MAGNET S2 SNAPSHOT 260823-1800z
Download a PDF version of this report
|
MAGCON
LEVEL 3
ELEVATED
|
MAGCON holds at Level 3 – ELEVATED per standing direction. Since the 260814-1700Z baseline, the Strait of Hormuz picture has continued to deteriorate: renewed Iranian attacks on ADNOC-linked (UAE) commercial tankers on 8 and 14 Aug (the 8 Aug incident fell inside the prior cycle’s window but was missed in that sweep, and is included now as a correction), a reported — but not independently confirmed — Iranian seizure of a UAE-flagged tanker on 17 Aug, and evasive/halted transit by the tanker Amara near Qeshm Island on 18 Aug. This runs in parallel with, not instead of, the kinetic US blockade-enforcement track reported last cycle (Vela Nova Hellfire strike, 11 Aug). Hormuz remains HIGH. Bab el-Mandeb/Red Sea holds at CRITICAL, restored last cycle following the lethal 12 Aug Houthi strike on the Tihamah; no new incident was identified in this window. The Mecca Joint Defence Agreement (Saudi Arabia–Turkey–Pakistan, signed 7 Aug) saw a notable development on 20 Aug when Syria’s Foreign Minister said Damascus is considering joining or cooperating with the pact. The DHS domestic surveillance disclosure reported last cycle (Operation Puppet Master / Project Whipple Shield) has been confirmed to extend to five churches across Minnesota and Michigan, per 20 Aug reporting — a wider geographic scope than previously understood. A new MAGNET S2 Intelligence Report (260821-1800Z) assessing the Tongan Crip Gang (TCG) in Utah is incorporated this cycle following a second fatal shooting at an LDS meetinghouse funeral in Kearns, UT on 17 Aug — a possible gang nexus is under investigation but not yet confirmed. CISA added six new KEV entries across two batches (18, 20 Aug), including three CVSS 9.8 critical vulnerabilities under active exploitation. Delaney Hall, PJM, Section 702/FISA, and America 250 show no material change this cycle. The WordPress Core wp2shell patch confirmation against magnethf.com remains outstanding — now a fourth consecutive cycle open item.
TREND VS LAST REPORT (260814-1700Z): WORSENING — HORMUZ ATTACK TEMPO INCREASING / MECCA PACT EXPANSION SIGNAL / DHS SURVEILLANCE SCOPE WIDER / NEW TCG UTAH INTEL REPORT
|
- Renewed Iranian attacks on ADNOC-linked (UAE) tankers in the Strait of Hormuz (8 and 14 Aug — the 8 Aug incident missed last cycle, included now as a correction), plus a reported but unconfirmed tanker seizure (17 Aug) and evasive/halted transit by the tanker Amara (18 Aug). Runs parallel to the kinetic US blockade-enforcement track (Vela Nova, 11 Aug) reported last cycle.
- Bab el-Mandeb/Red Sea holds at CRITICAL (restored last cycle following the 12 Aug Houthi strike on the Tihamah, which killed at least 6); no new incident identified this window.
- NEW — Syria’s Foreign Minister said (20 Aug) that Damascus is considering joining or cooperating with the Mecca Joint Defence Agreement (Saudi Arabia–Turkey–Pakistan, signed 7 Aug), which Turkey has said is open to expansion.
- NEW — DHS domestic surveillance disclosed last cycle (Operation Puppet Master / Project Whipple Shield) confirmed to have extended to five churches across Minnesota and Michigan, per 20 Aug reporting — a wider geographic scope than previously understood.
- NEW INTELLIGENCE REPORT INCORPORATED — MAGNET S2 260821-1800Z: Tongan Crip Gang (TCG) Utah. A second fatal shooting at an LDS meetinghouse funeral occurred in Kearns, UT (17 Aug), killing one and critically injuring two; a possible gang nexus is under investigation but not confirmed as TCG-linked as of the report DTG.
- Heavy CISA KEV week: two batches (18, 20 Aug) added six CVEs, three carrying CVSS 9.8 with confirmed active exploitation (Windows IKE Service Extensions, VMware vCenter, macOS Screen Sharing).
- WordPress Core wp2shell (CVE-2026-63030 / CVE-2026-60137) patch confirmation against magnethf.com remains outstanding — now a fourth consecutive cycle open item.
- Delaney Hall, PJM, Section 702/FISA, and America 250 show no material change since the 260814-1700Z baseline.
| TOPIC | DELTA FROM 260814-1700Z |
|---|---|
| Strait of Hormuz | WORSENING. Additional Iranian attacks on ADNOC-linked tankers (8, 14 Aug); reported tanker seizure (17 Aug, unconfirmed); Amara evasive transit (18 Aug). Runs parallel to last cycle’s kinetic blockade-enforcement escalation (Vela Nova, 11 Aug). Holds at HIGH. |
| Bab el-Mandeb / Red Sea | STABLE. No new incident identified this window; holds at CRITICAL (restored last cycle following the Tihamah strike, 12 Aug). |
| Mecca Joint Defence Agreement | DEVELOPING. Syria’s Foreign Minister said (20 Aug) Damascus is considering joining or cooperating with the pact signed 7 Aug by Saudi Arabia, Turkey, and Pakistan. |
| DHS Domestic Surveillance | WORSENING — SCOPE EXPANDED. Operation Puppet Master confirmed to have surveilled five churches across Minnesota AND Michigan (20 Aug reporting) — wider geographic scope than the Minnesota-only framing reported last cycle. |
| TCG Utah (New Intel Report) | NEW. MAGNET S2 260821-1800Z incorporated — second fatal shooting at an LDS meetinghouse funeral, Kearns, UT (17 Aug); possible gang nexus under investigation, not confirmed as TCG-linked. |
| CISA KEV | WORSENING. Six new CVEs across two batches (18, 20 Aug), three rated CVSS 9.8 with confirmed active exploitation, versus four additions the prior cycle. |
| Delaney Hall | STABLE. No new incident this window beyond the third custody-linked death (Chajon-Raxon) disclosed last cycle (13 Aug). |
| PJM Grid | STABLE. Bilateral matching window proceeding on schedule; central auction still tracking for 30 Sep–21 Oct. No new FERC action this cycle. |
| Section 702 / FISA | STABLE — NO CHANGE. Certifications remain valid through March 2027 regardless of underlying statute status. |
| America 250 | STABLE. No reinstatement trigger identified; still pending operator direction. |
| WordPress Core / wp2shell (magnethf.com) | ONGOING — 4TH CONSECUTIVE CYCLE OPEN ITEM. No confirmation received on magnethf.com’s patch level against CVE-2026-63030 / CVE-2026-60137. |
- MAGCON level holds at 3 – ELEVATED per standing direction
- Section 702/FISA certifications remain valid through March 2027 regardless of underlying statute status
- Panama Canal transit remains ROUTINE; normal operations
- PJM Reliability Backstop Procurement proceeding on schedule; no new FERC action this cycle
- America 250 watch-item status unchanged; no reinstatement trigger identified
- Delaney Hall oversight litigation (NJ AG / Newark v. GEO Group) ongoing with no new incident this window
| SECTOR | LEVEL | NOTES |
|---|---|---|
| Energy / Fuel | HIGH | Held at HIGH (restored 260814). Bab el-Mandeb lethal attack and continued kinetic Hormuz enforcement/renewed Iranian tanker attacks both directly affecting Gulf crude flows. |
| Transportation Systems | HIGH | Held at HIGH (restored 260814). Bab el-Mandeb transit risk remains lethal; Hormuz attack tempo continues to increase. |
| Supply Chain / Logistics | HIGH | Held at HIGH (restored 260814). Both Gulf chokepoints remain re-escalated; no offsetting improvement identified this cycle. |
| Cybersecurity / Critical Infrastructure | ELEVATED | Six new KEV additions this cycle (18, 20 Aug), three CVSS 9.8 with confirmed active exploitation across Windows, VMware, and SharePoint. |
| Domestic Security / Civil Unrest | ELEVATED | Held. DHS surveillance scope expansion (5 churches, MN/MI) and TCG Utah gang-violence intelligence report both reinforce standing posture; no MAGCON-level trigger identified. |
| Terrorism / Extremism | ELEVATED | New TCG Utah intelligence report (260821-1800Z) — second fatal shooting at LDS funeral gathering (Kearns, 17 Aug); possible gang nexus under investigation, not confirmed. |
| Grid / Energy Infrastructure (PJM) | ELEVATED | Held. Bilateral matching window proceeding on schedule; no acute reliability event in-period. |
| Mass Gatherings / Public Events | ELEVATED | FIFA World Cup retired from watch (tournament concluded). America 250 reinstatement pending operator direction. |
| CHOKEPOINT | STATUS | ASSESSMENT |
|---|---|---|
| Strait of Hormuz | HIGH | Restored to HIGH last cycle on kinetic blockade enforcement (Vela Nova Hellfire strike, 11 Aug). This cycle adds renewed Iranian attacks on ADNOC-linked tankers (8, 14 Aug), a reported but unconfirmed tanker seizure (17 Aug), and evasive/halted transit by the tanker Amara (18 Aug). Diplomatic movement (Iran-Oman route talks, “final stages”) does not offset an active kinetic enforcement and attack escalation — treat as “paused, not resolved,” never improving, while direct attacks on commercial shipping continue. |
| Bab el-Mandeb / Red Sea | CRITICAL | Restored to CRITICAL last cycle following the 12 Aug Houthi missile strike on the Tihamah near Perim Island, which killed at least 6 — the first shipping deaths linked to the Houthis since the war began 28 Feb. No new incident identified this window; treat as active lethal risk, not adaptation. |
| Panama Canal | ROUTINE | Stable. Normal operations; no reporting of disruption this cycle. |
| Strait of Malacca | ELEVATED | Stable. SE Asia energy stress from Hormuz/Bab el-Mandeb disruption persists; no direct incidents this cycle. |
Iranian forces attacked ADNOC-linked (UAE) tankers on 8 Aug (a third such vessel) and again on 14 Aug, when two vessels — a Singapore-flagged product tanker and a Liberian-flagged Aframax — were struck during a dark transit. The 8 Aug incident fell inside the prior cycle’s reporting window (3–9 Aug) but was not captured in that sweep; it is included now as a correction to the record, consistent with how the Mecca Joint Defence Agreement was handled last cycle.
Iranian state media (Farh News Agency) reported on 17 Aug the unconfirmed seizure of a UAE-linked tanker for alleged violation of the Persian Gulf Strait Authority’s (PGSA) passage rules, taken toward Qeshm Island. On 18 Aug, the fuel tanker Amara made a series of at least five erratic U-turns before halting near Qeshm Island under apparent Iranian pressure.
These developments run parallel to, not in place of, the kinetic US blockade-enforcement track reported last cycle: the Vela Nova was disabled by Hellfire missiles on 11 Aug, the third vessel disabled by direct fire since the blockade resumed 14 Jul. Iran-Oman route talks remain in “final stages” per Iranian officials, but members should not read diplomatic movement as reducing operational risk in the strait. Admiralty rating: B-2.
On 20 Aug, during a visit to Pakistan, Syrian Foreign Minister Asaad al-Shaibani said Damascus is considering whether to join or cooperate with the Mecca Joint Defence Agreement, the collective-defense pact signed 7 Aug by Saudi Arabia, Turkey, and Pakistan. Turkish officials have previously stated the pact is open to expansion beyond the founding three states.
This follows reporting that the pact’s framework includes a ministerial committee, political and military committees, and a planned permanent secretariat — structural elements Turkish officials have compared to NATO, though analysts characterize the agreement as a regional security-cooperation framework rather than a direct NATO analog. Admiralty rating: B-2.
Reporting on 20 Aug (NBC News, via multiple outlets) confirmed that Operation Puppet Master — the DHS undercover surveillance program targeting non-criminal left-leaning organizations first disclosed via unsealed court filings on 13 Aug — surveilled five churches across Minnesota and Michigan since December, with agents operating both outside and inside church buildings. This is a wider geographic scope than the Minnesota-only framing reported last cycle.
Minnesota Attorney General Keith Ellison publicly condemned the program on 14 Aug, characterizing it as retaliation against constitutionally protected protest activity. This item reinforces MAGNET’s standing PACE/OPSEC guidance regarding smartphone-based group messaging and financial-record exposure for members affiliated with advocacy organizations. Admiralty rating: B-2.
MAGNET S2 published a standalone Intelligence Report (DTG 260821-1800Z) on the Tongan Crip Gang (TCG), a Crips-affiliated Pacific Islander street gang active in the Salt Lake Valley, UT for over 35 years, following a second fatal shooting at an LDS meetinghouse funeral gathering. On 17 Aug, gunfire erupted outside a funeral in Kearns, UT, killing 18-year-old Vilisoni Angilau and critically injuring two others (ages 17 and 18); Unified Police arrested the 17-year-old suspect’s father, Afuhia Masiu Manatau, 45, for allegedly providing the firearm.
The Kearns incident closely parallels a 7 January 2026 shooting at an LDS meetinghouse in Salt Lake City that killed two people, including a former TCG member who had publicly renounced gang life — that earlier case resulted in federal firearms indictments against two alleged TCG members. Police describe the Kearns shooting as stemming from a dispute between two families and are investigating a possible gang connection; TCG affiliation has NOT been confirmed as of the report DTG. The full report assesses TCG structure, membership, rival/ally networks, and provides mitigation recommendations for Wasatch Front law enforcement partners. Admiralty rating: B-2 (multiple corroborating local news sources; full source list in the standalone report).
| CVE / SYSTEM | SEVERITY | ACTION REQUIRED |
|---|---|---|
| CVE-2026-33824 Microsoft Windows IKE Service Extensions | CRITICAL | NEW KEV 18 Aug. Wormable, unauthenticated RCE (CVSS 9.8). Federal patch deadline was 21 Aug — treat as overdue if not yet applied. |
| CVE-2026-55040 Microsoft SharePoint Server | HIGH | NEW KEV 18 Aug. Authentication bypass (CVSS 9.1); exploited within hours of public technical writeup. |
| CVE-2026-59310 Broadcom VMware vCenter | CRITICAL | NEW KEV 18 Aug. Path traversal (CVSS 9.8); hundreds of servers already compromised across 47 countries. |
| CVE-2026-65400 Apple macOS (Screen Sharing) | CRITICAL | NEW KEV 18 Aug. Authentication bypass (CVSS 9.8) being used to install cryptominers. |
| CVE-2026-16232 Check Point SmartConsole | ELEVATED | NEW KEV 20 Aug. Improper authentication vulnerability. |
| CVE-2026-50522 Microsoft SharePoint | ELEVATED | NEW KEV 20 Aug. Deserialization of untrusted data. |
| CVE-2026-63030 / CVE-2026-60137 WordPress Core (“wp2shell”) | CRITICAL | ONGOING — 4th consecutive cycle open item. Unauthenticated RCE chain (CVSS 9.8 combined) via REST API batch route + SQL injection. Fixed in WP 6.9.5 / 7.0.2 (17–18 Jul). magnethf.com’s own patch level remains unconfirmed. |
- Watch: Whether the reported Iranian seizure of a UAE-flagged tanker (17 Aug) is independently corroborated beyond Iranian state media.
- Watch: Whether additional Iranian attacks on ADNOC-linked shipping continue, and whether the attack tempo triggers a further chokepoint status escalation.
- Watch: Which additional states, if any, join or cooperate with the Mecca Joint Defence Agreement following Syria’s stated interest (20 Aug).
- Watch: Further disclosures on DHS surveillance scope (Operation Puppet Master / Project Whipple Shield) — additional states, targets, or congressional response.
- Watch: Resolution of the Kearns, UT shooting investigation and whether a TCG or TCG-affiliated (e.g., TCR) nexus is formally confirmed.
- Watch: Confirmation of magnethf.com’s own WordPress Core patch status against CVE-2026-63030 / CVE-2026-60137 — now a fourth-cycle open item.
- CONFIRMED ADNOC-linked tanker attacks in the Strait of Hormuz on 8 and 14 Aug. (Windward AIS data, The Maritime Executive)
- CONFIRMED Syria considering joining the Mecca Joint Defence Agreement (20 Aug). (Wikipedia citing Syrian FM statement in Pakistan)
- CONFIRMED DHS surveillance extended to 5 churches in Minnesota and Michigan. (NBC News via MSNBC, 20 Aug 2026)
- CONFIRMED Kearns, UT LDS funeral shooting (17 Aug) — 1 killed, 2 critically injured. (ABC4 Utah, Deseret News, Salt Lake Tribune)
- NOT CONFIRMED Iranian seizure of a UAE-linked tanker (17 Aug). Sourced to Iranian state media (Farh News Agency) only.
- NOT CONFIRMED Kearns shooting formally linked to TCG or a TCG-affiliated subset. Unified Police investigating; no confirmation as of DTG.
- NOT CONFIRMED magnethf.com’s WordPress Core patch level against wp2shell. Pending operator verification — now a fourth-cycle open item.
- CONFIRM WORDPRESS CORE VERSION NOW — magnethf.com’s patch level against wp2shell (CVE-2026-63030 / CVE-2026-60137) remains unconfirmed for a fourth consecutive cycle; verify against fixed releases 6.9.5 / 7.0.2 or later before next report.
- PATCH WINDOWS IKE SERVICE EXTENSIONS, VMWARE VCENTER, AND MACOS SCREEN SHARING IMMEDIATELY — all three CVSS 9.8 with confirmed active exploitation.
- GULF-ADJACENT SUPPLY CHAINS — do not treat Hormuz diplomatic movement as reducing operational risk; attack tempo against commercial shipping continues to increase alongside blockade enforcement.
- SIGNAL / COMMS OPSEC — continue treating smartphone-based group messaging as inherently more exposed than MAGNET HF/NBEMS, JS8Call, and VarAC BBS channels, per the confirmed DHS church/advocacy-group surveillance findings.
- UTAH / WASATCH FRONT OPERATORS — treat funeral and memorial gatherings tied to Pacific Islander community networks as elevated-attention events pending resolution of the Kearns investigation; see full TCG Utah intelligence report (260821-1800Z) for details.
- PROVIDE DIRECTION ON AMERICA 250 WATCH-ITEM REINSTATEMENT — still pending operator call as of this cycle.
- Report cyber incidents to cisa.gov or IC3.gov; CI Fortify guidance at cisa.gov.
- [1] [B2] The Maritime Executive — Iran Claims to Have Seized Tanker as It Continues Targeting UAE Shipping, 17 Aug 2026 — maritime-executive.com
- [2] [A2] Bloomberg — Tanker Stops in Hormuz as Iran Raises Efforts to Control Strait, 18 Aug 2026 — bloomberg.com
- [3] [C3] Wikipedia — Mecca Joint Defence Agreement (Syria consideration, 20 Aug 2026) — en.wikipedia.org
- [4] [B2] Al Jazeera — Which Other Countries Could Join the Turkiye-Saudi-Pakistan Defence Pact?, 9 Aug 2026 — aljazeera.com
- [5] [B2] MSNBC/NBC News — DHS Surveillance of Churches Adds to Clashes Between Team Trump and Faith Community, 20 Aug 2026 — ms.now
- [6] [A1] Minnesota Attorney General — Ellison Statement on DHS Surveillance of Minnesota Protesters, 14 Aug 2026 — ag.state.mn.us
- [7] [B2] ABC4 Utah — Victim of Kearns Funeral Shooting Identified; Father Arrested for Providing Firearm, 17–18 Aug 2026 — abc4.com
- [8] [B2] Deseret News / Salt Lake Tribune — Kearns Funeral Shooting Coverage, 17–18 Aug 2026 — deseret.com
- [9] [A1] CISA.gov — Adds Four Known Exploited Vulnerabilities to Catalog, 18 Aug 2026 — cisa.gov
- [10] [A1] CISA.gov — Adds Two Known Exploited Vulnerabilities to Catalog, 20 Aug 2026 — cisa.gov
- [11] [B2] Rapid7 / SOCRadar — wp2shell (CVE-2026-63030) Technical Advisories — rapid7.com
- [12] MAGNET S2 Report 260821-1800Z — Tongan Crip Gang (TCG) Utah, full source list therein — magnethf.com
- [13] MAGNET S2 Report 260814-1700Z — prior cycle baseline — magnethf.com
To Learn More About MAGNET, Visit www.MAGNETHF.COM
