(U//FOUO) We judge that narratives driven by Chinese, Iranian, and Russian state media, and proxy websites linked to these governments, often involve fact-based articles as well as editorials; these publications may include misinformation, disinformation, or factual but misrepresented information. This monthly “Snapshot” compiles English-language narratives, which we assess are intended for US and Western audiences, and highlights both consistent trends and emergent messaging, which we assess to reveal foreign actors’ changing influence priorities. We judge that, typically, China uses state and proxy media—including US-based outlets—to try to shape diaspora conduct and US public and leadership views; Iran state media manipulates emerging stories and emphasizes Tehran’s strength while denigrating US society and policy; and Russia uses both state and proxy media to amplify narratives seeking to weaken Washington’s global position relative to Moscow’s. This snapshot identifies the most persistent or emergent narratives being spread by these actors for English-speaking—probably US—audiences, as well as narratives of interest to Homeland Security stakeholders.

(U//FOUO) Chinese state media continued July’s heavy shift to Taiwan issues—away from significant focus on Ukraine or COVID-19—while also claiming that several US domestic controversies show a failing democracy. Outlets denounced visits to Taiwan by US politicians as political grandstanding, and as attempts to undermine the One‑China policy.

(U//FOUO) Iranian state media focused on long-standing narratives. Outlets praised Tehran’s purported efforts to revitalize the Joint Comprehensive Plan of Action (JCPOA), while criticizing Washington’s negotiating stance, and pushed stories of US social discord, including inflation and the search of the former president‘s property.

(U) Russia almost certainly is subjecting Ukrainian civilians in occupied areas to so-called filtration operations. Individuals face one of three fates after undergoing filtration, which include being issued documentation and remaining in Russian-occupied Ukraine, forcefully deported to Russia, or detained in prisons in eastern Ukraine or Russia.

  • Individuals are detained and taken to filtration waypoints, or stopped at filtration checkpoints.
  • Individuals are temporarily detained and evaluated for their perceived threat.
  • Those deemed most threatening probably are detained and imprisoned in eastern Ukraine or Russia. Little is known about their fates.
  • Those deemed less threatening but still hostile probably are forcibly deported to Russia.
  • Those deemed non-threatening probably are either issued documentation and permitted to remain in Ukraine or forcibly deported to Russia.

Share this:

(U//FOUO) This Intelligence In View provides federal, state, local, and private sector stakeholders an overview of Russian Government-affiliated cyber activity targeting the United States and Russian regional adversaries, including disruptive or destructive cyber activity, cyber espionage in support of intelligence collection, and malign foreign influence in service of Russian political agendas. This In View also provides examples of malware and tools used by Russian Government-affiliated cyber actors.


(U) Russia likely will remain a significant threat to US networks, data, and critical infrastructure as it refines and employs its sophisticated cyber espionage, influence, and attack capabilities, particularly in response to international pressure following its unprovoked attack on Ukraine. Russia has previously targeted critical infrastructure in the United States and allied countries to improve—and in some cases demonstrate—its ability to inflict damage during a crisis. Russia’s use of destructive malware against Ukrainian infrastructure highlights the potential for such attacks to unintentionally spill over to other countries and threatens the availability of US critical assets and data. Russia will likely use these tools to compromise infrastructure and networks, acquire intellectual property and other proprietary data, undercut public trust in US institutions, and sow discord in the Homeland.


(U) The Russian Government almost certainly considers cyber attacks an acceptable option to deter adversaries and control escalation.

(U//FOUO) This Joint Intelligence Bulletin (JIB) provides an overview of significant tactics, techniques, and procedures (TTPs) discussed or used by the alleged perpetrator of the 14 May 2022 mass casualty shooting in Buffalo, New York and details how related documents spread after the attack may contribute to the current threat landscape. The alleged attacker drew inspiration from previous foreign and domestic racially or ethnically motivated violent extremists (RMVEs) and their online materials, underscoring the transnational nature of this threat. DHS, FBI, and NCTC advise federal, state, local, tribal, and territorial government counterterrorism and law enforcement officials and private sector security partners to remain vigilant of this enduring threat.

(U) Tactics, Techniques, and Procedures Observed

(U//FOUO) DHS, FBI, and NCTC assess that the dissemination of written guidance outlining the TTPs used by the alleged Buffalo attacker will likely enhance the capabilities of potential mass casualty shooters who may be inspired by this attack. The alleged attacker prioritized creating a comprehensive “how-to” guide for future attackers, including guidance on bolstering opportunities for maximum casualties and optimizing personal defense. The written guidance will contribute to the volume of violent extremist content readily available online, leading to potential opportunities for future attackers to learn from the TTPs and enhance their own capabilities. While these TTPs can enhance the capabilities of any violent extremist, we assess that lone offender RMVEs espousing a belief in the superiority of the white race are most likely to utilize these tactics due to their shared ideology and the demonstrated history of RMVEs citing inspiration from previous attackers.

The United States and other Western nations face a heightened threat from violent extremists motivated by a broad range of ideologies. Previous editions of this booklet have focused solely on the indicators of homegrown violent extremist mobilization to violence; this edition has been expanded to include indicators that apply to multiple ideologically-motivated US-based violent extremists, given the evolving complexity and variety of factors influencing the domestic threat landscape.

These indicators were developed and updated based on a review of information derived from dozens of FBI terrorism investigations, peer-reviewed academic studies, and analytic exchanges among Intelligence Community and law enforcement professionals. The indicators of violent extremist mobilization described in this booklet are observable behaviors that could help to determine whether individuals are preparing to engage in violent extremist activities.

The indicators are grouped according to the stages individuals undergo: mobilization to violence, engaging in preparation, and developing motivation. These indicators suggest how close an individual may be to mobilizing to violence and are ordered by the strength of the indicator within each category.

This resource is provided to inform law enforcement, terrorism prevention practitioners, other first responders, community leaders, as well as the general public about both threats of violence and contextual behaviors that suggest an individual is mobilizing to violence. While some violent extremists may make direct, indirect, or vague threats of violence, others may plot violent action while avoiding such overt threats to maintain operational security—underscoring the need to consider both threats of violence and contextual behaviors.

(U//FOUO) During the six-month period from April 2022 to September 2022, we project that US Customs and Border Protection (CBP) will record between 1 and 2.1 million encounters at the US Southwest Border. We have low confidence in these projections because migration is a complex and fluid issue, making predictive analysis difficult. Additionally, the percentage of selected Latin American and Caribbean nationals encountered at the US Southwest Border has increased from 11 percent in the first six months of FY 2021 to 31 percent in the first six months of FY 2022. This increasing diversification of migrant nationalities encountered at the US Southwest Border—on top of other capacity challenges—will further complicate US capacity to manage the expected flow, as it requires engagement with other migrant-source countries besides Mexico and Northern Triangle countries. Specifically, encounters of Cuban, Nicaraguan, and Venezuelan nationals pose unique challenges because of our limited relationships with these host countries.

Share this: