Command Posts for the Drone Industrial Base, and a Defensive Front Line Shifting to Private Hands

In the early hours of 2 November refrigeration units in supermarkets in Belgium, Luxembourg, Sweden, Finland and Estonia, among others, were remotely set as high as 50°C through legacy Danfoss controllers, forcing Carrefour Belgium (about 15 stores) and Coop Sweden (six stores) among others to discard food. The same supplier was targeted in the 12 October attack in France; EU Agriculture Commissioner Christophe Hansen called it 'a deliberate attempt to disrupt our food supply chain and undermine consumers' confidence in it'. There has been no claim of responsibility and no government attribution; the case is recorded as simultaneous OT sabotage across several countries.

Fox News reported on 2 November that Secretary of War Pete Hegseth issued a September directive calling election security a 'no-fail mission', ordering the defence intelligence enterprise including NSA, DIA and NGA to 'mobilize every authorized asset, capability, and partnership' against foreign election threats and directing US Cyber Command to counter foreign cyber activity under existing authorities in coordination with DHS. The directive grants no new authorities and creates no new organisation, and the department has not detailed implementation. The text is not public; the account rests on the network's summary.

The New York Times reported on 2 November that CISA, which in 2024 ran a war room with state and local officials, will be 'largely absent from the action' on polling day. On CBS on 1 November Senator Mark Warner described Russian, Iranian and Chinese influence efforts plus others including North Korea, and Representative Jim Himes said 'nothing out there suggests that there is either the capability or the intent to do interference' while describing 'a pretty robust influence environment'. Private firms report suspected Russian operatives posting AI-altered videos on X.

Elbit Systems announced on 2 November a contract from Israel's Ministry of Defense worth about $170 million over 15 years to establish and operate a training and simulation centre for the IDF Artillery Corps. Covering the ROEM (SIGMA) 155mm self-propelled howitzer and the LAHAV (PULS) precision rocket launcher, it includes mission and driving simulators, classrooms and 'automation capabilities, AI-based functionalities', aimed at shortening qualification and reducing wear on operational platforms. The release does not specify what the AI functions do.

According to a Latvian National Armed Forces statement as relayed by Militarnyi, air-raid alerts were issued for the Krāslava and Ludza municipalities at 18:57 on 1 November after an unidentified aerial object was detected, and the BLAZE interceptor drone was deployed for the first time. The object left Latvian airspace into Russia at 19:16, and at 19:19 the military triggered BLAZE's self-destruct near the border to keep it from falling on Russian territory. The object's identity and whether an engagement took place have not been disclosed; the case stands as the first operational use of a European-built interceptor drone by a NATO military.

Ukraine's Defence Intelligence (HUR) published on its War&Sanctions portal on 2 November an analysis of a captured Gerbera-2, Militarnyi reported. The enlarged decoy has a 63-litre tank for a range of up to 1,200 km and endurance of up to 10 hours; the examined airframe carried a 10 kg OFZBCh-10 warhead against the 25 kg Russia claims, a jam-resistant Kometa-M12 navigation module, a mesh modem from China's Shenzhen Sinosun and a dual IP camera to detect Ukrainian interceptor drones. Of 22 foreign components identified, eight are Chinese, four US, three Irish, three Swiss, one Taiwanese and one Dutch, all per HUR's analysis.

Oshkosh Defense, maker of the JLTV, announced on 2 November a partnership with California startup Grid Aero to scale production of Lifter, an autonomous aircraft meant to carry a few thousand pounds over a few thousand miles for cargo and ISR. After design-for-manufacturability, production planning and supply-chain work, a pilot line at Oshkosh is planned in about a year, with hundreds to thousands of aircraft targeted for the early 2030s. Prototype testing continues for 6–12 months and the airframe is to be redesigned; no government funding or contract has been announced.

Leonardo DRS announced on 2 November that it will provide 'rugged integration expertise' as a subcontractor to prime AeroVironment on the Army's Enduring High Energy Laser (E-HEL), the service's first production high-energy laser programme, awarded in September at about $465–500 million with deliveries expected 'well into the dozens' in JLTV, ISV and palletised configurations. The subcontract value is undisclosed, and JIATF 401 plans a directed-energy shoot-off later this year.

Brig. Gen. Michael Smith, INDOPACOM's J6, said operators from the DoD Cyber Defense Command under US Cyber Command have been sent from Fort Meade to DISA-Pacific in Hawaii as 'Cyber Defense Forces Pacific', adding 'a level of additional cybersecurity defense here in this theater'. 'When they weren't here, it's just me,' he said, without giving numbers or dates. At the same conference DISA-Pacific described the Pacific Mission Partner Network consolidating allied networks and a new Regional Network Operations Security Center Pacific with 20% more personnel.

In a statement dated 31 October, Singapore's Ministry of Home Affairs rejected the Wall Street Journal's report that Singaporean intelligence suspected Megaspeed's Alice Huang, an associate of Nvidia CEO Jensen Huang, of being an MSS asset and questioned her in 2025: 'neither the Singapore Government nor its officials said this' and 'there were no such investigations conducted in respect of Alice Huang'. The ministry said investigations into Megaspeed are ongoing, that Singapore does not enforce other countries' unilateral export controls, and that it has charged four individuals and four companies since February 2025 for defrauding server suppliers. Reuters and AFP carried the statement widely on 2 November.

Nextgov reported on 2 November that an order signed by DHS Secretary Markwayne Mullin on 31 July and posted in the Federal Register on 30 October requires federal civilian agencies to completely remove software from Swiss-headquartered Acronis by 27 January 2027. The order rests on a Federal Acquisition Security Council recommendation citing continued Russian developer involvement and a licensing arrangement with a Russian entity reselling to government customers, though two former officials said there was no concrete evidence of backdoors. Private-sector use is not barred, and Acronis says EQT's May 2025 acquisition received CFIUS approval.

Asked at the 2 November regular briefing about attribution of the roughly $6.3 billion Binance theft to North Korea and President Trump's remarks, Chinese MFA spokesperson Mao Ning said only 'we are not aware of the relevant situation'. Bloomberg reported the same day that TRM Labs and Chainalysis point to TraderTraitor, and that Binance says a software engineer's laptop was compromised, giving access to withdrawal-processing systems. The suggestion that AI tools were used for reconnaissance or social engineering is attributed to 'some experts' and is not an investigative finding.

Coalition spokesman Brig. Gen. Turki al-Maliki said on 2 November that 'two drones [were] intercepted and destroyed in the Riyadh region', without naming the launcher or reporting damage. The same day Houthi spokesman Yahya Saree claimed that over the previous 48 hours Houthi forces hit Dammam airport with two drones, disrupting air traffic, scored a direct drone hit on an early-warning radar in Jazan and targeted a military transport aircraft at Jazan airport. The Houthi hit claims are not independently confirmed and Saudi Arabia has acknowledged no damage.

The Hacker News reported on 1 November that Kaspersky described a multi-stage infection chain targeting a custom Windows 10 build used exclusively by government entities in Asia. A CAB file placed in the Windows Update download directory bundled a malicious resource with legitimate PatchMyPC components, then used AppDomainManager injection, AMSI bypass and anti-forensic deletion before a final stage inside dllhost.exe, sleeping 22–28 hours between contacts with openaigpt4v[.]com. Kaspersky saw a single victim in an undisclosed country; a supply-chain compromise is suspected and no actor has been attributed.