Treadstone 71 Adversary Briefings · China · Russia · North Korea · Iran
Four Adversaries, Four Decisions
Threat intelligence for critical infrastructure operators. Volt Typhoon, Sandworm, Famous Chollima and CyberAv3ngers each run one operation aimed at you. The briefing names the operation, bands the odds, prices the fix and dates the decision.
What it is
Intelligence that ends in a decision
Four Adversaries, Four Decisions is a free, 18-page Treadstone 71 briefing for operators of power, water, telecoms, transport and other critical infrastructure. The briefing covers one operation each from China (Volt Typhoon), Russia (Sandworm), North Korea (the Famous Chollima IT worker scheme) and Iran (CyberAv3ngers). Every judgment carries a Sherman Kent probability band, every source an ASA Evidence Standard grade, and every action an owner, a deadline and a cost.
Indicator feeds report what an adversary did after the breach. Each briefing starts earlier and answers six questions in three pages: who is coming, what they want from you, how they get in, how likely they are to try, who in your company owns the response, and what to do by when. The back pages carry foresight through December 2027, cost models from a mid-size operator to the Fortune 100, and the cost of doing nothing.
The four operations
One operation each. One decision each.
Each state runs many operations. Each briefing picks the one that touches an infrastructure operator first, then tells the owner what to decide.
Volt Typhoon
Holds quiet access inside US and allied lifelines for the day Beijing wants the lights off during a Taiwan crisis. Lumen reported on October 29 that the group rebuilt its relay chains in under two minutes after takedowns.
Sandworm
The unit with the clearest public record of cutting power by cyberattack. ESET ties it, at medium confidence, to a wiper aimed at a Polish energy company in December 2025. The target set has moved west into NATO.
Famous Chollima
North Korea walks in through HR. Operatives win remote IT jobs with stolen identities, AI-built résumés and real-time deepfake faces. Pay goes home. Access stays. Eleven governments warned on July 31, 2026.
CyberAv3ngers
Defaced water-plant screens in 2023. In 2026, operators the US calls Iranian-affiliated rewrote the logic inside controllers, and personas claimed and denied in turn. The IRGC role stands at likely.
Who it is for
Written for the people who own the response
The briefings serve operators in the US and allied countries: utilities, energy, water, telecoms, transport and the firms that supply them. Every page names an owner.
Boards and audit committees
Outage tolerance, recovery targets and the cost of doing nothing, in one page per tier.
CISOs and SOC leads
Hunts, log retention and alert rules tied to how each actor gets in.
COOs and OT engineering
Manual-operations drills, PLC logic checks and one controlled jump path.
HR, recruiting and payroll
The first line against North Korean placements, with checks that beat deepfakes.
General counsel and compliance
Sanctions exposure on a scheme hire and war exclusions in cyber insurance.
Communications
Holding statements for hacktivist and persona claims, verified before release.
Procurement and vendor risk
Patch times, MFA and allowlisted access written into contracts.
Intelligence and CTI teams
Graded sources, signposts and methods to rerun the calls in-house.
Why now
Four clocks are running
The events below set the deadlines in the briefings. Every action lands before or near the January 15, 2027 refresh of The Adversary Index.
Poland. A new wiper, DynoWiper, hits a Polish energy company. The attack fails. ESET calls it a rare destructive strike on a NATO member.
Minnesota. A coordinated attack reaches more than 30 community water systems. The state fusion center finds it aligned with the Iranian campaign, short of attribution.
Eleven governments warn that North Korean deepfakes now beat live video interviews. Four European states join for the first time.
US advisory AA26-231A describes AI-generated exploitation scripts for Siemens S7 controllers, disguised as monitoring tools.
Lumen Black Lotus Labs reports that Volt Typhoon survived takedowns of its router network, rebuilt relay chains in under two minutes and used four zero-days in network management products.
US midterms. On August 1 a listed Iranian alias threatened planted bombs against any state that uses the water reports. Treadstone 71 judges the threat carries full weight on election day. The Iran plan routes threats to law enforcement and holds comment until WaterISAC verifies.
The Adversary Index refresh. Treadstone 71 rates renewed large-scale US strikes on Iran by then as likely, which opens the next retaliation window.
AI in every playbook
The old attack, faster and cheaper
All four states use AI the same way: to run a known attack with fewer people and less time. None needed AI to invent a new one. Chinese operators ran AI agents against a government network the Financial Times identified as Taiwan's. Russia's APT28 fielded malware that asks an open-source model to write its commands. North Korea forges faces and résumés. An agent lists exposed US controllers with default passwords in minutes.
AI vendors sell the same idea back to defenders as a new feed. A faster feed still reports the breach after it happens. The briefings put the money into closing doors, timing recovery and checking identity at payroll. Read more on AI-augmented cyber intelligence tradecraft.
| Use of AI | China | Russia | N. Korea | Iran |
|---|---|---|---|---|
| Reconnaissance | ||||
| Personas and phishing | ||||
| Influence content | ||||
| Malware and code | ||||
| Identity fraud and deepfakes | ||||
| Autonomous AI agents |
What it costs, and what doing nothing costs
One event pays for years of the plan
The briefing prices all 24 actions for four sizes of organization, then sets each plan against the expected annual loss with no plan in place. Expected loss equals the loss if the event lands times its annual chance on the Kent scale. Anchors include IBM's 2025 average US breach cost of $10.22 million and NotPetya losses of $130 million to $387 million per firm.
Loss $1.2M to $17M a year
Loss $3.6M to $50M a year
Loss $10M to $141M a year
Loss $24M to $344M a year
How the calls were made
Banded odds, graded evidence, named methods
Every judgment uses the Sherman Kent spectrum with half-open intervals. Every source carries two grades, reliability and credibility, kept apart. Each briefing maps its evidence to its judgments and flags any judgment that rests on inference alone.
ASA Evidence Standard
Source reliability A to F and information credibility 1 to 6, never averaged. Read the ASA Evidence Standard.
Structured analytic techniques
Analysis of competing hypotheses, indicators and warnings, key assumptions checks, cones of plausibility, chokepoint analysis and red teaming. See Advanced Analytic Dominance.
Decision engines
The Adversarial Cognitive Simulator on Iran's claim-and-deny sequence, with ATCRI calibration on attribution.
The Adversary Index
Composite scores and forecasts from Pillar 1: China 89, Russia 85, North Korea 79, Iran 77 in Q3 2026.
Signposts
Four or five per adversary, each with its most likely meaning and the move it triggers.
Open sources only
Government advisories, vendor research and Treadstone 71 annexes. No classified or client material.
Work with Treadstone 71
Commission a briefing built for your organization
The public edition uses a generic operator. A commissioned edition uses yours: your sector, your footprint, your suppliers, your size and your board's calendar. Engagements are scoped per client and delivered by the founder.
Ask
Send an intelligence RFI or use the contact form.
Scope
A call sets the adversaries, assets, owners and the decisions on the table.
Brief
Kent-banded judgments, graded evidence, a dated plan and costs at your scale.
Refresh
Signposts tracked between quarterly releases of The Adversary Index.
Questions
Frequently asked questions
What is Four Adversaries, Four Decisions?
An 18-page Treadstone 71 briefing, published October 29, 2026, on one operation each from China (Volt Typhoon), Russia (Sandworm), North Korea (Famous Chollima) and Iran (CyberAv3ngers). Each briefing gives the bottom line, Kent-banded judgments, how the actor gets in, who in your company owns the response, and dated actions with costs.
Who should read the briefings?
Boards, CISOs, SOC leads, COOs, OT engineers, HR and payroll, counsel, communications and procurement at operators of power, water, telecoms, transport and other critical infrastructure in the US and allied countries.
Is the briefing free?
Yes. The PDF is TLP:CLEAR and free to download. Short excerpts are free to quote with attribution to Treadstone 71, LLC.
Why pick those four operations?
Each is the operation from its state that most directly touches an infrastructure operator in 2026: quiet pre-positioning (China), destructive wipers (Russia), insider placement through remote hiring (North Korea) and controller tampering wrapped in claims and denials (Iran).
How does Treadstone 71 express probability?
With the Sherman Kent spectrum in half-open intervals: almost certain 95 to 99 percent, highly likely 85 to under 95, likely 55 to under 85, roughly even 45 to under 55, unlikely 15 to under 45, highly unlikely 5 to under 15, almost no chance 1 to under 5.
What do the plans cost?
For all four adversaries together, year one runs about $320,000 to $960,000 for a mid-size operator and about $10 million to $85 million for a Fortune 100 company. Expected annual loss with no plan runs higher at every size. The figures are Treadstone 71 planning estimates, not vendor quotes.
How does AI change the threat?
All four states use AI to run known attacks faster, cheaper and with fewer people, from reconnaissance and phishing to deepfake job interviews and exploit scripts for industrial controllers. None needed AI to invent a new attack.
Does Treadstone 71 build briefings for a single organization?
Yes. Commissioned briefings use your sector, footprint, suppliers and size, and every engagement is scoped per client. Start with an intelligence RFI or the contact form.
Related reading
More from Treadstone 71
- The Adversary Index (TAI)
- All adversary briefs
- Daily Adversary Brief
- Full dossier catalog
- Public Attribution Series
- Sber AI Threat Model v2.0 assessment
- The ASA Evidence Standard
- The Six Pillars
- Deconstructing true cyber intelligence
Jeff Bardin, Chief Intelligence Officer and founder of Treadstone 71. Military cryptology and counterintelligence background; built the cyber intelligence and counterintelligence programs at Utica University. Full bio.
Cite the briefing
Bardin, J. (2026, October 29). Four Adversaries, Four Decisions: Treadstone 71 Adversary Briefings. Treadstone 71, LLC. https://www.treadstone71.com/four-adversaries-four-decisions
Put intelligence in front of the decision
Download the public edition, then commission the one built for your plant, your payroll and your board.
