issue. Back in 2021, a hacker conducted a similar attack in a small Florida town. And instead of just shutting down operations like what happened in Minnesota a couple of days ago or last week in the Florida case, the hacker was actually able to control the PLC's to add in more sodium hydroxide or lie to the water supply with the intent to poison the population of that water district. So that was a legitimate deliberate terror attack. It did not get a lot of press at the time, but it was very very important. And during the various incidents reported over the past two weeks, the feds have not stated what was actually done by the malign actors in this recent case of cyber attacks. So, we don't know if this has happened again or what, but these attacks are continuing to affect various water districts. And in nearly all cases, county and city administrators are not immediately telling the populace that there is an issue until much later. As far as recommendations moving forward, since this is kind of a time-sensitive issue, um, at this juncture, it would be a very good idea for all citizens to examine their water security situation and really learn from this crisis to make sure that some level of preparedness is undertaken since it's been a couple of weeks since this crisis first began. And now we're finding out how serious this crisis actually has been over the past couple of weeks. We're finding this out after the fact, of course. But now that we know how serious this situation is, this is a good time to kind of look back retroactively look and see what we could have done better on the individual level to kind of insulate ourselves from these problems. Water filters are a critical need in the sort of prepping world, but also having some level of water storage on hand is good because the lesson learned with this particular crisis is that you can't really filter out chemicals from the water supply. I mean, you can on a small scale, but not really. And if a cyber attack takes place, which dumps a bunch of lie into the water, you can't really filter that back out. So even if you have water access, it might not be safe to drink. Generally speaking, FEMA recommends having one gallon of clean drinking water per person per day for a total of 3 days. I would recommend obviously more than that. The one gallon figure is just uh for all kinds of uses, including hygiene and things like that. So you can definitely stretch that out, but for a planning factor, one gallon is a good uh benchmark. This is a good baseline of preparedness and you can kind of go from there. Water is hard to store long term and most people don't really know how much water they actually need to survive. So, this is something to iron out right now before a disaster strikes and all the cases of water are gone from the store, which is exactly what happened in places like Minnesota and some of these other districts that got affected. Chances are, if you are watching this, you are probably a little bit more preparednessminded than the average person. So, I'm kind of preaching to the choir. I'm I'm sure this is more of a reminder for those of you out there who have more unprepared friends and family who don't really have any sort of preps at all. Just something to keep in mind because with a cyber attack, you will never have any sort of advanced warning. One day, you're going to be brushing your teeth and the water pressure is going to drop and you're going to find out an hour later that the water is not coming back on for a few days. When it comes to how a cyber attack might manifest itself in the average person's daily life, that is the most likely scenario. And as such, it bears more preparation for. So clearly we have shown that there are major infrastructure vulnerabilities. I and many others have been talking about this for years and there have been efforts to harden our our infrastructure against attacks like this but clearly it's not enough right? So staying one step ahead of the bad guys is hard to do on a national level. So we have to do things at the individual level to make sure that we're insulated from the impacts of some of these disasters. So speaking of preparedness and readiness, another series of disasters has continued this week. The wildfires in the Pacific Northwest. Overall, the Pacific Northwest region has been host to a very active fire season this year with Oregon reaching new records in terms of hectares burned and Washington state experiencing many fires which have spread to urban areas. The most serious fires have struck the city of Spokane in eastern Washington which has been categorized as the worst wildfire disaster in state history. Three main fires were responsible for the initial evacuation of 67,000 people in the city limits of Spokane. As far as how many of those people actually left the area and actually evacuated, we don't really know, but the level three mandatory leave now evacuation areas included tens of thousands of people in the northwestern side of the city. Thank god no fatalities have been reported, which is a miracle on its own when this many people are directly affected by the wildfire. But there are tens of thousands of people either directly homeless now or impacted in some way and having to kind of cope with the situation. So, this is going to be a a long-term disaster situation. Right now, there are many shelters set up around the city for those displaced by the fire. The main go-to place, the main place where most people are being housed is the Spokane Convention Center. That's where the main and primary Red Cross shelter is being set up, and they do accept pets at this location as well. This is the main place to go if you are affected by the fires, but there are some other options as well. Spokane Falls Community College served as an initial evacuation staging area, but I don't know if they're still active or not. They were listed as being an active shelter a few days ago, but I think they've transitioned a lot of their staff to the convention center uh as well to help plus up that that staffing situation there. If you are in Stevens County, Jenkins High School has a Red Cross shelter added as well. And for the military service members that are affected, the emergency family assistance center is at Fairchild at the Red Morgan Center. So, you can find uh resources there. If you are local to the area and looking to donate resources, here are some of the places you can directly donate to. Second Harvest Inland Northwest at 1234 East Front Avenue is a food bank that is accepting supplies and they have mobile markets that have been kind of popping up around the city for both donations and also distribution of food bank supplies. Second Harvest has stated that they are also in need of non-p perishable pet food and pet supplies. Uh the same goes for pretty much all the other charities that are helping out with uh pets and animals that have been taken in from the disaster such as the Spokane Humane Society and Spoke Animal. Both of these agencies have also said they need pet food, blankets, and towels. If you want to donate supplies specifically to the firefighters and emergency personnel that are working the fire, go to fire station 16 at 5225 North Assembly Street. They are accepting donations at this station, which are being transported out to the fire line and the various spike bases further out from town. Of note, they already have enough food and water, so don't bother uh bringing that. But what they are in need of is hygiene supplies. They have not published a specific list, but things like baby wipes, foot powder, sunscreen, travel size toiletries, nice pairs of socks, electrolyte drink mixes, and prepackaged snacks are always good to donate no matter what. As with all disasters, do not donate any prepared food. Everything has to be sealed in its original packaging. Also, do not just drop off stuff randomly. Make sure that you are donating supplies to a designated drop off area as they are already having a hard time managing the surge of support that has materialized. As always, everyone is thankful for the support, but it would be best to make the logistics as easy to manage as possible. So, definitely check to make sure the donation centers are accepting what you're dropping off and what their actual needs are because their needs change by the day. For more up-to-date resources and uh up totheminute updates, local mainstream media has been the most widespread source for coordinating all the various disaster aid efforts. There are a few uh groups. You can probably hit up most of these places on Facebook and uh check out their Facebook pages for all these agencies and entities that I mentioned today. They put out a lot of information on Facebook still and local sources on the ground will be more quick to respond to what their needs are. So, please check with those local sources which will have the most up-to-date information. After the fires die down over the next few uh days and weeks, the situation is going to transition into more of a long-term disaster recovery effort, and it's going to take some time to rebuild the over 900 structures which have been destroyed by the fires in just the Spokane suburbs alone. So certainly keep everyone in your prayers long after the disaster leaves the headlines, and I will try to offer updates on the crisis wherever I can. Staying in the same region, but switching gears very significantly. Another crisis emerged this week over in Idaho, which involved the active shooter incident at the Inn-Out in Twin Falls. The Twin Falls Police Department released a rollup product compiling all of the security camera footage of the incident, establishing the timeline for how the shooting transpired. I will provide the direct link to the primary source for the video so that anyone interested can review this uh incident if you wish. I highly recommend it if you're interested in trying to learn more and how to do better uh for next time because this is actually a pretty good product. Twin Falls PD actually did a really good job putting this product out, so very much appreciate their effort on that. The full video is actually over 9 minutes long, so it's too long for us to walk through uh together right now. Uh I can do a more thorough breakdown of the lessons learned from this incident if there's demand for it. But today, I just wanted to cover the highlights because this shooting is highly highly documented and a total of five different citizens responded and intervened to stop the shooter in some way. Just as a brief wavetop recap, one shooter began the attack by murdering the employee at the drive-through window of the restaurant, the In-N-Out in Twin Falls, and from there began engaging citizens at random throughout the local area. Throughout the incident, many citizens stepped up and did what they could, either to stop the shooter or to uh render aid to those who were wounded. One former state trooper who was in the drive-through line responded first and was immediately wounded in the arm and taken out of the fight. After the first uh series of shots were fired, an offduty officer inside the restaurant cleared the building and covered the evacuation of staff from the kitchen. After this, a woman who was in the drive-through line tried to escape the area and in the process found the shooter's discarded handgun and tried to use it against the shooter, but as it was jammed, this was ineffective. A fourth responder, the mysterious stranger, who has been identified as Jordan Selenus, was one of the first to get rounds on target and engaged the shooter with an extremely unique handgun choice of a suppressed 57. An engagement which took place at well beyond the effective range of a handgun. However, this effort did drive the shooter away from the shopping center and restaurant area unfortunately toward a Tesla charging station where the shooter engaged more victims in two parked Teslas. At that point, the shooter egressed across the parking lot and entered a local visitor center where employees hearing all of the prior gunfire had already cleared out the center and concealed visitors in the back rooms or evacuated them out of the facility. A fifth responder, an unarmed employee of the visitor center, actually ran into the shooter and had a conversation with him, which drew the shooters's attention away from a group of hikers that were coming down the walking path toward the shooter. This distraction effort worked and the hikers scattered before the shooter engaged the employee he was just talking to, though he missed him. The suspect proceeded down the trail before police caught up to him and he died of a self-inflicted gunshot wound, ending the incident. So, what is the overall lesson here? Again, I can dig into this deeper if you would like, but the common theme is one that we see time and time again in the world of mass shootings or really any kind of crisis like this. Responders can do everything right, and citizens can step up and do what they can to halt the attack, but fatalities still occur. In this case, the police response was literally mere seconds after the first shots were fired, and officers responded with an overmatch of capabilities as everyone had rifles and not just sidearms. Citizens at every single stage acted in some way, either directly by engaging the shooter or by aiding those wounded. There are certainly a lot of improvements that could have been made, which we can get to in due time, but at the wavetop level, this is what we should expect a proper active shooter response to look like under realworld conditions, it will be chaotic. The fog of war will be thick, and we have to be careful to understand that everyone was acting with the knowledge that they had at the time, not hindsight or what we can see from the cameras. So, I myself certainly do not want to criticize anyone's actions on that day. They all did the best that they could with the information they had, and that's all anyone can hope for. In terms of why this shooting occurred in the first place, I have no clue. Uh, there has been no motive released by investigating authorities regarding why Chad Williams carried out this attack, and so far there haven't really been any theories circulating either. Maybe this guy's online profile will lead to some clues, but so far, I haven't found anything solid that would point to a motive. The randomness of this attack is indicative of maybe some kind of 764 or order of nine angles or 09A, but the suspect is not transgender. He doesn't really have that vibe about him either. Nor were the firearms used marked up with the white paint pen as is characteristic of those kinds of attacks. So, I honestly don't know why this happened. And I will be staying on top of this to get to the bottom of whatever led to this attack. We don't normally get this much information with mass shootings. We certainly don't get products like this produced by the police department so quickly after the incident. So really do appreciate the transparency on this especially because we can learn from this moving forward. So this is most certainly motivation to get effective training both in terms of medical aid and also in terms of firearms training and also reexamine what you could do to improve your situational awareness and situational overview and and understanding of the situation around you when things go sideways. Not easy to do, but I myself find this very, very motivating to get forward and get after it. So that's all I've got for Idaho. Transitioning to the Middle East for this week, no major changes all around. The Iranians and Omanis are still working on their agreement for administrative control of the strait of Hormuz and there's really been no solid news on how that's going. Uh the Iranians have continued to strike merchants in the straight about once a day or so as random vessels keep trying to go through the southern Omani route and the US Navy is not really able to protect them sufficiently. Uh speaking of missile defense, the mainstream media outlets have reported this week on the extremely low stockpiles of munitions which have been dwindling for some time. This is not really new. We've been talking about this for a couple months now, but offensive and defensive munitions are critically low with a tackams and prisms being in very low supply along with TAMs being almost completely expended. Interceptor missiles such as the Pack 3 and Pack 2 missiles for the Patriot system have been sharply reduced for a long time and it's not like we can just replace these. These take years to build. The Pack 3 missiles, the more capable and most recent version of the missile for the Patriot system. These are almost completely exhausted since the hot shooting phase of the war back in April. The older Pack 2 missiles are pretty much all we have left, but some reports claim that we're down to double digits of some of these interceptor missiles, though the exact number is obviously not public, so we just have to kind of guess. It's not exactly a wild guess because we know based on congressional reports, every year the Pentagon has to report how many missiles they have and how many they bought. So, it's not like we're uh we're we're just shooting from the hip here. We do have numbers to work from, and it's not looking good. The Pentagon indirectly confirmed the dire situation on the dwindling missile stockpile by both denying the low levels of munitions, but also announcing that they are investigating who whoever leaked that information to the press. So, that's kind of a confirmation in and of itself because if the information was untrue, no investigation would be needed because you can only charge somebody with espionage if the information is true. So, I guess the Pentagon has kind of forgotten the old practice of we will neither confirm nor deny, right? I guess they've kind of moved out of that sort of mentality. Plus, the Pentagon has been openly stating that their missile stockpiles are running low for months now. So, they've they've actually said this themselves in the various congressional testimony that we have been looking at since the war began. It's not that much of a surprise to see that we are basically out of missiles in the Middle East and have emptied out a lot of bases because some bases simply fired off their last missile that they had weeks ago. Thankfully, the air strikes between the United States and Iran have largely remained stagnant for a couple of weeks now, which might be brought on by the sheer lack of long range standoff munitions. Uh they're available to carry out even a small bombing campaign. So, we're certainly still in the realm of waiting to see how this all works out. The Chinese and the Russians are definitely padding the Iranian missile stockpile, at least in terms of air defense, which is going to make it harder for the United States to use uh any more of their quote unquote dumb bombs, right? The more uh less precision uh guided munitions that we're going to have to deliver much much closer. We can't just launch these uh dumb bombs, so to speak, from thousands of miles away or hundreds of miles away at least. Most of the munitions that we have left, we're going to actually have to put aircraft in Iranian airspace. And if we're going to do that, that's going to be a whole big operation, which is probably why they're not wanting to do it for now. But just give it a few days or at the most a week or two and we'll see, we'll we'll reexamine that. We'll see how it works out. It's not looking super great, but at least things are, I guess, decently stable. Is that do we dare call this the situation stable at this moment, i don't know. Not a whole lot has changed this week, but it's still uh fairly tense all around. Similar story with a specific incident that took place in Germany regarding Ukraine. So, let's jump to Europe really quick. A few days ago, a series of drone incursion incidents were reported at Leipzig Hala Airport in Germany. Several drones were spotted by staff at the airport which prompted the airport to shut down and effectively uh enact their drone procedures which most modern airports have nowadays and also which involves a search of the airport grounds which revealed several drones. One drone was cited hovering just off the ground by a bus driver at the airport who uh kicked it and knocked it out of the air. After the Chuck Norris style drone defense, a second drone was also found next to a Ukrainian transport plane in the cargo handling section of the airport. This second drone uh reportedly had an explosive charge on board which was rendered safe by the airport explosive ordinance disposal team. But as this incident was unfolding and as the runway was being shut down and they were trying to get everybody, you know, situated, a DHL aircraft was actually on short final approach trying to land. Air traffic control issued an emergency goaround order for that aircraft. And as the DHL aircraft was aborting the landing and they were trying to nose up and climb out of the airport, they hit a third drone uh which was actually in the air hovering over the runway. The DHL aircraft diverted to a nearby airport after declaring an emergency and nobody was harmed on board that aircraft, but it was a pretty close call. So, as one might expect, the theories for who might be behind this attack are extremely biased and also impossible to confirm. The Germans, surprise, surprise, are blaming the Russians for the attack because it looks like they were trying to take out a Ukrainian transport plane on the ground in Germany. The Russians also, not surprisingly, blame the Ukrainians on conducting a false flag attack so as to drum up more support for the war from Germany and to pressure Germany to sell Ukraine more missiles. As it stands, it's honestly not really possible to determine the truth, and the information space is completely saturated with propaganda, it's too hot. We got to wave off for now and just kind of re circle back around to this in a few weeks. On the one hand, it would make sense for it to be Russia because Russia has been slowly walking toward a more direct confrontation with NATO due to NATO encouraging and enabling direct attacks on Russia's oil terminals and civilian infrastructure. So, it would make sense for Russia to have this kind of tit fortat response to this and kind of do a little bit of a sly old school cold war kind of thing. They can't really be directly tied back to them, but we tangentially know that it was probably them. The only problem with this theory is that it doesn't really make sense for this attack to have a 100% failure rate if it was the Russians. The Russians are pretty good at this and these drones failing doesn't make a whole lot of sense. Unless that failure itself was intentional and thus a pretty strong message regarding how serious Russia is. You can argue this pretty much any way you want. Uh, of course, Ukraine is also a prime suspect, too. And since there are Ukrainian military cargo aircraft at this airport, it would not be that hard for them to carry out an attack on their own planes at this airport. It's anybody's guess as to what the truth actually is. In cases like this, the rhetoric in the media is normally a fairly good indicator of what the truth might be simply due to the truth usually being the opposite of whatever is reported in the mainstream media for stuff like this, but I don't know. I think we're just going to have to wait and see what the next escalation is and how it plays out over the next few weeks. I wish we could get to a conclusion with that, but unfortunately we just got to just got to see what happens, right? So that's all I have for today and let's uh go ahead and wrap it up with some of the more interesting Ghost Net reports that I have picked up from my own radio here in the Mid-Atlantic region. As you guys know, every week I try to highlight some of the more interesting reports that have uh gone out over the airwaves on our Ghostnet uh HF or shortwave radio network. And I can usually pick up the reports from the entire East Coast, usually from Florida all the way to Canada. And this week I picked up about 80 people or so transmitting localized information reports from their own neighborhoods. Summertime is always more popular for those getting on the airwaves and this summer has been really great. And usually anywhere from 50 to 100 other stations are pretty active on any given week. All trying to do their best to keep skills sharp and to make sure that no matter what happens, we will have a lot of capable people at the other end of the radio ready, willing, and able to keep the flow of information going. It is all of you who keep the net going, and I am happy to carry on this net well into the future. So, otherwise, I'm trying to get a lot more educational content finished up soon. You all know these things take so much longer than anyone plans for, but I'm working as hard as I can to really get a lot of frameworks worked out and in place. More to come on that later on, as usual. Thank you guys for all of your support. I really do appreciate it. Thank you again to all of you on Patreon who keep the project going and I will see you next time.