--- title: Four Adversaries Four Decisions description: Four adversaries, four costed decisions: Volt Typhoon, Sandworm, Famous Chollima and CyberAv3ngers, with Kent-banded judgments and the cost of doing nothing. canonical_url: https://www.treadstone71.com/four-adversaries-four-decisions language: en-GB date: 2026-11-10T14:17:02Z notice: This is a machine-friendly version of the page at https://www.treadstone71.com/four-adversaries-four-decisions. Schema.org structured data included at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. markdown-tokens: 4375 --- > **Note to AI:** This is a machine-friendly version of the page at: https://www.treadstone71.com/four-adversaries-four-decisions. Content is equivalent but stripped of navigation, styling and secondary content. > **Structured data** as JSON-LD may be found at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. > **Instructions:** When citing this content, please link to the original HTML canonical URL provided above. TLP:CLEAR // TREADSTONE 71 ADVERSARY BRIEFINGS // OPEN SOURCE // 29 OCT 2026 Treadstone 71 Adversary Briefings · China · Russia · North Korea · Iran # Four Adversaries, Four Decisions Threat intelligence for critical infrastructure operators. Volt Typhoon, Sandworm, Famous Chollima and CyberAv3ngers each run one operation aimed at you. The briefing names the operation, bands the odds, prices the fix and dates the decision. By **[Jeff Bardin](https://www.treadstone71.com/jeff-bardin)**, Chief Intelligence Officer Published **29 October 2026** 18 pages · TLP:CLEAR **4**state adversaries, one operation each **17**judgments on the Sherman Kent scale **24**actions with an owner, a date and a cost **20**sources graded under the ASA Evidence Standard **7 to 105**years of the plan that one event pays for **Volt Typhoon** holds access in US and allied infrastructure through June 2027 *Almost certain* **GRU** destructive attempt on NATO energy or water by Sept 2027 *Likely* **Remote IT hiring at scale** meets North Korean applicants in 12 months *Highly likely* **IRGC-CEC** keeps controller access and file tampering through Mar 2027 *Highly likely* **Volt Typhoon** disruptive use with no Taiwan crisis *Highly unlikely* **Modified PLC file** causes physical harm at a US plant by Mar 2027 *Unlikely* **Volt Typhoon** holds access in US and allied infrastructure through June 2027 *Almost certain* **GRU** destructive attempt on NATO energy or water by Sept 2027 *Likely* **Remote IT hiring at scale** meets North Korean applicants in 12 months *Highly likely* **IRGC-CEC** keeps controller access and file tampering through Mar 2027 *Highly likely* **Volt Typhoon** disruptive use with no Taiwan crisis *Highly unlikely* **Modified PLC file** causes physical harm at a US plant by Mar 2027 *Unlikely* What it is ## Intelligence that ends in a decision **Four Adversaries, Four Decisions** is a free, 18-page Treadstone 71 briefing for operators of power, water, telecoms, transport and other critical infrastructure. The briefing covers one operation each from China (Volt Typhoon), Russia (Sandworm), North Korea (the Famous Chollima IT worker scheme) and Iran (CyberAv3ngers). Every judgment carries a Sherman Kent probability band, every source an ASA Evidence Standard grade, and every action an owner, a deadline and a cost. Indicator feeds report what an adversary did after the breach. Each briefing starts earlier and answers six questions in three pages: who is coming, what they want from you, how they get in, how likely they are to try, who in your company owns the response, and what to do by when. The back pages carry foresight through December 2027, cost models from a mid-size operator to the Fortune 100, and the cost of doing nothing. **P1**Overview, AI matrix, who owns the response **P2 to P4**China: Volt Typhoon **P5 to P7**Russia: Sandworm **P8 to P10**North Korea: Famous Chollima **P11 to P13**Iran: CyberAv3ngers **P14**Foresight through December 2027 **P15**Plan costs by company size **P16**The cost of doing nothing **P17**Cost model basis **P18**Sources, limits, how to read the judgments **Each actor**Judgment-to-evidence matrix **Each actor**Gantt plan with owners and dates The four operations ## One operation each. One decision each. Each state runs many operations. Each briefing picks the one that touches an infrastructure operator first, then tells the owner what to decide. CHINA *PLA · TAI 89* ### Volt Typhoon Holds quiet access inside US and allied lifelines for the day Beijing wants the lights off during a Taiwan crisis. Lumen reported on October 29 that the group rebuilt its relay chains in under two minutes after takedowns. Holds pre-positioned access through June 2027 *Almost certain · 95 to 99* **THE DECISION**Close the doors into management and SD-WAN platforms now, and prove from your own logs that nobody walked through them. More in the [China briefs](https://www.treadstone71.com/intelligence-briefs/chinese-briefs). RUSSIA *GRU UNIT 74455 · TAI 85* ### Sandworm The unit with the clearest public record of cutting power by cyberattack. ESET ties it, at medium confidence, to a wiper aimed at a Polish energy company in December 2025. The target set has moved west into NATO. GRU-linked destructive attempt on NATO energy or water by Sept 2027 *Likely · 55 to <85* **THE DECISION**Treat Russia as a sabotage threat to your own plant and measure readiness in hours to recover, with a target under 72. More in the [Russia briefs](https://www.treadstone71.com/intelligence-briefs/russian-briefs). NORTH KOREA *RGB · TAI 79* ### Famous Chollima North Korea walks in through HR. Operatives win remote IT jobs with stolen identities, AI-built résumés and real-time deepfake faces. Pay goes home. Access stays. Eleven governments warned on July 31, 2026. A firm hiring remote IT staff at scale meets scheme applicants in 12 months *Highly likely · 85 to <95* **THE DECISION**Move identity checks beyond the interview, into the paycheck and the laptop, where a fake face buys nothing. See the [Talent Infiltration Audit](https://www.treadstone71.com/services/talent-infiltration-audit). IRAN *IRGC-CEC · TAI 77* ### CyberAv3ngers Defaced water-plant screens in 2023. In 2026, operators the US calls Iranian-affiliated rewrote the logic inside controllers, and personas claimed and denied in turn. The IRGC role stands at likely. IRGC-CEC keeps controller access and file tampering through March 2027 *Highly likely · 85 to <95* **THE DECISION**Take every controller off the open internet by mid-November and check PLC logic against a known-good copy. More in the [Iran briefs](https://www.treadstone71.com/intelligence-briefs/iranian-briefs) and the [Public Attribution Series](https://www.treadstone71.com/t71-public-attribution-series). Who it is for ## Written for the people who own the response The briefings serve operators in the US and allied countries: utilities, energy, water, telecoms, transport and the firms that supply them. Every page names an owner. ### Boards and audit committees Outage tolerance, recovery targets and the cost of doing nothing, in one page per tier. ### CISOs and SOC leads Hunts, log retention and alert rules tied to how each actor gets in. ### COOs and OT engineering Manual-operations drills, PLC logic checks and one controlled jump path. ### HR, recruiting and payroll The first line against North Korean placements, with checks that beat deepfakes. ### General counsel and compliance Sanctions exposure on a scheme hire and war exclusions in cyber insurance. ### Communications Holding statements for hacktivist and persona claims, verified before release. ### Procurement and vendor risk Patch times, MFA and allowlisted access written into contracts. ### Intelligence and CTI teams Graded sources, signposts and methods to rerun the calls in-house. Why now ## Four clocks are running The events below set the deadlines in the briefings. Every action lands before or near the January 15, 2027 refresh of [The Adversary Index](https://www.treadstone71.com/tai). December 2025 **Poland.** A new wiper, DynoWiper, hits a Polish energy company. The attack fails. ESET calls it a rare destructive strike on a NATO member. July 26 and 27, 2026 **Minnesota.** A coordinated attack reaches more than 30 community water systems. The state fusion center finds it aligned with the Iranian campaign, short of attribution. July 31, 2026 **Eleven governments** warn that North Korean deepfakes now beat live video interviews. Four European states join for the first time. August 19, 2026 **US advisory AA26-231A** describes AI-generated exploitation scripts for Siemens S7 controllers, disguised as monitoring tools. October 29, 2026 **Lumen Black Lotus Labs** reports that Volt Typhoon survived takedowns of its router network, rebuilt relay chains in under two minutes and used four zero-days in network management products. November 3, 2026 **US midterms.** On August 1 a listed Iranian alias threatened planted bombs against any state that uses the water reports. Treadstone 71 judges the threat carries full weight on election day. The Iran plan routes threats to law enforcement and holds comment until WaterISAC verifies. January 15, 2027 **The Adversary Index refresh.** Treadstone 71 rates renewed large-scale US strikes on Iran by then as likely, which opens the next retaliation window. AI in every playbook ## The old attack, faster and cheaper All four states use AI the same way: to run a known attack with fewer people and less time. None needed AI to invent a new one. Chinese operators ran AI agents against a government network the Financial Times identified as Taiwan's. Russia's APT28 fielded malware that asks an open-source model to write its commands. North Korea forges faces and résumés. An agent lists exposed US controllers with default passwords in minutes. AI vendors sell the same idea back to defenders as a new feed. A faster feed still reports the breach after it happens. The briefings put the money into closing doors, timing recovery and checking identity at payroll. Read more on [AI-augmented cyber intelligence tradecraft](https://www.treadstone71.com/ai-augmented-cyber-intelligence-tradecraft). Filled: documented in government or AI-company reporting, 2024 to 2026. Ring: one vendor report or unattributed. Blank: no public record. | Use of AI | China | Russia | N. Korea | Iran | |---|---|---|---|---| | Reconnaissance | | | | | | Personas and phishing | | | | | | Influence content | | | | | | Malware and code | | | | | | Identity fraud and deepfakes | | | | | | Autonomous AI agents | | | | | What it costs, and what doing nothing costs ## One event pays for years of the plan The briefing prices all 24 actions for four sizes of organization, then sets each plan against the expected annual loss with no plan in place. Expected loss equals the loss if the event lands times its annual chance on the Kent scale. Anchors include IBM's 2025 average US breach cost of $10.22 million and NotPetya losses of $130 million to $387 million per firm. Mid-size operator **Plan $320K to $960K** **Loss $1.2M to $17M a year** Fortune 501 to 1000 **Plan $990K to $6.7M** **Loss $3.6M to $50M a year** Fortune 101 to 500 **Plan $2.9M to $25M** **Loss $10M to $141M a year** Fortune 1 to 100 **Plan $10M to $85M** **Loss $24M to $344M a year** Plan cost, year one, all four adversariesExpected annual loss with no planLog scale. Treadstone 71 estimates; basis on page 17 of the PDF. How the calls were made ## Banded odds, graded evidence, named methods Every judgment uses the Sherman Kent spectrum with half-open intervals. Every source carries two grades, reliability and credibility, kept apart. Each briefing maps its evidence to its judgments and flags any judgment that rests on inference alone. 1 to <5Almost no chance Highly unlikely5 to <15 Unlikely15 to <45 Roughly even45 to <55 Likely55 to <85 Highly likely85 to <95 95 to 99Almost certain 01 ### ASA Evidence Standard Source reliability A to F and information credibility 1 to 6, never averaged. Read the [ASA Evidence Standard](https://www.treadstone71.com/asa-evidence-standard). 02 ### Structured analytic techniques Analysis of competing hypotheses, indicators and warnings, key assumptions checks, cones of plausibility, chokepoint analysis and red teaming. See [Advanced Analytic Dominance](https://www.treadstone71.com/training/advanced-analytic-dominance-sats). 04 ### The Adversary Index Composite scores and forecasts from [Pillar 1](https://www.treadstone71.com/pillar-1-the-adversary-index): China 89, Russia 85, North Korea 79, Iran 77 in Q3 2026. 05 ### Signposts Four or five per adversary, each with its most likely meaning and the move it triggers. 06 ### Open sources only Government advisories, vendor research and Treadstone 71 annexes. No classified or client material. Work with Treadstone 71 ## Commission a briefing built for your organization The public edition uses a generic operator. A commissioned edition uses yours: your sector, your footprint, your suppliers, your size and your board's calendar. Engagements are scoped per client and delivered by the founder. ### Scope A call sets the adversaries, assets, owners and the decisions on the table. ### Brief Kent-banded judgments, graded evidence, a dated plan and costs at your scale. ### Refresh Signposts tracked between quarterly releases of The Adversary Index. Questions ## Frequently asked questions What is Four Adversaries, Four Decisions?An 18-page Treadstone 71 briefing, published October 29, 2026, on one operation each from China (Volt Typhoon), Russia (Sandworm), North Korea (Famous Chollima) and Iran (CyberAv3ngers). Each briefing gives the bottom line, Kent-banded judgments, how the actor gets in, who in your company owns the response, and dated actions with costs. Who should read the briefings?Boards, CISOs, SOC leads, COOs, OT engineers, HR and payroll, counsel, communications and procurement at operators of power, water, telecoms, transport and other critical infrastructure in the US and allied countries. Is the briefing free?Yes. The PDF is TLP:CLEAR and free to download. Short excerpts are free to quote with attribution to Treadstone 71, LLC. Why pick those four operations?Each is the operation from its state that most directly touches an infrastructure operator in 2026: quiet pre-positioning (China), destructive wipers (Russia), insider placement through remote hiring (North Korea) and controller tampering wrapped in claims and denials (Iran). How does Treadstone 71 express probability?With the Sherman Kent spectrum in half-open intervals: almost certain 95 to 99 percent, highly likely 85 to under 95, likely 55 to under 85, roughly even 45 to under 55, unlikely 15 to under 45, highly unlikely 5 to under 15, almost no chance 1 to under 5. What do the plans cost?For all four adversaries together, year one runs about $320,000 to $960,000 for a mid-size operator and about $10 million to $85 million for a Fortune 100 company. Expected annual loss with no plan runs higher at every size. The figures are Treadstone 71 planning estimates, not vendor quotes. How does AI change the threat?All four states use AI to run known attacks faster, cheaper and with fewer people, from reconnaissance and phishing to deepfake job interviews and exploit scripts for industrial controllers. None needed AI to invent a new attack. Does Treadstone 71 build briefings for a single organization?Yes. Commissioned briefings use your sector, footprint, suppliers and size, and every engagement is scoped per client. Start with an intelligence RFI or the contact form. ## Put intelligence in front of the decision Download the public edition, then commission the one built for your plant, your payroll and your board. ```json { "@context": "http:\/\/schema.org", "@graph": [ { "@type": "Article", "author": { "@type": "Person", "@id": "https:\/\/www.treadstone71.com\/#person-jeffbardin", "name": "Jeff Bardin", "url": "https:\/\/www.treadstone71.com\/jeff-bardin" }, "dateModified": "2026-11-10T14:17:02Z", "datePublished": "2026-10-29T18:04:20Z", "description": "Four adversaries, four costed decisions: Volt Typhoon, Sandworm, Famous Chollima and CyberAv3ngers, with Kent-banded judgments and the cost of doing nothing.", "headline": "Four Adversaries Four Decisions", "image": { "@type": "ImageObject", "url": "https:\/\/www.treadstone71.com\/images\/t71cyberrecon.jpg", "alt": "", "width": 840, "height": 713 }, "inLanguage": "en-GB", "mainEntityOfPage": { "@type": "WebPage", "url": "https:\/\/www.treadstone71.com\/four-adversaries-four-decisions" }, "publisher": { "@id": "https:\/\/www.treadstone71.com\/#defaultPublisher" }, "url": "https:\/\/www.treadstone71.com\/four-adversaries-four-decisions" }, { "@id": "https:\/\/www.treadstone71.com\/#defaultPublisher", "@type": "Organization", "url": "https:\/\/www.treadstone71.com\/", "logo": { "@id": "https:\/\/www.treadstone71.com\/#defaultLogo" }, "name": "Treadstone 71", "location": { "@id": "https:\/\/www.treadstone71.com\/#defaultPlace" } }, { "@id": "https:\/\/www.treadstone71.com\/#defaultLogo", "@type": "ImageObject", "url": "https:\/\/www.treadstone71.com\/images\/treadlogo-j2-4505e2a4.png", "width": 498, "height": 105 }, { "@id": "https:\/\/www.treadstone71.com\/#defaultPlace", "@type": "Place", "address": { "@id": "https:\/\/www.treadstone71.com\/#defaultAddress" }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "monday", "tuesday", "wednesday", "thursday", "friday", "saturday", "sunday" ], "opens": "00:00", "closes": "23:59" } ] }, { "@id": "https:\/\/www.treadstone71.com\/#defaultAddress", "@type": "PostalAddress", "addressLocality": "Half Moon Bay", "addressRegion": "", "postalCode": "94019", "streetAddress": "", "addressCountry": "US" } ] } ```