{"schema_version":"0.10.0","id":"LR-2026-0683","record_version":1,"title":"AI-assisted state-aligned espionage campaign against UAE critical sectors","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":42.5,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":2.24,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"1aecf7820eda8e563fbb9be58bb82cd39271e43a1316af5edf4cf826adccb4ec"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-08-17","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"The UAE government reported that organised cyberattacks targeting its aviation, energy and education sectors were thwarted before critical systems or services could be disrupted. The council assesses the campaign as coordinated and state-aligned espionage, with a moderate-confidence association, and states that attackers used AI to accelerate target profiling, localise messages and generate convincing correspondence. The first warning came when an employee’s account and device began behaving unusually. Security teams terminated sessions, changed credentials and isolated compromised devices. The council found no evidence that attackers reached operational systems controlling flights, airports or energy infrastructure, and no physical services were disrupted. A limited number of corporate accounts and devices were compromised.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Test met: data or systems of others touched with a bounded scope stated (a limited number of corporate accounts and devices compromised)","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.wired.me/story/inside-the-ai-powered-cyberattack-on-the-uaes-critical-sectors","publisher":"WIRED Middle East","date":"2026-08-17","type":"press","title":"Inside the AI-Powered Cyberattack on the UAE’s Critical Sectors - WIRED Middle East","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"event.incident_class":"C","event.adversarial_actor":"C","impact.severity":"D","impact.severity_because":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"Last week, the UAE announced that it had thwarted organised cyberattacks targeting the country’s aviation, energy and education sectors."}],"event.adversarial_actor":[{"source_index":0,"quote":"Al Kuwaiti says a limited number of corporate accounts and devices were compromised during what the council assesses to be a coordinated, state-aligned espionage campaign."}],"impact.severity":[{"source_index":0,"quote":"Al Kuwaiti says a limited number of corporate accounts and devices were compromised during what the council assesses to be a coordinated, state-aligned espionage campaign."}],"impact.severity_because":[{"source_index":0,"quote":"Al Kuwaiti says a limited number of corporate accounts and devices were compromised during what the council assesses to be a coordinated, state-aligned espionage campaign."}],"event.summary":[{"source_index":0,"quote":"Last week, the UAE announced that it had thwarted organised cyberattacks targeting the country’s aviation, energy and education sectors."},{"source_index":0,"quote":"AI was used to accelerate target profiling, localise messages, generate convincing correspondence and rapidly modify lures when earlier attempts failed."},{"source_index":0,"quote":"Al Kuwaiti says the evidence supports a “moderate-confidence association with state-aligned activity”."},{"source_index":0,"quote":"In one case described to WIRED Middle East, the first warning came when an employee’s account and device began behaving unusually."},{"source_index":0,"quote":"Security teams terminated active sessions, changed affected credentials, isolated compromised devices and searched other systems for signs that the attackers had spread."},{"source_index":0,"quote":"The council says it found no evidence that the attackers reached the operational systems controlling flights, airports or energy infrastructure, or the sensitive education platforms it examined."},{"source_index":0,"quote":"No physical services were disrupted."},{"source_index":0,"quote":"Al Kuwaiti says a limited number of corporate accounts and devices were compromised during what the council assesses to be a coordinated, state-aligned espionage campaign."}]},"notes_on_gaps":"No exact dates are stated for the UAE announcement, the attacks, or detection; the article date 2026-08-17 is its publication date, not a disclosure date, so no date fields are set. The July disclosure year is not stated. The AI was described as a tool used by human attackers; no autonomous agent was reported, so agent_involved is false and no failure_class is set. Attribution is only a moderate-confidence association with state-aligned activity; the adversarial_actor value is a judgement from that. The number of organisations, accounts, devices and any extracted data are not stated. Detection method, trigger, root cause and responsible party are not stated and are left out. The system is not identified as an AI product, so system fields are omitted. Severity moderate is a judgement from the bounded 'limited number' scope. The J3 link to the isolation remediation is my judgement, since the source does not name a control. The J9 failure is inferred from the phishing message reaching an employee. Financial-institution campaign details are not included beyond the stated link. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"A tailored message reached an employee, malicious code ran on a corporate device, and the attackers tried to obtain credentials.","quote":"Investigators concluded that a tailored message had reached the employee, malicious code had run on a corporate device and the attackers had attempted to obtain credentials.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.wired.me/story/inside-the-ai-powered-cyberattack-on-the-uaes-critical-sectors"]},"analysis":{"sections":{"timeline":[{"text":"The council disclosed an earlier campaign against UAE financial institutions, linked to these attacks.","quote":"He also linked the attacks to an earlier campaign against UAE financial institutions, which the council disclosed in July.","source_index":0,"when":"July"},{"text":"Investigators concluded a tailored message reached an employee, malicious code ran, and credentials were sought.","quote":"Investigators concluded that a tailored message had reached the employee, malicious code had run on a corporate device and the attackers had attempted to obtain credentials.","source_index":0,"when":null},{"text":"Security teams terminated sessions, changed credentials, isolated devices and searched other systems.","quote":"Security teams terminated active sessions, changed affected credentials, isolated compromised devices and searched other systems for signs that the attackers had spread.","source_index":0,"when":null},{"text":"No physical services were disrupted.","quote":"No physical services were disrupted.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.wired.me/story/inside-the-ai-powered-cyberattack-on-the-uaes-critical-sectors"]}}