LC-1 · Kinematic Threat Briefs

Kinematic Threat Brief

# Kinematic Threat Brief

**LRRK Watch / Open-Source Intelligence** — Five current signals across systems that sense, move, and act.

| Field | Value |
| --- | --- |
| Collection cutoff | 30 November 2010 |
| Platform | Quiet Systems |
| Data label | Open-source intelligence // LRRK analytic product |
| Handling | Public-source material. Image rights require separate verification before publication. |

## Executive read

### BLUF

Symantec’s November Stuxnet dossier made PLC sabotage and Iran-concentrated infection the default public technical picture, while WikiLeaks’ 28 November Cablegate release created a new primary stream that, within days, would document the political economy of Predator access — even if the richest drone cables hit the press in early December.

### Key judgments

1. **[Assessment — high confidence]** W32.Stuxnet Dossier version 1.3 (November 2010) is the month’s technical primary on a worm designed to reprogram PLCs and hide that change from operators.
2. **[Assessment — high confidence]** Cablegate began 28 November 2010 as a public dump of U.S. diplomatic cables; it is a Control Fabric leak whose UAV-relevant cables are already being read by the press at month’s end.
3. **[Inference — moderate confidence]** The political fight over who may own Predators will now have documentary evidence, not only rumor.

### Analytic labels

- **Fact** — verified reporting or primary record
- **Assessment** — analytic judgment
- **Inference** — reasoned but not directly observed
- **Uncertainty** — unresolved information gap

### Source grades

- **A1** — authoritative primary record / directly confirmed
- **B1–B2** — generally reliable and corroborated
- **C3** — useful but requires caution

## 01. Symantec W32.Stuxnet Dossier 1.3

*Event / publication dates: November 2010 (version 1.3 on the fetched PDF)*

**Verified record — [Fact — A1]** The fetched Symantec paper is labeled W32.Stuxnet Dossier Version 1.3 (November 2010), authors Nicolas Falliere, Liam O Murchu, and Eric Chien. It states Stuxnet targets a specific ICS likely in Iran, that the goal is sabotage by reprogramming PLCs, that discovery was in July with samples at least a year earlier, that a majority of infections were in Iran, and that features include USB .lnk propagation, print-spooler and SMB propagation, Step 7 project infection, peer-to-peer updates, C2, a Windows rootkit, and a PLC rootkit that hides modified code. C&C monitoring from 20 July showed, as of 29 September, approximately 100,000 infected hosts, over 40,000 unique external IPs from over 155 countries, and approximately 60% of infected hosts in Iran. On 22 August Iran was no longer reporting new infections to the C&C servers, “most likely due to Iran blocking outward connections.” This brief does not reproduce exploit or PLC-attack procedures. Fetched: https://www.cs.unh.edu/~it666/reading_list/ZeroDay/w32_stuxnet_dossier.pdf

**Threat landscape.** Public technical literature now describes a complete Sense-Move-Act loop against industrial controllers, with a geographic center of gravity in Iran and a C2 cut-off consistent with Iranian blocking.

**Intelligence assessment.** [Assessment — high confidence] Version 1.3 is the November public technical baseline. [Inference — moderate confidence] Iran blocking C2 is containment of the Windows/C2 plane, not proof that PLC payloads were removed. [Uncertainty] Plant identity remains Symantec’s “likely,” not IAEA’s.

**Opportunity.** An Iranian or IAEA November statement on centrifuges-plus-malware would have joined the ledgers.

**LRRK relevance.** Lab / Sense-Move-Act / Passport. File 1.3 as the November technical Passport; stolen signing certificates and Step 7 project infection are supply-chain and engineering-network findings, not a how-to.

**Confidence.** High on Symantec’s measurements; moderate on target identification.

## 02. Cablegate opens

*Event / publication dates: 28 November 2010 first partner publication of cables*

**Verified record — [Fact — B1]** CNN’s 1 December report on WikiLeaks cables — written from the Cablegate stream that began 28 November — treats the cables as authentic U.S. diplomatic records. The first UAV-rich cable stories land on 1 December and are filed in the December brief. For November, the Fact is that Cablegate has started and that drone-relevant cables are already in reporters’ hands at cutoff. Fetched: https://edition.cnn.com/2010/US/12/01/wikileaks.pakistan.drones/index.html

**Threat landscape.** Diplomatic C2 and political-economy of UAV access are about to become public documents.

**Intelligence assessment.** [Assessment — high confidence] A large classified diplomatic archive is now leaking on a schedule. [Inference — moderate confidence] UAV sales, Pakistani private consent, and third-country ISR sharing will appear. [Uncertainty] The November 28–30 published subset was not independently re-counted here.

**Opportunity.** WikiLeaks’ own 28 November index of first cables would have been a second A1; the fetched CNN piece is the UAV-relevant confirmation used.

**LRRK relevance.** Passport / Watch. Open a Cablegate serial; grade each cable as it is published.

**Confidence.** High that Cablegate began; UAV specifics reserved to December’s fetched CNN article.

## 03. IAEA physical ledger still malware-silent

*Event / publication dates: GOV/2010/46 (September) still the last fully fetched IAEA report*

**Verified record — [Fact — A1]** This collection’s fetched IAEA primary remains GOV/2010/46. It does not mention Stuxnet. A November successor report was not successfully retrieved as a PDF here. Fetched: https://www.iaea.org/sites/default/files/documents/gov2010-46.pdf

**Threat landscape.** Safeguards accountancy and vendor forensics remain unjoined in the fetched official record.

**Intelligence assessment.** [Assessment — high confidence] No fetched November IAEA document attributes centrifuge status to malware. [Uncertainty] A November IAEA report may exist outside this fetch.

**Opportunity.** Retrieving GOV/2010/62 or the November Board report would have been the correct physical update.

**LRRK relevance.** Watch. Negative join.

**Confidence.** High on the negative for this collection.

## 04. Extra-theater UAV Act — about to be documented from the other side of the cable

*Event / publication dates: continuing operations; Cablegate imminent on private Pakistani consent*

**Verified record — [Fact — B2]** Operational continuity still rests on the January C2 snapshot; no November official U.S. strike table was fetched. Fetched: https://www.nbcnews.com/id/wbna35027603

**Threat landscape.** The Act program’s political economy is about to be more visible than its sortie log.

**Intelligence assessment.** [Assessment — moderate confidence] Continuity of strikes. [Inference — moderate confidence] Cablegate will matter more to Watch in December than any November orbit count. [Uncertainty] November counts not fetched.

**Opportunity.** An official November tempo note.

**LRRK relevance.** Kestrel / Control Fabric.

**Confidence.** Moderate.

## 05. NAS access and no civil drone market

*Event / publication dates: September hearing still the fetched FAA position*

**Verified record — [Fact — A1]** Commercial UAS operations in the U.S. are not permitted; public operators use COAs. Fetched: https://irp.fas.org/congress/2010_hr/uas.html

**Threat landscape.** November 2010 remains military/public-operator UAS.

**Intelligence assessment.** [Assessment — high confidence] No COTS quadcopter signal. [Uncertainty] October/November access-plan delivery still unfetched.

**Opportunity.** Posted NAS Access Plan.

**LRRK relevance.** Control Fabric.

**Confidence.** High.

## Forward indicators

Ranked watchlist as of the collection cutoff (what a 2001–2011 Watch desk would have monitored next).

1. Cablegate cables on Predators, Pakistan, Turkey, UAE, and UAV video downlinks.
2. Next IAEA Iran report — any halt or replacement-rate language.
3. Symantec updates that name process conditions (frequency converters) without requiring a recipe.
4. Official U.S. comment on Cablegate sources and damage.
5. Any state attribution claim for Stuxnet (none is official in this collection).

> **Collection integrity.** Symantec 1.3 PDF fetched and used. Cablegate start accepted; detailed drone-cable quotes reserved to the 1 December CNN piece actually fetched. Did not fetch a November IAEA PDF and did not invent a mid-November Natanz halt. Did not use Zhuhai 2010 UAV-show claims without a fetched 2010 primary. No Stuxnet exploit steps.

*LRRK — security assurance for systems that sense, move, and act.*

<p align="right"><span style="opacity:0.35;letter-spacing:0.18em;font-size:0.8em">L-C1</span></p>