DEEP DIVE – By any traditional definition, the city of Ryazan doesn’t belong on a list of battlegrounds in the Ukraine war. There are no Ukrainian soldiers or tanks deployed there, and it’s in western Russia, roughly 600 miles from the active front lines of Pokrovsk or Kupiansk.

But residents and officials in Ryazan – population 550,000 – wouldn’t be surprised to find their city on such a list. Ukraine has attacked Ryazan at least a half dozen times, as part of an escalating drone-and-missile campaign against Russia’s oil sector. Most recently, an oil refinery in Ryazan – Russia’s fourth-largest – was forced to shut down after an Oct. 23 attack by Ukrainian drones.

Ryazan is hardly alone.

Lt. Gen. Vasyl Maliuk, head of the Ukrainian Security Service, said last week that Ukraine has carried out more than 160 successful attacks on Russian refineries and other energy targets this year; an Open Source Centre investigation identified more than 90 strikes between Aug. 2 and Oct. 14. In the last week alone, Ukraine has struck an oil terminal and tanker in Russia’s Black Sea port of Tuapse; energy facilities in Russia's Oryol, Vladimir, and Yaroslavl regions; and the Koltsevoy, or “ring,” pipeline, which links refineries in Moscow, Ryazan, and Nizhny Novgorod, and supplies fuel to the Russian military. Earlier strikes damaged one of Russia's biggest oil refineries near St. Petersburg, and perhaps most impressive – from the Ukrainian point of view – the campaign has reached as far as the Siberian city of Tyumen, some 1200 miles east of Moscow.

Stretching the conventional notion of front lines is clearly part of the Ukrainian strategy; the strikes have forced the Kremlin to worry about drone and missile attacks across a broad swath of Russian territory. But the main aim is to hurt the Russian oil sector – the country’s richest revenue source, and a key reason why the Kremlin has been able to maintain the funding of its war machine.

“Ukraine’s theory of victory now includes destroying Russia’s energy sector,” Lt. Gen. Ben Hodges, a former commander of U.S. Army Forces in Europe, told The Cipher Brief. “They’ve developed capabilities that can reach great distances with precision, exposing Russia’s vulnerability – its inability to protect critical infrastructure across its vast landscape.”

Last week Ukrainian President Volodymyr Zelensky vowed to intensify the pace and scope of the campaign. “We must work every day to weaken the Russians. Their money for the war comes from oil refining,” Zelensky said in an Oct. 27 address to the nation. “The most effective sanctions - the ones that work the fastest - are the fires at Russia’s oil refineries, its terminals, oil depots.”

Zelensky also noted that 90 percent of the strikes have been carried out by Ukrainian-made drones and missiles – a not-so-subtle message to Europe and the U.S.: get us more of your long-range weapons, and we can help bring Russian President Vladimir Putin to the negotiating table.

“It’s very impressive,” said Balazs Jarabik, a former European Union diplomat and analyst for RPolitik, said of Ukraine’s campaign against the Russian energy sector. In an interview with The Cipher Brief, Jarabik said the attacks have “had an impact in terms of getting headlines, making the Russian war effort more expensive, and creating shortages so the Russian people feel the pain of the war.”

That’s also the aim of the recent U.S. sanctions against energy giants Rosneft and Lukoil, the first American economic penalties imposed on Russia since Donald Trump returned to office. The Treasury Department said the sanctions would “increase pressure on Russia’s energy sector and degrade the Kremlin’s ability to raise revenue for its war machine.”

While Ukrainian officials have welcomed the sanctions, they have also said that their drone and missile attacks pack a more powerful punch.

“Our strikes have already had more impact than sanctions,” Kyrylo Budanov, Ukraine’s head of Military Intelligence, said on Telegram following last week’s spate of attacks.

For their part, Putin and other Russian officials have downplayed the impact of the strikes while at the same time warning that they are dangerously escalatory. The Kremlin has also said that neither the attacks nor the sanctions will move them to change course in the war.

Experts say both sides may be right – that in the short term, the Kremlin can probably ride out the impact of the Ukrainian campaign, but that Russia may feel significant pain if the sanctions are enforced and the oil sector strikes continue.

“Russia’s oil refineries are a bit like a man who is being repeatedly punched,” Sergey Vakulenko, Senior Fellow, Carnegie Russia Eurasia Center, wrote in a recent assessment for Carnegie Politika. “He will not die from one punch, or even half a dozen punches. But it becomes harder and harder for him to recover after each subsequent blow. Although no single punch is fatal, he could end up being beaten to death.”

Need a daily dose of reality on national and global security issues? Subscriber to The Cipher Brief’s Nightcap newsletter, delivering expert insights on today’s events – right to your inbox. Sign up for free today.

Assessing the damage

To date, the Ukrainian strikes have hit 21 of Russia's 38 large oil refineries, according to the BBC, and several have been struck more than once. Roughly 20% of the nation’s refining capacity has been damaged or destroyed, and last month the International Energy Agency (IEA) reported that Russia's revenues from crude oil and refined products had fallen to their lowest level in a decade – excluding the period immediately following the COVID-19 outbreak.

"Persistent attacks on Russian energy infrastructure have cut Russian crude processing by an estimated 500,000 barrels per day, resulting in domestic fuel shortages and lower product exports," the IEA said. In an accompanying forecast, the agency said that if the sanctions remain in place and the attacks continue – even without Zelensky’s promised scaling-up of their cadence – the impact to Russia’s refining would stretch to at least mid-2026.

Beyond the macroeconomic impact, the Ukrainian campaign has also been felt by Russian citizens, in the form of higher fuel prices and – in some regions – shortages and long lines for gas.

“The economic impact of strikes against Russian energy infrastructure is beginning to be felt outside of Moscow, as Russia diverts available energy from the regions to keep Moscow supplied,” Rob Dannenberg, a former chief of the CIA’s Central Eurasia Division, wrote last week in The Cipher Brief. “There are shortages and energy price hikes that the Kremlin can no longer conceal.”

And in a broader reflection of Russia’s economic woes, this week the central bank downgraded the country’s growth forecast. Experts say the sanctions and Ukrainian strikes are a big part of the problem for Moscow.

“Ukraine’s attacks on Russian energy infrastructure are strategically meaningful and increasingly so,” Jacek Siewiera, a former head of Poland’s National Security Bureau, told The Cipher Brief. He said the strikes are serving three strategic functions: forcing Russia to divert efforts to rear-area defense; raising the overall cost of war by creating new logistical costs inside Russia; and a less tangible, more symbolic impact.

“These attacks send a message to Moscow and its economy that Ukraine – and its backers – can reach deep,” Siewiera said. “That has symbolic as well as material value.”

What comes next

Might the Ukrainian campaign alter the course of the war? Experts are divided on the question.

On the one hand, dozens of Russian oil sector targets are now within reach of Ukrainian missiles and drones – and it’s clear that Zelensky’s vow to expand and intensify the campaign is underway. An already-bruised industry in Russia is surely girding for more punishment.

But several experts said that in order to sustain the tempo and volume of the attacks, Ukraine will need help from the West or a significant boost to its own capabilities.

“Ukraine has made impressive inroads but it’s not yet clear whether the strikes will fundamentally degrade Russia’s war-fighting capacity,” Siewiera said. He and others echoed Zelensky’s point – that the West should support Ukraine’s deep-strike capabilities to boost the impact of the current attacks, and improve the odds that they will effect change in Moscow. Until then, Siewiera said, it’s unlikely that the campaign can deliver “a knockout blow.”

Jarabik agreed, noting that Ukrainian drones typically carry payloads of only 50-60 kilograms (roughly 110-130 pounds); long-range missile systems can inflict far greater damage. He and others said that much will depend on the success of the Ukrainian-made Flamingo missile – which has been touted as a homegrown alternative to western long-range weapons. Officials say the Flamingo is now operational, and that it can carry more than 1,000 kilos (2000+ pounds), with a range of roughly 1800 miles.

“I think we are going to see the Ukrainian strikes increasing,” Jarabik said. “The big question here is whether Ukrainians are going to have the missile capabilities to scale the attack.” At the current rate, he said, Ukraine cannot compel the Kremlin to alter its approach. “So far, neither the sanctions nor this (campaign of strikes) is actually enough to bring the end of the war. Russia has the means to continue.”

All those interviewed for this piece agreed that the success of the Ukrainian campaign will depend on whether Ukraine can hit more targets, more frequently, and with heavier payloads.

“As Ukraine continues to improve its long-range precision strike capability – and if the West adds its own weapons to Ukraine’s arsenal – the impact is going to increase significantly,” Lt. Gen. Hodges said. And that, he said, “could lead to a successful outcome for Ukraine.”

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief because National Security is Everyone’s Business.

EXPERT PERSPECTIVE -- In the middle of the night, with no witnesses, a single ship flagged out of Hong Kong drags its anchor across the Baltic Sea. In silence, it severs a vital gas pipeline and the digital cables that link northern capitals. By morning, millions lose connectivity, financial transactions stall, and energy grids flicker on the edge.

The culprit vanishes behind flags of convenience, leaving blame circulating in diplomatic circles while Moscow and others look on, exploiting maritime ambiguity and the vulnerabilities of Europe's lifelines.

Meanwhile, in Warsaw and Vilnius, shoppers flee as flames engulf two of the largest city malls. Investigators soon discover the arsonists are teenagers recruited online, guided by encrypted messages, and paid by actors connected to hostile state agencies. The chaos sows fear, erodes social trust, and sends shockwaves through European communities—proxy sabotage that destabilizes societies while providing plausible deniability to those orchestrating the acts.

Thousands of kilometers away, Chinese dredgers and coast guard vessels silently transform disputed reefs into fortified islands in the South China Sea. With no declaration of war and no pitched battles, new airstrips and bases appear, steadily shifting maritime boundaries and economic interests. Each construction project redraws the strategic realities of an entire region, forcing neighbors and distant powers alike to reckon with incremental, shadowy coercion and efforts to change the status quo.

In early 2024, Chinese state-sponsored hackers, known as "Volt Typhoon," penetrated U.S data repositories and embedded themselves deep within the control systems of U.S. critical infrastructure, including communication networks, energy grids, and water treatment facilities.

Then-FBI Director Christopher Wray described it as a pre-positioning of capabilities by China that can be turned on whenever Beijing wanted - wreaking havoc and causing real-world harm to American citizens and communities. China has denied any connection to these attacks on U.S. sovereignty.

And just weeks ago, around 20 Russian drones violated Poland’s airspace. Russia’s denials were predictable and since then, Russian drones and jets have violated airspace in Romania, Estonia, and over the Baltic Sea.

Were these threats, tests of capability and resolve, provocations, or demonstrations—or maybe all of the above? Just as NATO will develop a set of lessons-learned for future incursions, it’s also likely that Russia learned from these episodes and will recalibrate future incursions.

Threaded almost invisibly through all of these gray zone activities, and countless others like them, is cognitive warfare—a persistent tool of our adversaries. It is an assault on cognition. The information and decision spaces are flooded with weaponized narratives, AI-powered disinformation, synthetic realities, and the coercive use of redlines and intimidation.

The goal is clear—deceive, change how we see the world, fracture societies, destroy faith in institutions and partnerships, erode trust, challenge and replace knowledge and belief, coerce and intimidate; and perhaps most importantly; undermine decision autonomy. It is here, in the crowded intersection of AI; cyber; traditional tools such as narratives and storytelling; and cognition; that today’s most urgent battles are fought.

These are all operations in the gray zone. We all use somewhat different terms for this, but let me share the definition of the gray zone that I think works well.

The gray zone is the geopolitical space between peace and war where adversaries work to advance their own national interests while attacking and undermining the interests of their adversaries and setting the conditions for a future war without triggering a military response.

We might refer to attacks in the gray zone as gray warfare. It is the domain of ambiguity, deniability, and incremental aggression calculated to limit deterrence and discourage persuasive response.

The 2026 Cipher Brief HONORS Awards are open for nominations. Find out more at www.cipherbriefhonors.com

Today, it is the space where global competition, particularly great power competition, is playing out.

Why are we seeing more gray zone activity today?

First, great power competition is intensifying. This includes great powers, middle powers, and impacts almost every other nation. Almost every nation has a role to play, even if involuntary: competitor, ally and supporter, enabler, spoiler, surrogate, or innocent bystander and victim. Like the African proverb says, “When elephants fight, it is the grass that suffers.”

But great powers will go to great lengths to avoid 21^st Century superpower conflict, primarily because of the fear of unintended losses and damage to national power that could take decades to recover. The catastrophic damage to nations and militaries from WWII are distant—but still vivid—reminders of the impact of a war of great powers.

Today, just look at the unprecedented loss of national power by Russia in indirect superpower conflict. Superpower conflict has consequences. Given these strategic considerations, the gray zone and gray warfare provide an effective strategic alternative to conventional war. Our adversaries have calculated that there are more gains than risks in the gray zone, and that any risks they do face are acceptable.

Second, technology levels the playing field, creating new opportunities for gray zone attacks. Cyberattacks, even those that are disrupted, lead to more effective cyber capabilities by our adversaries. AI-driven cognitive warfare now delivers persuasive content with unprecedented global access and immediacy. Small kinetic drones can be wielded by state and non-state actors to pose both kinetic and cognitive threats. Technology also enables adversaries to conceal their operations and increase non-attribution. Even simple technologies have the potential to generate strategic effects in the gray zone.

Third, surrogates and proxies offer expanded reach, ambiguity, and impact

Little Green Men, hired criminals, ghost ships, unknown assassins and saboteurs, and shadowy companies that help evade sanctions blur attribution, providing bad actors with a veneer of deniability while increasing their reach, impact, and lethality. On a broader scale, Houthi attacks on global shipping and North Korean soldiers fighting Ukraine elevate the effects of this ambiguous warfare to a higher level. This trend is likely to intensify in the future.

Fourth, it is important to address the direct impacts of Russia’s war on Ukraine on an increase in gray zone attacks. Russia’s significant loss of national power and limited battlefield gains have created pressure on the Kremlin to reassert relevance, project power, and potentially punish antagonists. This dynamic almost certainly means a continued escalation of gray zone activities targeting Europe and aimed at destabilizing the continent. Many experts believe the Baltics and the Balkans may be particularly vulnerable.

That Russian gray bullseye is crowded—the U.S. is also a traditional target, and more Russia activity to undermine and weaken the U.S. is coming, despite Putin’s offers of renewed diplomatic and economic cooperation.

Finally, there are more gray zone attacks because real deterrence and persuasive responses to gray attacks are challenging, and our adversaries know it. In other words, gray zone attacks in most cases are relatively low cost, often effective, provide a level of deniability, and frustrate efforts at deterrence and response.

Our adversaries have calculated that they can hide behind ambiguity and deniability to violate sovereignty, ignore national laws and international norms, and engage in activities such as political coercion, sabotage, and even assassinations without triggering an armed response.

This “no limits” approach exploits the openness, legal norms, and ethical standards of democratic societies, making coordinated, timely, and effective response more difficult.

So, what can we do?

The most important outcome of our actions is to change the risk calculation of our adversaries. Gray zone attacks that go unanswered reward our adversaries and reinforce the idea that there are more gains than risk in the gray zone and encourage more attacks. Further, our adversaries calculate, often accurately, that our reasonable concerns for avoiding escalation will lead to indecision, weak responses, or the acceptance of false choices.

We need improved and shared gray zone intelligence to see through the fog of disinformation, synthetic realities, false risks and threats, and an overload of information by our adversaries to understand what is taking place in the gray zone. This not only strengthens our operations to counter gray zone attacks but it helps our citizens, communities, and countries to understand, recognize, reject, and remain resilient in the face of gray zone attacks.

We have to employ “strategic daylighting” to expose and put into context the gray zone activity by our adversaries—stripping away deniability and laying bare nefarious and illegal actions—knowing that our adversaries will go to great lengths to conceal, defend, and attack our efforts to expose their activities.

We have to speak frankly and convincingly to our adversaries and of course, we have to back up our words with persuasive action. Empty warnings and rhetoric will fall short. Changing the risk calculation of our adversaries means real consequences across a broad spectrum—public, diplomatic, economic, legal, informational, or even kinetic. It means a strategy on how to respond - not just a series of hasty responses. Real deterrence will result from planning and strategy; not decisions in the moment based on immediate circumstances.

Finally, we need to think of deterrence and response as a team sport - an “Article 5 mindset.” Our adversaries will seek to divide and isolate. Collective, unified action and resolve can form a powerful deterrent.

Of course, none of this is new. All of us need a solid understanding of the problems and the likely best solutions and implementation remains the greatest challenge.

We can go a long way with a good strategy, good partners, and resolve which seems like a reasonable place to start.

This Cipher Brief expert perspective by Dave Pitts is adapted from a speech he recently delivered in Sarajevo. Comments have been lightly edited for clarity. All statements of fact, opinion, or analysis expressed are my own and do not reflect the official positions or views of the US Government. Nothing in my remarks should be construed as asserting or implying US Government authentication of information or endorsement.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals.

Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

OPINION — “I'm not going to answer particulars on something that may be in the planning process, but we definitely do have multiple layers of National Guard response forces, whether it's in each state, whether it's regionally, whether it's Title 10 active duty, whether it's Washington D.C. We've got a lot of different ways that constitutionally and legally we can employ Title 10 and Title 32 forces, and we will do so when necessary.”

That was Defense Secretary Pete Hegseth in the Oval Office this past Friday, after a meeting of the Trump administration’s Homeland Security Task Force, responding to a reporter’s question about whether the establishment of multi-state National Guard rapid response forces “that's going to be trained in crowd control and civil unrest and deployed in all 50 states by April of 2026” is underway.

It’s worth remembering that buried as part of “Operational Actions” called for under an August 25, Trump Executive Order (EO) entitled, “Additional Measures To Address the Crime Emergency in the District of Columbia,” there is a section that reads: “The Secretary of Defense shall immediately begin ensuring that each State’s Army National Guard and Air National Guard are resourced, trained, organized, and available to assist Federal, State, and local law enforcement in quelling civil disturbances and ensuring the public safety and order whenever the circumstances necessitate, as appropriate under law.”

That EO section goes on to say. “In coordination with the respective adjutants general, the Secretary of Defense shall designate an appropriate number of each State’s trained National Guard members to be reasonably available for rapid mobilization for such purposes. In addition, the Secretary of Defense shall ensure the availability of a standing National Guard quick reaction force that shall be resourced, trained, and available for rapid nationwide deployment.”

Before Trump signed the August 25 EO, his assistant Will Scharf described it as “an executive order that contains a number of additional measures relating to crime and law enforcement in Washington, D.C. It charges, for example, your Secretary of Defense with establishing specialized units in both the D.C. National Guard and the National Guard units around the country specifically trained and equipped to deal with public order issues.”

Hegseth added about the response teams, “And at your direction as well, sir, [meaning Trump] it's just common sense to make sure they're armed as well.”

Under Title 10, the President can federalize any state’s National Guard if the country “is invaded or is in danger of invasion by a foreign nation,” if there’s “a rebellion or danger of a rebellion” against the federal government’s authority, or if the president “is unable with the regular forces to execute the laws of the United States.” Such an order “shall be issued through the governors of the States,” Title 10 says.

Under Title 32, state National Guard units can be deployed for federal purposes, but they remain under state control. Since the troops are under state control, they are not subject to the Posse Comitatus Act’s restriction against engaging in civilian law enforcement.

On August 26, retired-National Guard Maj. Gen. Randy Manner said on PBS: “I think this is unneeded and also very dangerous. It's setting a new precedent.”

He went on, “When I was the acting vice chief of the National Guard Bureau, we absolutely already put into place the ability of having quick reaction forces in every state, depending on the size…They were at the time, of course, targeting the ability to respond to emergencies in the state such as floods, hurricanes, forest fires, earthquakes, and so on to be able to save lives. The difference here is that it's focused on ‘public order.’ That's very disturbing.”

Manner added, “Also, the idea of creating a unit whose primary mission is to deploy anywhere in the country to deal with potentially demonstrations or civil disorder, as the President sees fit…that is not in keeping with the mission of the National Guard as a strategic reserve for our military and for our nation.”

Manner then made an important point, relative to what has happened since: “This is something where the President is imposing the armed military to go into American cities. That is the most significant difference. And it's very important to remember that civil disturbance deployments by governors is actually the smallest amount of missions that have ever been done by the National Guard. It is a rarity, whereas now the President is elevating it to be a significant capability for the National Guard.”

The Cipher Brief brings expert-level context to national and global security stories. It’s never been more important to understand what’s happening in the world. Upgrade your access to exclusive content by becoming a subscriber.

Over the objections of the Governors of California, Oregon and Illinois, President Trump has ordered Title 10, federalized Guard units deployed – deployments which are all undergoing judicial tests.

In Illinois, U.S. District Judge April Perry on October 9, issued a temporary order that barred the Trump administration “from ordering the federalization and deployment of the National Guard of the United States within Illinois.”

Perry said in her opinion that there was “insufficient evidence of rebellion or a danger of a rebellion,” as required by Title 10, nor was there “sufficient evidence that the President was unable with the regular forces to execute the laws of the United States.” The Trump administration immediately appealed and moved for a stay of the order pending appeal.

On October 16, the U.S. Court of Appeals for the Seventh Circuit agreed with Judge Perry, writing that in their opinion “the facts do not justify the President’s actions in Illinois under [Title 10], even giving substantial deference to his assertions. The Circuit Court did, however, allow Presidential federalization of a National Guard unit, while prohibiting its deployment.

In its opinion, the Circuit Court made points about the “rebellion or danger of rebellion,” that are worth reviewing since it’s clear the Trump administration sees Title 10 allowing them to use military troops freely.

The Circuit Court wrote: “Political opposition is not rebellion. A protest does not become a rebellion merely because the protestors advocate for myriad legal or policy changes, are well organized, call for significant changes to the structure of the U.S. government, use civil disobedience as a form of protest, or exercise their Second Amendment right to carry firearms as the law currently allows.”

The Court added, “Nor does a protest become a rebellion merely because of sporadic and isolated incidents of unlawful activity or even violence committed by rogue participants in the protest. Such conduct exceeds the scope of the First Amendment, of course, and law enforcement has apprehended the perpetrators accordingly. But because rebellions at least use deliberate, organized violence to resist governmental authority, the problematic incidents in this record clearly fall within the considerable daylight between protected speech and rebellion.”

I quote the Circuit Court opinion because the Trump administration from the start has claimed in this case before the District and Circuit Courts and elsewhere, that the President’s federalization of the Guard under Title 10 “is not judicially reviewable at all. Alternatively, it contends that the factual predicates of [Title 10] are satisfied in light of the deference due the President’s decision to federalize the Guard.”

Need a daily dose of reality on national and global security issues? Subscriber to The Cipher Brief’s Nightcap newsletter, delivering expert insights on today’s events – right to your inbox. Sign up for free today.

On October 17, the day after the Circuit Court opinion, Trump’s Solicitor General D. John Sauer filed an emergency motion with the Supreme Court seeking to block the Perry order that prevents deployment of the federalized Illinois National Guard units.

In seeking that order, which would also overrule the Seventh Circuit Court opinion, Sauer argued, as he had done unsuccessfully in District Court, “As a threshold matter, both the statutory language and historical tradition make clear that the President’s decision whether to federalize the Guard is not subject to second-guessing by the State of Illinois or a federal district court.” He then quoted Title 10 with respect to “rebellion or danger of rebellion.”

Sauer also wrote, to support the argument for deployment, that “The President has express statutory authority to ‘call into Federal service’ the National Guard, after which the Guardsmen serve under the command and control of federal military officials and ultimately the President as Commander in Chief.”

The Supreme Court has not yet acted on this emergency motion.

But as writers in Just Security said last Friday, “The government’s interpretation suggests that a President may deploy military forces anywhere in the United States for any reason, and that courts would have no authority to determine its legality. This assertion runs counter to U.S. history, the structure of powers related to the military in the U.S. Constitution, and the theory of checks and balances.”

Or as New York Attorney James D. Zirin wrote yesterday in The Washington Monthly, “If the Court grants Trump relief in Chicago, what will stop Trump from deploying National Guardsmen nationwide to supplement the ICE program in enforcing immigration laws? And then, based on some pretext that there is a rebellion, posting troops at select polling places nationwide to intimidate voters during the midterm elections?”

It is Zirin’s second fear, for the 2026 midterm congressional elections, that first drew my concern over Trump’s August proposal for all 50 states to have National Guard rapid reaction forces prepared to ensure “the public safety and order whenever the circumstances necessitate, as appropriate under law.”

There has been no public report I know of from the National Guard Bureau or Defense Department as to how many such units have been formed so far under the Trump administration, despite the April 2026 deadline. It is one of many things to watch for.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals.

Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

DEEP DIVE — Front companies, campus networks, diaspora recruits — Tehran’s espionage push on U.S. soil is bigger, bolder, and harder to track than many realize.

On July 31, a coalition of Western governments led by the United States publicly warned of a wave of Iranian intelligence activity they said was aimed at “killing, kidnapping, and harassing” dissidents, journalists and officials across Europe and North America. The unusually blunt joint statement, signed by Washington, London, Paris, Berlin and more, said Iranian services were increasingly collaborating with criminal networks and called for coordinated defenses.

That diplomatic alarm was echoed in criminal courts and federal filings in recent months. In Oslo over the summer, prosecutors put a former security guard at the U.S. Embassy on trial after accusing him of offering building floor plans and security routines to both Russian and Iranian operatives in return for euros and cryptocurrency; an example of how even low-level hostile services can monetize perimeter jobs.

In the United States, a more concrete case played out in federal court this spring when a former Federal Aviation Administration contractor, Abouzar Rahmati, pleaded guilty in April to acting as an unregistered agent of the Iranian government after allegedly seeking aviation and solar-energy technology and passing non-public data to Iran. Prosecutors said the activity combined procurement, intelligence collection, and network building — classic gray-zone tradecraft that can be lethal in aggregate even if individual acts appear isolated.

Moreover, the FBI has publicly sought information on an Iranian intelligence officer it says recruited intermediaries for surveillance and for plots intended as retaliation for the 2020 killing of Qassem Soleimani — showing Tehran remains willing to task operatives to target current or former U.S. officials.

Together, these cases illustrate a pattern more than a single conspiratorial plan.

“Iran’s espionage efforts in the U.S. and allied countries are perhaps increasing, in both frequency and sophistication,” Colin Clarke, a senior research fellow at The Soufan Center, tells The Cipher Brief. “But it goes beyond mere espionage and extends to surveillance and active terror plots.”

Three recurrent patterns

Recent public cases and multiple intelligence assessments indicate three recurring lines of operation.

First: access and mapping. Low-level staff, contractors and service providers have proximity to sensitive facilities. The U.S. embassy case underscores how seemingly peripheral access can be valuable to foreign services. Even information that is not classified—floor plans, guard rotations, contractor lists—can be stitched together into operational value.

Second: procurement and sanctions evasion. Tehran has long sought aviation, dual-use and energy components through front companies and covert procurement channels. The Rahmati plea demonstrates how U.S. contractor credibility can be leveraged to facilitate the movement of goods, knowledge, or lists of potential collaborators. “Sanctions evasion and procurement are treated more as a ‘legitimate’ business opportunity in their eyes,” Matthew Levitt of The Washington Institute noted, distinguishing those networks from strictly human intelligence operations.

Third: transnational repression and violent plotting. The FBI’s public notice about Majid Dastjani Farahani made clear that some taskings included surveillance of religious sites and recruitment for attacks framed as revenge for Soleimani’s killing. That is the line where intelligence collection and terrorism blur—a mixing of objectives that, several experts warned, raises the stakes.

How they recruit — the blunt and the subtle

Recruitment, the experts said, follows both old and new playbooks.

“Recruitment inducements are the same as always: family pressure, financial, ego, gradual approaches, honey traps,” a former senior U.S. intelligence official tells The Cipher Brief on the condition of anonymity. “Tehran has enjoyed the cyber world like everyone else.”

The explicit lever — threats to family back home — is a recurring thread in dozens of post-incident reviews. Historical cases such as the 2013 Manssor Arbabsiar plot are helpful reminders of old patterns; Arbabsiar’s prosecution remains a touchstone for the limits and dangers of outsourced plots.

Clarke also noted that Iran’s services have broadened their toolkit in recent years to “outsource activities to a range of criminal entities, including gangs,” reflecting a hybrid strategy that mixes ideological operatives with transactional cut-outs.

Beth Sanner, the former deputy director of national intelligence for mission integration, stressed the diaspora angle: Iran has stepped up harassment and plotting against exiles and communities abroad in countries like Australia and across Europe, since the Soleimani strike and increasingly relies on local criminal networks to carry out deniable tasks, making the work of drawing connections incredibly difficult for investigators.

“We have not seen Iran be as successful with this in the U.S., that we know of,” Sanner tells The Cipher Brief, “but I think it is only a matter of time.”

Matthew Levitt, senior fellow and director of counterterrorism and intelligence at The Washington Institute for Near East Policy, described the human-cyber fusion that makes modern tradecraft effective. Once operators can access email or scheduling systems, they can combine that intrusion with social engineering to track or manipulate targets.

“Once they had an interest in people like Ambassador Bolton or Secretary Pompeo, they’d want to know where Bolton would be next Tuesday,” he tells The Cipher Brief.

Levitt recounted being spoofed in a recent European operation — emails and ProtonMail contacts posed as him, and an operator even used an American-accented voice on WhatsApp to reinforce the ruse.

The tactic is simple, low-cost and scalable.

The murky middle — law, attribution and the limits of remedies

Part of the problem is structural: Western legal systems punish the actors who are caught, but they often struggle to hold accountable the shadowy operators who task them.

“We punish those involved in operations, not those behind operations,” the anonymous official said. “We handle Iran’s work as a legal issue, not as a state warfare issue.”

That legal framing shapes the available responses — criminal prosecutions, sanctions, diplomatic expulsions — while stopping short of kinetic or overt state-level countermeasures.

That framework, such experts caution, often leaves gaps in deterrence, creating space for Iran to continue experimenting with plots that may appear clumsy but still carry real risk.

Clarke warned that Tehran may have been “amateurish” in some plots. Still, it learns from failure and retains motive: revenge for Soleimani, pressure over nuclear setbacks, and the strategic aim of deterring dissidents.

“It would be a mistake to dismiss the severity of their intent,” he said.

What’s being done — and what should change

Governments are moving earlier in the threat lifecycle. In late June and July, U.S. authorities announced targeted immigration and enforcement actions against Iranian nationals in operations that officials said were designed to disrupt suspected networks and procurement channels. Those arrests, often filed as immigration or export-control violations, signal a preference for prevention over public prosecutions alone.

Experts recommended layered, practical reforms: universities and research centers should bolster insider-risk training and clear reporting pathways; contracting agencies need tighter vetting and monitoring of supply-chain access; allied services must share watchlists and technical indicators more rapidly; and communities vulnerable to transnational repression deserve coordinated consular and protective measures.

Clarke urged more realistic briefings for students and visiting scholars about the risks of coercion and family leverage, while Levitt emphasized the importance of basic cyber hygiene and multi-factor authentication checks that can mitigate social-engineering campaigns.

The longer arc

Iranian intelligence, however, is not a mirror of Russia or China: its budgets, technological reach and bureaucratic sophistication differ.

“The Iranians aren’t as advanced as the Chinese or the Russians,” Clarke noted. “Tehran’s plots have been a bit more amateurish and cumbersome.”

But intent matters. Levitt put it starkly: “Just because some of their operations look like Keystone Cops doesn’t mean they won’t succeed eventually. We have to get it right every time; they only need to succeed once.”

And Sanner warned that a shift toward criminal proxies makes attribution harder and response slower — fueling a permissive environment.

Historically, Tehran has combined state actors and proxies — most infamously through Hezbollah in the 1990s in Latin America — and the pattern of outsourcing persists. The task for U.S. policy is not only to prosecute and sanction when possible, but to harden the soft targets: campuses, contracting pipelines, and diaspora communities that Iran can pressure or co-opt.

Bottom line

Iran’s external operations are diverse and adaptive. They mix old tools — family coercion, diasporic leverage — with modern techniques, including cyber intrusion, online social engineering, and the purchase of deniable cut-outs.

The July 31 allied statement signaled an unusual diplomatic consensus; the public cases in Oslo, Washington and beyond show why that consensus has teeth. However, experts caution that the work to blunt Tehran’s pressure must be sustained, technical and community-level as much as legal and diplomatic.

As the one former U.S. intelligence official put it: Iran’s intelligence activity remains “the only threat that is simultaneously urgent, lethal, and strategic.”

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief because National Security is Everyone’s Business.

DEEP DIVE – A senior Ukrainian delegation will travel to Washington D.C. this week for talks that are expected to include the use of frozen Russian assets to aid Ukraine, air defense challenges and increased sanctions on Moscow. The decision on whether or not the U.S. will provide Ukraine with Tomahawk missiles is also expected to be front and center.

Ukrainian President Volodymyr Zelensky says he believes that the Israeli-Gaza ceasefire announced late last week, is proof that a resolution to his country’s fight against Russia is also possible.

In a congratulatory phone call from Zelensky to Trump on Saturday, Ukrainian officials said the two leaders talked about Russia’s latest strikes targeting Ukraine’s energy infrastructure, as well as the possibility of Kyiv obtaining U.S. made Tomahawk missiles. In a post on X, Zelensky said “If a war can be stopped in one region, then surely other wars can be stopped as well - including the Russian war”.

The missile request is the latest in a long-running series of high-profile requests by Ukrainian officials for more powerful and sophisticated western support.

President Trump says he has “sort of made a decision” about giving Tomahawks to NATO for supply to Ukraine, but says he wants to know Ukrainian plans for them before sending them.

Moscow is pushing back against the possibility of providing U.S. Tomahawks to Ukraine, which could provide the capability for even deeper strikes inside Russia, something that wouldn’t play well for the Russian President at home.

President Vladimir Putin said recently that sending Tomahawks to Ukraine would significantly damage U.S.-Russia relations, and that the weapons would "mean a completely new, qualitatively new stage of escalation, including in relations between Russia and the United States".

Ukraine has already shown impressive tenacity in striking targets on Russian soil. Kyiv’s domestic drone campaign against Russian oil and gas facilities, aimed at cutting Russia’s energy export revenues that fund its war machine, has been remarkably successful. Moscow has publicly acknowledged that it is facing domestic fuel shortages, but has not publicly attributed the Ukrainian strikes as the cause. In June, Ukraine smuggled over 100 drones into Russia and launched Operation Spider Web, a drone attack that resulted in the loss of a third of Moscow’s fleet of strategic bomber aircraft.

And, Ukraine has already successfully employed advanced western supplied missiles like the US-made Army Tactical Missile System (ATACMS) and the European-made Storm Shadow. The ATACM has a range of around 300 KM, while the Storm Shadow has a range of 250KM. Kyiv is also producing and testing its own long-range missile, the FP-5 Flamingo that has a stated range of 3000KM. Recent media reports indicate that Kyiv may have started using the Flamingo in an operational capacity, but details on the operations remain scarce.

^{An infographic titled "Range of ATACMS missiles" created in Ankara, Turkiye on November 19, 2024. (Photo by Murat Usubali/Anadolu via Getty Images)}

The Tomahawk would be a significant improvement in long-range strike capability for Ukraine’s military. The missiles, capable of being launched from ships, submarines and ground launchers, have a range of 1,500-2,000KM, and are capable of hitting targets accurately even in heavily defended airspace. The Tomahawk would give Ukraine the ability to hit most of European Russia, west of the Ural Mountains. That puts key political and military hubs like Moscow and St. Petersburg in range, as well as significant military assets and energy infrastructure.

_{A Tomahawk cruise missile flies toward Iraq after being launched from the AEGIS guided missile cruiser USS San Jacinto March 25, 2003 in the Red Sea. (Photo by Mark Wilson/Getty Images)}

THE CONTEXT

• President Trump says he “sort” of has made a decision on supplying Ukraine with Tomahawks
  
• Foreign Minister of Estonia told Trump that Tomahawks could help Ukraine “push Russia back”
  
• The Tomahawk missile is made by Raytheon and has a range of 1,500-2,000kms (around 930-1,550 miles)
  
• It is approximately 750 Kilometers from Kyiv to Moscow

• Tomahawks are primarily launched from maritime platforms and are currently deployed on all U.S. ships and submarines equipped with vertical launch systems (VLSs).

• Ground-launched Tomahawks are launched from the Typhon, a new vertical launch system developed by Lockheed Martin to enable the U.S. military to launch Tomahawks from the ground. This system would likely be required by Ukraine.

• Since the 1990s, the U.S. Navy has purchased about 9,000 Tomahawk units at an average price of $1.3 million each. It is unclear where the U.S. stockpile stands currently. U.S. allies armed with Tomahawks include the Netherlands, Australia, the UK, and Japan.

• The Trump administration in late August approved the sale of 3,350 Extended Range Attack Munition (ERAM) missiles to Ukraine. They have a range of 250 miles. The purchase is being funded by Denmark, the Netherlands, Norway and U.S. Foreign Military Financing.
  
  Experts and analysts are watching closely for developments coming out of Washington this week. Some notable questions remain regarding the potential use of Tomahawks by Ukraine such as:
  • If approved, will they represent a significant increase in capability for Ukraine?
  • What quantities and how quickly would Tomahawks be supplied to Ukraine?
  • How is Russian President Vladimir Putin likely to respond?
    

The Cipher Brief: Is sending Tomahawk missiles going to enable Ukraine to do a lot more than it's already capable of doing now? Would it make a difference?

Rear Admiral (Ret) Montgomery: I'm going to caveat this. I'm not opposed to Tomahawks. But I think it's “Tomahawks and.” And then how many Tomahawks? Ten Tomahawks won't make a difference. 100 Tomahawks won't make a difference. But 400 or 500 would. Is the U.S. willing to part with 400 or 500? Can Europe take a deep breath and pay for 400 or 500? And what are the Tomahawks going to look like? Are we going to strip them of certain capabilities and capacity? Then it becomes a slow land attack cruise missile. So I'm not sure.

Tomahawks would be helpful. What I'm sure would be much more, I think, operationally game-changing is the provision of the ERAM (Extended Range Attack Munition). And I'm thrilled with what the U.S. Air Force and the U.S. Department of Defense writ large have done with the ERAM, which is effectively a small cruise missile with extended ranges well beyond ATACMS, but less than the Tomahawk. There's multiple variants of it. And when it begins to deliver, it'll be 10 here, 20 there, but eventually it should get up to about 100 a month for 20 months. And you can fire it from MiG-29s or Sukaloys or F-16s. This weapon is going to stretch the battlefield for the Russians and will force logistics and command and control and troop aggregation sites farther and farther from the front line.

And I don't think the Russians have demonstrated the ability to properly control and support forces at long range and distances. So, if the Russians are stretched out like that, combined with the operational and strategic pressure from the long range unmanned Ukrainian UASs strikes, and maybe the addition of Tomahawks, particularly to target the refineries, I think all of this can really cause Putin to readjust his thinking.

So from my perspective, things could get better. It's not “Tomahawks alone” or “Tomahawks or.” It's “Tomahawks and”, and the “and” is the big thing. And that “and” to me is the ERAM.

Corn: I think that what Ukrainians are doing is great. The Tomahawks would just increase their ability and increase, I'd say, the volume of the attacks and deep strikes that they could conduct inside of Russia.

And of course there's a symbolic and kind of political message here too. If the United States agrees to provide these weapons systems, it just shows that we're not backing down and we're not going to be intimidated by Moscow, which I'm sure the Ukrainians want to see because that's a sign of political support. That's important for them.

The Cipher Brief: Moscow is obviously rattling the sabers over the potential US Tomahawk decision. How do you assess Russia's escalation threats to the U.S.?

Corn: I find it ironic when the Russians say they're going to retaliate. They're already launching attacks. They're already targeting Ukraine and now also NATO countries, and I would say even U.S. interests. They've been doing it for years. So my own belief is it's a lot of saber rattling. It's a full court press right now in Moscow to try and deter Washington and Brussels from taking certain steps that will be extremely painful and costly for Moscow.

I'm sure that [talk of Tomahawks] increases Moscow’s level of concern. They definitely do not want the Ukrainians to have these weapon systems, and they're making all kinds of threats. They're looking for potential sore points with the U.S., for example, suggesting they will deploy new weapons systems to Nicaragua or Cuba. They're going back to the Cold War playbook that led to the Cuba missile crisis.

So I’m not surprised. Experience has shown that the Russians make a lot of threats, but those threats tend to be empty. Let's go back to all the threats they made over the F-16s, over the ATACMS, over Finland and Sweden joining NATO. I don't think that they followed through on a lot of those threats, not in the near term, not on an immediate basis or not in an obvious way. They may, of course, respond in the future, but so far they have not followed through on threats to use nuclear weapons, which they’ve previously implied as a potential scenario. So, they haven't followed through on previous threats. It doesn't mean they won’t do it in the future, but my assessment is they will not. .

Rear Admiral (Ret) Montgomery: Russia and China practice a similar provocation principle. We democracies bend and capitulate to the fear that an authoritarian regime might do something because they announce that they've got a red line or they've got an issue. And they provoke us. They tell us that the provocation will cause them to overreact and therefore we should stand down. At no point ever do they have the same sense of decorum or restraint, right? But apparently we're supposed to practice that restraint. Enough of that. We need to do what we think is right. If it's Tomahawks, fine. If it's Tomahawks and ERAM, which is what I think it is, great. If it was E-RAM alone, I think it’d be great.

What I say is, I would not back off. One reason I support sending Tomahawks now is because the Russians oppose them so much and I feel compelled to support the decision, if it's made, to send them. But the Russians are going to learn that they were complaining about the wrong thing. And by the time they learn that lesson, I think they're going to be in a lot of pain.

In Summary:

The coming decision on Tomahawk cruise missiles is a true inflection point for both Ukraine and the U.S.: it could materially expand Kyiv’s ability to conduct deep-strike operations, but only if supplied in sufficient quantities and paired with the right launch and logistical support. US and Western leaders must weigh that operational upside against difficult questions - platform and delivery constraints, the need for complementary systems like ERAM, funding and NATO cooperation, and the very real risk of Moscow escalating its response. Whatever Washington decides will test U.S. resolve, reshape NATO burden-sharing conversations, and have consequences that reverberate across the battlefield in Ukraine and Russia.

Follow The Cipher Brief for more timely analysis and updates as this critical story develops.

Ethan Masucol, Ian Coleman and Connor Cowman contributed research for this report

DEEP DIVE – A senior Ukrainian delegation will travel to Washington D.C. this week for talks that are expected to include the use of frozen Russian assets to aid Ukraine, air defense challenges and increased sanctions on Moscow. The decision on whether or not the U.S. will provide Ukraine with Tomahawk missiles is also expected to be front and center.

Ukrainian President Volodymyr Zelensky says he believes that the Israeli-Gaza ceasefire announced late last week, is proof that a resolution to his country’s fight against Russia is also possible.

In a congratulatory phone call from Zelensky to Trump on Saturday, Ukrainian officials said the two leaders talked about Russia’s latest strikes targeting Ukraine’s energy infrastructure, as well as the possibility of Kyiv obtaining U.S. made Tomahawk missiles. In a post on X, Zelensky said “If a war can be stopped in one region, then surely other wars can be stopped as well - including the Russian war”.

The missile request is the latest in a long-running series of high-profile requests by Ukrainian officials for more powerful and sophisticated western support.

President Trump says he has “sort of made a decision” about giving Tomahawks to NATO for supply to Ukraine, but says he wants to know Ukrainian plans for them before sending them.

Moscow is pushing back against the possibility of providing U.S. Tomahawks to Ukraine, which could provide the capability for even deeper strikes inside Russia, something that wouldn’t play well for the Russian President at home.

President Vladimir Putin said recently that sending Tomahawks to Ukraine would significantly damage U.S.-Russia relations, and that the weapons would "mean a completely new, qualitatively new stage of escalation, including in relations between Russia and the United States".

Ukraine has already shown impressive tenacity in striking targets on Russian soil. Kyiv’s domestic drone campaign against Russian oil and gas facilities, aimed at cutting Russia’s energy export revenues that fund its war machine, has been remarkably successful. Moscow has publicly acknowledged that it is facing domestic fuel shortages, but has not publicly attributed the Ukrainian strikes as the cause. In June, Ukraine smuggled over 100 drones into Russia and launched Operation Spider Web, a drone attack that resulted in the loss of a third of Moscow’s fleet of strategic bomber aircraft.

And, Ukraine has already successfully employed advanced western supplied missiles like the US-made Army Tactical Missile System (ATACMS) and the European-made Storm Shadow. The ATACM has a range of around 300 KM, while the Storm Shadow has a range of 250KM. Kyiv is also producing and testing its own long-range missile, the FP-5 Flamingo that has a stated range of 3000KM. Recent media reports indicate that Kyiv may have started using the Flamingo in an operational capacity, but details on the operations remain scarce.

^{An infographic titled "Range of ATACMS missiles" created in Ankara, Turkiye on November 19, 2024. (Photo by Murat Usubali/Anadolu via Getty Images)}

The Tomahawk would be a significant improvement in long-range strike capability for Ukraine’s military. The missiles, capable of being launched from ships, submarines and ground launchers, have a range of 1,500-2,000KM, and are capable of hitting targets accurately even in heavily defended airspace. The Tomahawk would give Ukraine the ability to hit most of European Russia, west of the Ural Mountains. That puts key political and military hubs like Moscow and St. Petersburg in range, as well as significant military assets and energy infrastructure.

_{A Tomahawk cruise missile flies toward Iraq after being launched from the AEGIS guided missile cruiser USS San Jacinto March 25, 2003 in the Red Sea. (Photo by Mark Wilson/Getty Images)}

THE CONTEXT

• President Trump says he “sort” of has made a decision on supplying Ukraine with Tomahawks
  
• Foreign Minister of Estonia told Trump that Tomahawks could help Ukraine “push Russia back”
  
• The Tomahawk missile is made by Raytheon and has a range of 1,500-2,000kms (around 930-1,550 miles)
  
• It is approximately 750 Kilometers from Kyiv to Moscow

• Tomahawks are primarily launched from maritime platforms and are currently deployed on all U.S. ships and submarines equipped with vertical launch systems (VLSs).

• Ground-launched Tomahawks are launched from the Typhon, a new vertical launch system developed by Lockheed Martin to enable the U.S. military to launch Tomahawks from the ground. This system would likely be required by Ukraine.

• Since the 1990s, the U.S. Navy has purchased about 9,000 Tomahawk units at an average price of $1.3 million each. It is unclear where the U.S. stockpile stands currently. U.S. allies armed with Tomahawks include the Netherlands, Australia, the UK, and Japan.

• The Trump administration in late August approved the sale of 3,350 Extended Range Attack Munition (ERAM) missiles to Ukraine. They have a range of 250 miles. The purchase is being funded by Denmark, the Netherlands, Norway and U.S. Foreign Military Financing.
  
  Experts and analysts are watching closely for developments coming out of Washington this week. Some notable questions remain regarding the potential use of Tomahawks by Ukraine such as:
  • If approved, will they represent a significant increase in capability for Ukraine?
  • What quantities and how quickly would Tomahawks be supplied to Ukraine?
  • How is Russian President Vladimir Putin likely to respond?
    

The Cipher Brief: Is sending Tomahawk missiles going to enable Ukraine to do a lot more than it's already capable of doing now? Would it make a difference?

Rear Admiral (Ret) Montgomery: I'm going to caveat this. I'm not opposed to Tomahawks. But I think it's “Tomahawks and.” And then how many Tomahawks? Ten Tomahawks won't make a difference. 100 Tomahawks won't make a difference. But 400 or 500 would. Is the U.S. willing to part with 400 or 500? Can Europe take a deep breath and pay for 400 or 500? And what are the Tomahawks going to look like? Are we going to strip them of certain capabilities and capacity? Then it becomes a slow land attack cruise missile. So I'm not sure.

Tomahawks would be helpful. What I'm sure would be much more, I think, operationally game-changing is the provision of the ERAM (Extended Range Attack Munition). And I'm thrilled with what the U.S. Air Force and the U.S. Department of Defense writ large have done with the ERAM, which is effectively a small cruise missile with extended ranges well beyond ATACMS, but less than the Tomahawk. There's multiple variants of it. And when it begins to deliver, it'll be 10 here, 20 there, but eventually it should get up to about 100 a month for 20 months. And you can fire it from MiG-29s or Sukaloys or F-16s. This weapon is going to stretch the battlefield for the Russians and will force logistics and command and control and troop aggregation sites farther and farther from the front line.

And I don't think the Russians have demonstrated the ability to properly control and support forces at long range and distances. So, if the Russians are stretched out like that, combined with the operational and strategic pressure from the long range unmanned Ukrainian UASs strikes, and maybe the addition of Tomahawks, particularly to target the refineries, I think all of this can really cause Putin to readjust his thinking.

So from my perspective, things could get better. It's not “Tomahawks alone” or “Tomahawks or.” It's “Tomahawks and”, and the “and” is the big thing. And that “and” to me is the ERAM.

Corn: I think that what Ukrainians are doing is great. The Tomahawks would just increase their ability and increase, I'd say, the volume of the attacks and deep strikes that they could conduct inside of Russia.

And of course there's a symbolic and kind of political message here too. If the United States agrees to provide these weapons systems, it just shows that we're not backing down and we're not going to be intimidated by Moscow, which I'm sure the Ukrainians want to see because that's a sign of political support. That's important for them.

The Cipher Brief: Moscow is obviously rattling the sabers over the potential US Tomahawk decision. How do you assess Russia's escalation threats to the U.S.?

Corn: I find it ironic when the Russians say they're going to retaliate. They're already launching attacks. They're already targeting Ukraine and now also NATO countries, and I would say even U.S. interests. They've been doing it for years. So my own belief is it's a lot of saber rattling. It's a full court press right now in Moscow to try and deter Washington and Brussels from taking certain steps that will be extremely painful and costly for Moscow.

I'm sure that [talk of Tomahawks] increases Moscow’s level of concern. They definitely do not want the Ukrainians to have these weapon systems, and they're making all kinds of threats. They're looking for potential sore points with the U.S., for example, suggesting they will deploy new weapons systems to Nicaragua or Cuba. They're going back to the Cold War playbook that led to the Cuba missile crisis.

So I’m not surprised. Experience has shown that the Russians make a lot of threats, but those threats tend to be empty. Let's go back to all the threats they made over the F-16s, over the ATACMS, over Finland and Sweden joining NATO. I don't think that they followed through on a lot of those threats, not in the near term, not on an immediate basis or not in an obvious way. They may, of course, respond in the future, but so far they have not followed through on threats to use nuclear weapons, which they’ve previously implied as a potential scenario. So, they haven't followed through on previous threats. It doesn't mean they won’t do it in the future, but my assessment is they will not. .

Rear Admiral (Ret) Montgomery: Russia and China practice a similar provocation principle. We democracies bend and capitulate to the fear that an authoritarian regime might do something because they announce that they've got a red line or they've got an issue. And they provoke us. They tell us that the provocation will cause them to overreact and therefore we should stand down. At no point ever do they have the same sense of decorum or restraint, right? But apparently we're supposed to practice that restraint. Enough of that. We need to do what we think is right. If it's Tomahawks, fine. If it's Tomahawks and ERAM, which is what I think it is, great. If it was E-RAM alone, I think it’d be great.

What I say is, I would not back off. One reason I support sending Tomahawks now is because the Russians oppose them so much and I feel compelled to support the decision, if it's made, to send them. But the Russians are going to learn that they were complaining about the wrong thing. And by the time they learn that lesson, I think they're going to be in a lot of pain.

In Summary:

The coming decision on Tomahawk cruise missiles is a true inflection point for both Ukraine and the U.S.: it could materially expand Kyiv’s ability to conduct deep-strike operations, but only if supplied in sufficient quantities and paired with the right launch and logistical support. US and Western leaders must weigh that operational upside against difficult questions - platform and delivery constraints, the need for complementary systems like ERAM, funding and NATO cooperation, and the very real risk of Moscow escalating its response. Whatever Washington decides will test U.S. resolve, reshape NATO burden-sharing conversations, and have consequences that reverberate across the battlefield in Ukraine and Russia.

Follow The Cipher Brief for more timely analysis and updates as this critical story develops.

Ethan Masucol, Ian Coleman and Connor Cowman contributed research for this report

DEEP DIVE – A senior Ukrainian delegation will travel to Washington D.C. this week for talks that are expected to include the use of frozen Russian assets to aid Ukraine, air defense challenges and increased sanctions on Moscow. The decision on whether or not the U.S. will provide Ukraine with Tomahawk missiles is also expected to be front and center.

Ukrainian President Volodymyr Zelensky says he believes that the Israeli-Gaza ceasefire announced late last week, is proof that a resolution to his country’s fight against Russia is also possible.

In a congratulatory phone call from Zelensky to Trump on Saturday, Ukrainian officials said the two leaders talked about Russia’s latest strikes targeting Ukraine’s energy infrastructure, as well as the possibility of Kyiv obtaining U.S. made Tomahawk missiles. In a post on X, Zelensky said “If a war can be stopped in one region, then surely other wars can be stopped as well - including the Russian war”.

The missile request is the latest in a long-running series of high-profile requests by Ukrainian officials for more powerful and sophisticated western support.

President Trump says he has “sort of made a decision” about giving Tomahawks to NATO for supply to Ukraine, but says he wants to know Ukrainian plans for them before sending them.

Moscow is pushing back against the possibility of providing U.S. Tomahawks to Ukraine, which could provide the capability for even deeper strikes inside Russia, something that wouldn’t play well for the Russian President at home.

President Vladimir Putin said recently that sending Tomahawks to Ukraine would significantly damage U.S.-Russia relations, and that the weapons would "mean a completely new, qualitatively new stage of escalation, including in relations between Russia and the United States".

Ukraine has already shown impressive tenacity in striking targets on Russian soil. Kyiv’s domestic drone campaign against Russian oil and gas facilities, aimed at cutting Russia’s energy export revenues that fund its war machine, has been remarkably successful. Moscow has publicly acknowledged that it is facing domestic fuel shortages, but has not publicly attributed the Ukrainian strikes as the cause. In June, Ukraine smuggled over 100 drones into Russia and launched Operation Spider Web, a drone attack that resulted in the loss of a third of Moscow’s fleet of strategic bomber aircraft.

And, Ukraine has already successfully employed advanced western supplied missiles like the US-made Army Tactical Missile System (ATACMS) and the European-made Storm Shadow. The ATACM has a range of around 300 KM, while the Storm Shadow has a range of 250KM. Kyiv is also producing and testing its own long-range missile, the FP-5 Flamingo that has a stated range of 3000KM. Recent media reports indicate that Kyiv may have started using the Flamingo in an operational capacity, but details on the operations remain scarce.

^{An infographic titled "Range of ATACMS missiles" created in Ankara, Turkiye on November 19, 2024. (Photo by Murat Usubali/Anadolu via Getty Images)}

The Tomahawk would be a significant improvement in long-range strike capability for Ukraine’s military. The missiles, capable of being launched from ships, submarines and ground launchers, have a range of 1,500-2,000KM, and are capable of hitting targets accurately even in heavily defended airspace. The Tomahawk would give Ukraine the ability to hit most of European Russia, west of the Ural Mountains. That puts key political and military hubs like Moscow and St. Petersburg in range, as well as significant military assets and energy infrastructure.

_{A Tomahawk cruise missile flies toward Iraq after being launched from the AEGIS guided missile cruiser USS San Jacinto March 25, 2003 in the Red Sea. (Photo by Mark Wilson/Getty Images)}

THE CONTEXT

• President Trump says he “sort” of has made a decision on supplying Ukraine with Tomahawks
  
• Foreign Minister of Estonia told Trump that Tomahawks could help Ukraine “push Russia back”
  
• The Tomahawk missile is made by Raytheon and has a range of 1,500-2,000kms (around 930-1,550 miles)
  
• It is approximately 750 Kilometers from Kyiv to Moscow

• Tomahawks are primarily launched from maritime platforms and are currently deployed on all U.S. ships and submarines equipped with vertical launch systems (VLSs).

• Ground-launched Tomahawks are launched from the Typhon, a new vertical launch system developed by Lockheed Martin to enable the U.S. military to launch Tomahawks from the ground. This system would likely be required by Ukraine.

• Since the 1990s, the U.S. Navy has purchased about 9,000 Tomahawk units at an average price of $1.3 million each. It is unclear where the U.S. stockpile stands currently. U.S. allies armed with Tomahawks include the Netherlands, Australia, the UK, and Japan.

• The Trump administration in late August approved the sale of 3,350 Extended Range Attack Munition (ERAM) missiles to Ukraine. They have a range of 250 miles. The purchase is being funded by Denmark, the Netherlands, Norway and U.S. Foreign Military Financing.
  
  Experts and analysts are watching closely for developments coming out of Washington this week. Some notable questions remain regarding the potential use of Tomahawks by Ukraine such as:
  • If approved, will they represent a significant increase in capability for Ukraine?
  • What quantities and how quickly would Tomahawks be supplied to Ukraine?
  • How is Russian President Vladimir Putin likely to respond?
    

The Cipher Brief: Is sending Tomahawk missiles going to enable Ukraine to do a lot more than it's already capable of doing now? Would it make a difference?

Rear Admiral (Ret) Montgomery: I'm going to caveat this. I'm not opposed to Tomahawks. But I think it's “Tomahawks and.” And then how many Tomahawks? Ten Tomahawks won't make a difference. 100 Tomahawks won't make a difference. But 400 or 500 would. Is the U.S. willing to part with 400 or 500? Can Europe take a deep breath and pay for 400 or 500? And what are the Tomahawks going to look like? Are we going to strip them of certain capabilities and capacity? Then it becomes a slow land attack cruise missile. So I'm not sure.

Tomahawks would be helpful. What I'm sure would be much more, I think, operationally game-changing is the provision of the ERAM (Extended Range Attack Munition). And I'm thrilled with what the U.S. Air Force and the U.S. Department of Defense writ large have done with the ERAM, which is effectively a small cruise missile with extended ranges well beyond ATACMS, but less than the Tomahawk. There's multiple variants of it. And when it begins to deliver, it'll be 10 here, 20 there, but eventually it should get up to about 100 a month for 20 months. And you can fire it from MiG-29s or Sukaloys or F-16s. This weapon is going to stretch the battlefield for the Russians and will force logistics and command and control and troop aggregation sites farther and farther from the front line.

And I don't think the Russians have demonstrated the ability to properly control and support forces at long range and distances. So, if the Russians are stretched out like that, combined with the operational and strategic pressure from the long range unmanned Ukrainian UASs strikes, and maybe the addition of Tomahawks, particularly to target the refineries, I think all of this can really cause Putin to readjust his thinking.

So from my perspective, things could get better. It's not “Tomahawks alone” or “Tomahawks or.” It's “Tomahawks and”, and the “and” is the big thing. And that “and” to me is the ERAM.

Corn: I think that what Ukrainians are doing is great. The Tomahawks would just increase their ability and increase, I'd say, the volume of the attacks and deep strikes that they could conduct inside of Russia.

And of course there's a symbolic and kind of political message here too. If the United States agrees to provide these weapons systems, it just shows that we're not backing down and we're not going to be intimidated by Moscow, which I'm sure the Ukrainians want to see because that's a sign of political support. That's important for them.

The Cipher Brief: Moscow is obviously rattling the sabers over the potential US Tomahawk decision. How do you assess Russia's escalation threats to the U.S.?

Corn: I find it ironic when the Russians say they're going to retaliate. They're already launching attacks. They're already targeting Ukraine and now also NATO countries, and I would say even U.S. interests. They've been doing it for years. So my own belief is it's a lot of saber rattling. It's a full court press right now in Moscow to try and deter Washington and Brussels from taking certain steps that will be extremely painful and costly for Moscow.

I'm sure that [talk of Tomahawks] increases Moscow’s level of concern. They definitely do not want the Ukrainians to have these weapon systems, and they're making all kinds of threats. They're looking for potential sore points with the U.S., for example, suggesting they will deploy new weapons systems to Nicaragua or Cuba. They're going back to the Cold War playbook that led to the Cuba missile crisis.

So I’m not surprised. Experience has shown that the Russians make a lot of threats, but those threats tend to be empty. Let's go back to all the threats they made over the F-16s, over the ATACMS, over Finland and Sweden joining NATO. I don't think that they followed through on a lot of those threats, not in the near term, not on an immediate basis or not in an obvious way. They may, of course, respond in the future, but so far they have not followed through on threats to use nuclear weapons, which they’ve previously implied as a potential scenario. So, they haven't followed through on previous threats. It doesn't mean they won’t do it in the future, but my assessment is they will not. .

Rear Admiral (Ret) Montgomery: Russia and China practice a similar provocation principle. We democracies bend and capitulate to the fear that an authoritarian regime might do something because they announce that they've got a red line or they've got an issue. And they provoke us. They tell us that the provocation will cause them to overreact and therefore we should stand down. At no point ever do they have the same sense of decorum or restraint, right? But apparently we're supposed to practice that restraint. Enough of that. We need to do what we think is right. If it's Tomahawks, fine. If it's Tomahawks and ERAM, which is what I think it is, great. If it was E-RAM alone, I think it’d be great.

What I say is, I would not back off. One reason I support sending Tomahawks now is because the Russians oppose them so much and I feel compelled to support the decision, if it's made, to send them. But the Russians are going to learn that they were complaining about the wrong thing. And by the time they learn that lesson, I think they're going to be in a lot of pain.

In Summary:

The coming decision on Tomahawk cruise missiles is a true inflection point for both Ukraine and the U.S.: it could materially expand Kyiv’s ability to conduct deep-strike operations, but only if supplied in sufficient quantities and paired with the right launch and logistical support. US and Western leaders must weigh that operational upside against difficult questions - platform and delivery constraints, the need for complementary systems like ERAM, funding and NATO cooperation, and the very real risk of Moscow escalating its response. Whatever Washington decides will test U.S. resolve, reshape NATO burden-sharing conversations, and have consequences that reverberate across the battlefield in Ukraine and Russia.

Follow The Cipher Brief for more timely analysis and updates as this critical story develops.

Ethan Masucol, Ian Coleman and Connor Cowman contributed research for this report