GCTA Foresight Audit, Part 10: Cyber-Kinetic Convergence

CommandEleven Intelligence // Cyber and Infrastructure Desk. Foresight Audit, status as of November 3, 2026. This audit scores the 2026 Global Counter-Terrorism Assessment (GCTA), published in April 2026, against evidence published afterwards.

Bottom Line Up Front

The cyber-kinetic chapter (pages 10, 11, 72, 73 and 79) mostly describes events that had already happened by April 2026, so most of it is checked as baseline fact, and most of that holds. We scored two forward-looking judgments. Both are partly confirmed: 1 of 2. The baseline facts do not count in the Foresight Record totals.

The convergence thesis stands. Amazon confirmed that drones struck its facilities in the United Arab Emirates and Bahrain in March, shipping analysts recorded about 978,000 GPS jamming events in the first quarter of 2026, a record, and Amazon’s own threat team documents Iranian cyber access to Jerusalem cameras days before the June 23, 2025 missile attack. But the actors we named are mostly wrong. The joint FBI, CISA and NSA advisory on industrial controllers names an Iranian state-affiliated group, not the Baloch Liberation Army or ISKP, and the TTP’s anti-drone gun is one captured system, not an arms race. Several specific figures, including a $45 million grounding bill and a 72-hour Gulf outage, we cannot source.

Key Judgments

KJ1: The strikes and signal-jamming events we described did happen. The AWS strikes, the Jerusalem camera access and the record jamming figures are confirmed in substance. [BASELINE, confirmed]

KJ2: Industrial controllers are being attacked, but by a state-affiliated group, not the non-state actors we named. The damage reported is disruption and financial loss. [PARTIALLY CONFIRMED]

KJ3: The TTP has been filmed with a captured anti-drone gun. That is one system, not a documented procurement program or arms race. [PARTIALLY CONFIRMED]

KJ4: Our dates and figures were weaker than our thesis. The Houthi ship-data example dates to 2021 through 2024, not early 2026. [BASELINE, corrected]

How We Scored

Every call is scored under the Foresight Record rules, set out in full in the GCTA Foresight Audit introduction. The original is quoted and dated, the score rests on evidence published after the GCTA appeared, and confirmed counts 1 and partly confirmed counts 0.5. Where an official attributes something without publishing evidence, we score partly confirmed. A call that depends on a verdict or a data release is held open. Only our own judgments count.

This audit covers the cyber-kinetic sections on pages 10 and 11 (drones and counter-measures), 72 and 73 (the convergence vectors) and 79 (convergence markers). The drone claims specific to the Sahel and to Latin America are scored in the Sahel audit and the Latin America audit, and the question of a strike on US data centers and the grid is held open in the Europe and North America audit. We scored the statements that predict how threat actors would behave, and checked the rest as baseline facts. One limit applies: the joint advisory on industrial controllers was first published on April 7, before the GCTA, so we score on its July 22 update.

The Scored Calls

CK-01. Anti-drone guns in militant hands

What we said (GCTA, p. 11). “In a significant 2026 development, the TTP and other groups have begun acquiring their own anti-drone jamming guns to protect their hideouts from state surveillance, creating a technological arms race in the border regions.”

What the record shows. A June 22, 2026 analysis in South Asian Voices says pro-TTP videos show militants holding a captured anti-drone gun that resembles the GIDS SAFRAH-II, a jamming system with a reported range of 1,500 meters. The provincial government had recently issued these guns to Khyber Pakhtunkhwa police, and the author says the militants probably took them in attacks on police installations. The article does not date the capture. The same analysis shows how large the drone threat is: Pakistan’s army spokesman acknowledged TTP drone use for the first time in December 2025 and cited 405 attacks that year, and Bannu police reported 20 such attacks in January 2026 alone. We found no evidence that the TTP or any other group bought jamming equipment or used it to protect hideouts.

Score: PARTIALLY CONFIRMED. The direction of travel is right and the device is real. One captured system does not show an acquisition effort or an arms race, and the capture is undated.

CK-02. Industrial controllers and engineered accidents

What we said (GCTA, p. 73). “2026 threat actors are focusing on Purdue Level 1 devices (PLCs and field controllers).” We added that groups like the BLA or ISKP could trigger catastrophic mechanical failures in pipelines or rail networks that look like accidents.

What the record shows. A joint advisory from the FBI, CISA, the NSA, the EPA, the Department of Energy, US Cyber Command’s Cyber National Mission Force and the Treasury was first published on April 7, 2026 and updated on July 22. It says an Iranian-affiliated group is exploiting programmable logic controllers from Rockwell Automation, Schneider Electric and Siemens, and has changed controller project files and manipulated operator displays. Government facilities, water and wastewater systems and energy providers were hit, and some organizations suffered operational disruption and financial loss. The advisory links the activity to CyberAv3ngers, which is affiliated with the IRGC’s Cyber Electronic Command. The page we read does not report physical damage. We found no report of the BLA or ISKP manipulating industrial controllers.

Score: PARTIALLY CONFIRMED. Field-controller targeting is confirmed and is serious. The actor is a state-affiliated group, not the non-state groups we named, and the reported effect is disruption, not catastrophic mechanical failure.

Baseline Facts Checked

These are factual statements in the GCTA that were checkable. They are not forecasts and are not counted in the Foresight Record totals. A claim we could not reproduce is marked unverified, which is not the same as wrong.

What Would Change These Scores

• A documented BLA or ISKP manipulation of an industrial controller would move CK-02 toward confirmed.
• Evidence that the TTP bought or used jamming equipment at scale would move CK-01 toward confirmed.
• A source for the 72-hour Gulf outage, the $2,000 munition or the $45 million grounding would move those rows from unverified.
• Reported physical damage from the Iranian-affiliated controller campaign would strengthen the engineered-accident part of CK-02.

What We Learned

The thesis was right and the attribution was loose. We wrote that the actors who might exploit field controllers were the BLA and ISKP, and the public record names an Iranian state-affiliated group. State actors are doing the convergence work, and non-state groups are following at a distance.

We attached precise numbers to events we could not source. The cost of a vivid figure is the correction, and we will cite the source for any figure in the next assessment or leave it out.

What This Audit Does and Doesn’t Establish

• It establishes that physical strikes on cloud infrastructure, camera access for targeting and record GPS jamming all occurred.
• It establishes that field controllers in US water, energy and government systems are being attacked by an Iranian-affiliated group.
• It does not show that any non-state group has done so.
• It does not show that the TTP is running an anti-drone procurement program.
• It does not review the Gulf strikes’ full economic cost.

Frequently Asked Questions

Did Iran strike Amazon data centers?

Amazon confirmed that drones struck its facilities in the UAE and that a Bahrain facility lost power, and reports tie the strikes to Iran’s retaliation. Amazon’s statements did not say who launched them.

Are terrorists attacking industrial control systems?

A state-affiliated Iranian group is, according to a joint US advisory. We found no report of the BLA or ISKP doing so.

Did the Houthis use hacked ship data?

Amazon documented an Iranian group tracking a vessel in January 2024 and a Houthi missile strike on it days later, and called the link unmistakable. It did not say the Houthis received the data.

What comes next?

Part 11 is the closing synthesis, covering the policy chapters and the series totals.

Sources

• The Register, AWS says drones hit two of its datacenters in UAE, urges users to move resources to different regions (March 2, 2026)
• AWS Security Blog, New Amazon Threat Intelligence Findings: Nation-State Actors Bridging Cyber and Kinetic Warfare (Amazon)
• The Record, Report on Iranian use of hacked Israeli security cameras during the June 2025 missile attacks (June 23, 2025)
• Inside GNSS, MSC Antonia Grounding in the Red Sea Attributed to Suspected GNSS Spoofing (May 2025)
• OCCRP, More than 1,100 ships hit by widespread GPS disruption after Iran strikes (March 5, 2026)
• SAFETY4SEA, Maritime GPS jamming hits record levels in Q1 of 2026 (June 24, 2026)
• American Hospital Association, Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure (updated July 22, 2026)
• South Asian Voices, Analysis of the TTP drone threat in Pakistan (June 22, 2026)

Related CommandEleven Intelligence Reporting

• The GCTA Foresight Audit
• GCTA Foresight Audit, Part 3: The Sahel
• GCTA Foresight Audit, Part 7: Europe and North America
• GCTA Foresight Audit, Part 9: ISKP, the Islamic State’s Engine Room
• The Foresight Record: Every Call We Have Scored, Misses Included
• 2026 Global Counter-Terrorism Assessment (download)