Russia's Shadow War Reaches US Soil

When we think about a threat from a hostile state, we tend to picture intelligence officers, diplomatic vehicles and surveillance teams with specialist training. That makes it easy to file the problem under something that happens to governments or people operating at a much higher level than us. But what happens when the state hires somebody who looks completely ordinary?

Last week, the US Justice Department charged five Russian intelligence operatives with recruiting a man in Brooklyn to watch a Russian dissident and then offering him $40,000 to arrange his murder. It is the third week running that Russia's shadow war has moved closer to home, from British businesses to NATO's border and now onto the streets of America. The people carrying out the work may have no obvious connection to Moscow, which means the early signs may not look like state surveillance at all.

This week, On the Circuit, we look at how foreign states are using ordinary paid proxies to reach their targets.

This summer, a man in Brooklyn was offered $40,000 to make a person disappear. The offer, according to an indictment unsealed in Manhattan on September 15, came from a network working for Russian intelligence. First they paid him between $1,000 and $1,500 to photograph two addresses tied to a prominent Russian dissident living in the United States. He sent back photos and video. Then came the $40,000 to eliminate the target. When he said he would not do it himself, a recruiter asked whether he knew anyone who would, and mentioned a team in Mexico who could handle it instead.

Five men are charged, and all remain at large. Prosecutors name a former Russian intelligence colonel, Yuri Khrameev, his son Kirill, an FSB officer, and three recruiters from Cuba and Venezuela who were living in Russia. The Brooklyn plot was not the network's first attempt. A year earlier the same people paid an American $200 to photograph an address in Vilnius, then offered him $25,000 to kill the man who lived there, someone they said was spreading dirt about Russia. When he refused, they offered a simpler job, setting fire to a warehouse or an electrical substation in a country helping Ukraine. The full breakdown of the charges and the defendants is in our Circuit Wire report.

This is the third week running that On the Circuit has led on Russia's war against the West, so it’s fair to say that things are hotting up. Three weeks ago it was proxies recruited online to burn Ukraine-linked warehouses in Britain. Last week it was a drone striking a diplomatic train at the Polish border. This week it is a contract killing solicited inside the United States. The same motive is behind all three. Moscow picks the target, and people with no visible tie to Russia carry out the work, paid a few hundred dollars to watch and tens of thousands to act.

The most revealing part of this case isn't the $40,000 offered for the killing. It's the $1,000 to $1,500 paid beforehand for photographs and video. The operation began with a man in Brooklyn visiting two addresses every few days and reporting back with his phone. There was no trained intelligence officer on the street and nothing visibly connecting the activity to Moscow. That is what makes the method difficult to recognize, but it is also where the network is exposed. Before the violence came the surveillance, and the surveillance was clumsy, repetitive and visible. The earlier attempt in Vilnius followed the same pattern: watch the target, offer money for the killing and propose arson when that failed.

The indictment shows that Russia's external-attack apparatus has crossed onto US soil, using ordinary local recruits to do its work. The clearest warning is likely to appear long before the hit.

🇸🇦 Saudi Arabia. Saudi air defenses intercepted a Houthi ballistic missile over Riyadh on September 19, the capital's first air-raid alert since July, and the US then barred staff travel to Taif and Yanbu.

🇨🇺 Cuba. Cuba's national power grid collapsed on September 18, its sixth failure this year, and the US embassy told Americans the timeline to restore power was unknown.

🇱🇹 Lithuania. NATO jets shot down a drone over Lithuania on September 15, the first intercept in the country's airspace; officials say it likely crossed from Belarus carrying explosives.

🇽🇰 Kosovo. A Hague court sentenced former president Hashim Thaci to 25 years for war crimes on September 16, bringing protests and road closures to Pristina.

INSIDER RISK. A four-country advisory on September 18 tied a North Korean group called WaterPlum to malware on more than 30,000 devices worldwide. Operators pose as recruiters at AI or crypto firms and send job applicants a coding task that hides malware, then steal passwords, crypto wallet keys and copies of ID documents. Those stolen IDs are reused to land more remote jobs and reach the victim's employer.

DOMESTIC TERRORISM. The FBI arrested Jonathan Kramer, 21, outside a Pennsylvania hotel on September 12 after watching him buy a rifle, magazines and about 190 rounds. Agents had tracked him since a juvenile mass-casualty plot, and online, posing as an ISIS supporter, he wrote that he was ready and only needed a weapon. Prosecutors say he was preparing a mass shooting and want him held without bond.

Something is being built inside Tesla's facilities that almost no one is talking about — yet.

According to insider sources, Elon Musk has quietly developed a breakthrough product he claims will be "10x bigger than the largest product in history." The target launch date is July 22. And when it drops, the window to position quietly will already be closing.

Most investors will hear about this after the stock has moved. You don't have to be one of them. Our analyst named 3 stocks positioned to ride the launch — with entry guidance, price targets, a bonus 4th supply-chain pick, and a 3-phase playbook for when to buy, add, and take profits.

See the 3 stocks now.

A principal's bank can put an AI agent to work without telling you. So can their airline, hotel, insurer, household supplier or business. If that agent sends a false instruction, exposes an account or takes a service offline, the protection team inherits the fallout without ever having seen the system that caused it. That is why a breach involving AI agents thousands of miles away still belongs in the protective picture.

Our latest Premium article explains how 1,200 agents meant to work alone found one another and helped break into a real company. It then turns that incident into four questions you can use with whoever runs these systems: who can stop the agent, what it can reach, who notices when it acts outside its task and whether the evidence survives. The included AI Incident Tabletop Pack lets you test the answers before a real failure does it for you.

Upgrade for subscriber-only tactical analysis and every future briefing.

Q: The threat has spiked and the client insists the move goes ahead. What can you do?

🟩🟩🟩🟩🟩 Change the route and timing at the last minute (60%)
⬜⬜️⬜️⬜️⬜️ Push surveillance detection and an advance vehicle out ahead (0%)
🟨⬜️⬜️⬜️⬜️ Harden the move with armor, a medic, and a rehearsed abort (10%)
🟨⬜️⬜️⬜️⬜️ Cut the footprint and tighten who knows the plan (10%)
🟨🟨⬜️⬜️⬜️ Something else. Let us know → (20%)

RM: "Do not publicise the intended arrival of a client. On arrival, the client should be 'visibly invisible', given clothing that blends in with the locals... Popular protection vehicles should be excluded in favour of unremarkable ones, discreetly modified for performance... If the client blends in with his surroundings, there is very little chance of an attack on them."