Today's D Brief: EU prepares for gas rationing; Moscow's expanding invasion; Czechs want F-35s; Chinese, Russian, DPRK hackers are busy; And a bit more.

The European Union is moving closer to gas rationing in anticipation of Russia cutting off supplies across the bloc in the coming winter. “EU countries should do their best now to save 15% of annual gas consumption,” Ursula von der Leyen, EU Commission president, advised Wednesday in remarks from Brussels. “Right now the goal is aspirational,” she said. But, “In case of a European alert, the 15% are binding.”

“Russia is using gas as a weapon,” Von der Leyen warned. “We learnt from the pandemic that if we act in unity, we can address any crisis. So let's act together to reduce gas use and provide a safety net for all EU countries.” 

Context: “Russian President Vladimir Putin said late Tuesday that his country would fulfill its commitments to supply natural gas to Europe but also warned of possible new capacity shortfalls because of Western sanctions,” the Wall Street Journal reports. 

“I think we should be very clear: Gazprom has proven to be a completely unreliable supplier,” Von der Leyen said Wednesday. “And behind Gazprom is, as we know, Putin. So it is not predictable what is going to happen.” Already, EU-wide “Gas storage is at 64%,” she said; and “Gas supply from other sources has increased by 75% compared to last year.” But more related moves could be coming. “The quicker we act, the more we save, the safer we are,” said Von der Leyen.

Read more: The Associated Press has an explainer today that asks “Can Europe live without Russian natural gas?” The Journal also published its own explainer on Russia’s Nord Stream 1 pipeline, here.

Russia’s top diplomat says Putin indeed wants to seize more of Ukraine than just the country’s east. Now, said Foreign Minister Sergei Lavrov to state-run RIA news agency on Wednesday, the Ukrainian land that Russia wants is “far from being just [the Donetsk] and [Luhansk oblasts], it's also Kherson and Zaporizhzhia regions and a number of other territories…This process is continuing logically and persistently,” he said, according to Reuters. (Max Seddon of Financial Times preserved video of Lavrov’s remarks on Twitter, here.)

The White House said as much on Tuesday as well. “We’re seeing ample evidence in the intelligence and in the public domain that Russia intends to try to annex additional Ukrainian territory,” said John Kirby, coordinator for strategic communications at the National Security Council. “Russia is beginning to roll out a version of what you could call an ‘annexation playbook,’ very similar to the one we saw in 2014.” 

Ukraine’s Kherson, Zaporizhzhia, and “all of Donetsk and Luhansk Oblasts” are on the Kremlin’s annexation agenda, Kirby said. “Russia is also installing loyalists in areas of Ukraine that it controls, including a man named Sergei Yeliseyev, a former Russian intelligence officer who has been put in charge of Kherson. Figures like Yeliseyev are Russian bureaucrats with absolutely no connection to Ukraine,” Kirby said.

Should Moscow move ahead with these annexations, “Russia will face additional sanctions and become even more of a global pariah than it is now,” Kirby said, and promised, “We will never recognize any purportedly annexed territory as belonging to Russia.”

More HIMARS will be headed to Ukraine soon, he added. And “We’re also going to continue to expose Russian plans so the world knows that any purported annexation is premeditated, illegal, and illegitimate,” Kirby said. So more of this information could be just around the bend. (Russia’s state-run media, TASS, said last week that Moscow wants to hold referendums on annexing Zaporizhzhia in the early Autumn.)

The Czech Republic wants to buy possibly two dozen F-35s from the U.S., the country’s foreign and defense ministers announced Wednesday. That means negotiations are expected to formally begin soon, with the goal of reaching an official agreement by Oct. 2023. 

“We're selecting a multi-role platform,” said Karel Řehka, chief of staff for the Czech army, “not just a fighter or a bomber, but we're looking at a platform that can serve as a command and control center—at the same time a very advanced sensor and spy aircraft, and at the same time a combat aircraft,” he said Tuesday. 

The Czechs say they want “a multifunctional [aircraft] that has to be able to fulfill our tasks beyond 2027,” while also “ fit[ting] into the concept of how we will fight and wage war in 2040, 50, 60,” Řehka said. 

Said F-35-maker Lockheed Martin in a statement Tuesday: “As the foundation of NATO and European alliance’s next generation of air power, the F-35 is the most advanced aircraft in the world today.” 

Read more: Our colleague Tara Copp has some background and a few more details, reporting from Prague, here.

Additional reading: 

• “Ukrainian forces strike key bridge in Russian-occupied south,” via AP, reporting Wednesday after this video clip made the rounds on social media Tuesday; 
• “Putin Finds a New Ally in Iran, a Fellow Outcast,” via the New York Times, reporting Tuesday; 
• And don’t miss an excellent new multimedia feature from the Economist humbly entitled, “Rebuilding one street in Ukraine,” about seemingly heroic reconstruction efforts taking place in Irpin, just outside of Kyiv. 

From Defense One

At UK Airshow, Defense Execs Warn of Inflation, Supply Chains, and Worker Shortages  // Marcus Weisgerber and Bradley Peniston: The Biden administration needs to invest in apprentice schools, CEO of top aerospace and defense firm says.

Ukraine Says It Needs at Least 100 HIMARS and Longer-Range Rockets  // Patrick Tucker: More mobile artillery rocket systems, drones, and longer-range rockets would be a “game changer” said top Ukrainian defense official.

Russia Following 2014 ‘Annexation Playbook’ In Eastern Ukraine, White House Says // Jacqueline Feldscher: The White House is expected to announce another weapons shipment to Ukraine this week.

Austria Becomes the National Guard’s Newest Security Partner in Europe  // Tara Copp: The Guard is expanding its presence overseas with new partners and lessons from Ukraine.

The Air & Space Brief: UK’s new fighter set to fly in five years; Sweden studying new jet amid NATO bid; Space priorities in the NDAA // Jacqueline Feldscher: 

Welcome to this Wednesday edition of The D Brief, brought to you by Ben Watson with Jennifer Hlad. If you’re not already subscribed to The D Brief, you can do that here. And check out other Defense One newsletters here. On this day in 1936, the Montreux Convention was signed in Switzerland—bringing together officials from Australia, Bulgaria, France, Greece, Japan, Romania, Yugoslavia, the United Kingdom, the Soviet Union, and Turkey. The agreement lets Turkey restrict naval traffic in the Bosporus and Dardanelles Straits, which strategically link the Black and Mediterranean Seas.

U.S. authorities say they finally thwarted a North Korean ransomware campaign that hit hospitals and health facilities across the country, including in Kansas and Colorado, Deputy Attorney General Lisa Monaco said during a cybersecurity event at Fordham Law School in New York. In the process, officials with the U.S. Department of Justice say they were able to confiscate about a half-million in cryptocurrency ransom payments, the Wall Street Journal reported after Monaco detailed the campaign on Tuesday.
And FBI Director Chris Wray succinctly addressed the persistent cyber threats from Russia, China, and Iran, telling the audience on Tuesday:

• “The Russians are trying to get us to tear ourselves apart. The Chinese are trying to manage our decline, and the Iranians are trying to get us to go away.”

China’s MO: In private remarks to Adam Goldman of the New York Times, Wray elaborated somewhat on the threat from Beijing, saying, Chinese officials “care more about being caught, which may contribute to their calculus in terms of how they go about what they are doing. Part of that is because of their goal to be the world’s dominant economic power…That requires trying to maintain a level of credibility, if you will, with all sorts of audiences around the world,” Wray told the Times. Read more, here.

Don’t drop your guard: Russian hackers are still scouring U.S. government networks for anything they can grab, including using Google Drive and Dropbox cloud storage to infect their targets, according to cybersecurity firm Palo Alto Networks, which detailed this latest known effort on Tuesday.
Why it matters: “The ubiquitous nature of Google Drive cloud storage services—combined with the trust that millions of customers worldwide have in them—make their inclusion in this [advanced persistent threat]’s malware delivery process exceptionally concerning,” Mike Harbison and Peter Renals of Palo Alto warn. CNN has more, here.
Google says some Russian disinformation campaigns are targeting Russia’s own population in order to shore up support for Putin’s invasion of Ukraine. This includes work from the well known Internet Research Agency as well as a Russian consulting firm. More on those efforts in Google’s second quarter roll-up, published last week, here.
Russian-backed phishing campaigns are still aggressively targeting “government and defense officials, politicians, NGOs and think tanks, and journalists,” Google said in a separate report on Tuesday. “In addition to including phishing links directly in the email, the attackers also link to PDFs and/or DOCs, hosted on Google Drive and Microsoft One Drive, that contain a link to an attacker-controlled phishing domain,” Billy Leonard of Google’s Threat Analysis Group said, and noted that, “In at least one case, unrelated to Ukraine, they have leaked information from a compromised account.”
For what it’s worth, at least one of your D Brief-ers has observed a steep rise in attempted phishing campaigns via cell phone since April, including one that seemed to have lazily targeted 20 people in a single text purportedly from Amazon on Tuesday. For several years, analysts have estimated that anywhere between 15% and 30% of phishing messages are opened by the targets—which means there will always be someone who clicks; don’t be that someone. Read more from Google about the above Russian-backed campaign and others like it, here.
Another thing: Chinese hackers allegedly attacked Belgium’s defense ministry recently, Belgian officials announced in a statement on Monday. “Belgium strongly denounces these malicious cyber activities, which are undertaken in contradiction with the norms of responsible state behavior as endorsed by all UN member states,” officials in Brussels said. “We continue to urge the Chinese authorities to adhere to these norms and not allow its territory to be used for malicious cyber activities, and take all appropriate measures and reasonably available and feasible steps to detect, investigate, and address the situation,” they added. More here.
Related reading: 

• “Critical flaws in GPS tracker enable ‘disastrous’ and ‘life-threatening’ hacks,” Ars Technica reported Tuesday off a new report (PDF) from cybersecurity firm BitSight and a new U.S. Cybersecurity and Infrastructure Security Agency warning about the $20 ​​MiCODUS MV720 GPS tracker.

And lastly today: In curious new findings from academia, two European researchers say they’ve discovered “that wolf attacks [on livestock] are accompanied by a significant rise in far-right voting behavior” in Germany. That’s according to the University of Amsterdam’s Bernhard Clemm von Hohenberg and Anselm Hager, an assistant professor at Berlin’s Humboldt University. Writing in the Proceedings of the National Academy of Sciences this week, the two sought to “explore the connection between wildlife conservation and voting behavior” after wolf conservation efforts yielded growing numbers of the fabled creature over the past several years. 
What they learned: Among state-level elections, Germany’s far-right Alternative für Deutschland, or AfD party, “gains over 5 percentage points after a wolf attack.” And at the municipality-level, “we find that communities that witnessed wolf attacks are significantly more likely to vote for the radical right AfD, which espouses climate-skeptic and anti-conservationist positions,” Hager and von Hohenberg write.
And relatedly, “By contrast, the pro-environment Green party, if anything, suffers electoral losses when wolves attack,” they insist, but note that “this relationship is detectable only in state elections.”
Why it may matter more than you’d thought 10 minutes ago: “[M]any more wolf packs are expected to find territories in Europe—models estimate an increase to up to 1,400 packs in Germany from 150 today,” the researchers argue.
Critical caveat: “[E]ven though municipalities that witnessed wolf attacks swing right, we do not know how this compares to other factors explaining the vote for the radical right, such as anti-immigrant sentiment,” von Hohenberg and Hager say. Read the rest, here.
Dive deeper on a related topic: “Do shark attacks swing elections?” the Washington Post asked in Oct. 2016, resurrecting a 100-year-old tale involving the Jersey shore and POTUS28 Woodrow Wilson’s re-election campaign.