Havana and the KGB's 1995 Malware Campaign

By Vera Kessler · September 13, 2026

Kept under Secret//Noforn markings, this record details how Soviet and Cuban agents targeted American computer systems using malicious software to erode national security.

The invisible breach of a government server is a quiet violence, an erasure of trust that leaves a nation's digital skin porous and exposed. For those tasked with defending the wire, the cost is a permanent state of paranoia and the knowledge that the enemy is already inside.

In May 1995, the United States Army was cataloging this violence not as a series of spy operations, but as a technical inventory. The record available here is a curated archival description rather than the original pages of the report. It refers to a "Defense Intelligence Reference Document" titled "Nonlethal Technologies - Worldwide," produced by the National Ground Intelligence Center. The file is marked Secret//Noforn//WNINTEL, a designation that forbids the sharing of the contents with any foreign national.

Nonlethal Toolkits

The report originates from the National Ground Intelligence Center, the scientific and technical intelligence arm of the Army Intelligence and Security Command, which provides foreign ground force assessments to National-level decisionmakers. By placing the report under the umbrella of "Nonlethal Technologies," the Army shifted the conversation. The record explicitly states that this section of the assessment "deals primarily with electronic intrusion and malicious software" (NGIC, 1995).

The pattern suggests that this taxonomy was a deliberate choice. By reclassifying strategic espionage as a "nonlethal technology," the Army moved the problem of cyber-intrusion from the diplomatic and intelligence beats—where it would be handled by the State Department or the CIA—and placed it firmly on a military procurement and defense beat. The desk's reading is that this shift allowed the Army to frame electronic intrusion as a materiel threat, effectively transforming a spy problem into a budget line for defense systems.

Document imagery from nsarchive.gwu.edu From the files: nsarchive.gwu.edu

The Havana Proxy

The document identifies two primary actors in this effort to disrupt U.S. systems: the KGB and Cuban intelligence. The KGB, the Soviet Union's chief security agency from 1954 to 1991, had spent decades managing internal security and foreign intelligence through a massive apparatus of surveillance and subversion. Cuban intelligence, the state's main intelligence agency founded in 1961 to conduct foreign operations, functioned as a Caribbean outpost for Soviet interests.

The record claims these two agencies pursued "parallel strategic objectives in conducting electronic intrusions against U.S. systems" (NGIC, 1995). This phrasing is a diplomatic courtesy that masks a harder reality. At the time of this report, Cuba was enduring the "Special Period," a catastrophic economic collapse following the withdrawal of Soviet subsidies. The Cuban state lacked the technical autonomy and the capital to develop a sophisticated, worldwide malware campaign independently.

The desk's reading is that the "parallel" relationship described by the Army was actually a hierarchical dependency. Cuba did not act in parallel; it acted as a proxy and a testbed for Russian tools. The KGB provided the blueprints and the malicious software, and Havana provided the operational cover and the regional access. The "parallelism" is a fiction that obscures the extent to which the Soviet intelligence architecture survived the collapse of the Soviet state by outsourcing its operations to its most loyal clients.

May 1995

There is a glaring chronological dissonance in the record. The report is dated May 1, 1995. By this date, the Soviet Union had been dead for nearly four years. The KGB had been dissolved and split into successor agencies. Yet, the Army continues to name the KGB as the active threat actor.

This is not a clerical error. If the shape of this file is what it appears to be, the Army obfuscated the transition of the KGB into its successors to maintain a simplified threat model. By continuing to use the label "KGB," the National Ground Intelligence Center could rely on a pre-existing, well-understood framework of Soviet aggression. Admitting that the threat had evolved into new, fragmented Russian agencies would have required a new analysis and, more importantly, a new set of justifications for the Army's technical countermeasures.

Furthermore, the report is titled "Nonlethal Technologies - Worldwide." However, the actors listed are exclusively from the former Eastern Bloc and its Caribbean satellite. The pattern suggests that "Worldwide" is a legacy label. The Army was still viewing the digital landscape through a Cold War lens, ignoring emerging threats from other regions to focus on the ghosts of a fallen empire.

The Noforn Gap

The most telling part of the record is what it does not say. While the report identifies the actors—the KGB and Cuban intelligence—and their methods—electronic intrusion and malicious software—it remains silent on the specific vulnerabilities within U.S. systems that allowed these intrusions to occur.

This gap is the logic of the "Noforn" (No Foreign Nationals) classification. The Army did not just want to keep the Russians and Cubans from seeing the report; it wanted to keep its own allies from seeing where the American digital fence had holes. The desk's reading is that the document suppresses specific system vulnerabilities to prevent the report from becoming a roadmap for any other actor. The Army reported the threat, but it buried the failure.

This creates a closed loop of information. The National Ground Intelligence Center documents the penetration, the Army labels it a "nonlethal technology," and the classification ensures that the specific technical failures are never scrutinized by outside eyes. The result is a system where the threat is acknowledged, but the vulnerability is protected as a state secret.

If a full release of the original pages were to occur, it would not show a sophisticated war of equal powers. It would show a series of embarrassingly simple entries—unpatched ports and default passwords—that the KGB and its Cuban proxies exploited to move through U.S. networks with ease. The still-withheld pages are not protecting the methods of the enemy; they are protecting the incompetence of the defenders.

The desk's reading is that the transition of cyber-intrusion from an intelligence matter to a "nonlethal technology" matter was a calculated move to shift the cost of failure. When a spy penetrates a system, it is a failure of counterintelligence. When a "nonlethal technology" penetrates a system, it is a failure of equipment. The Army chose the latter because equipment can be upgraded with a new contract. The cost of this semantic shift was paid in security; the government stopped treating the breach as a betrayal of trust and started treating it as a hardware deficiency. The vulnerability remained, the budget grew, and the door stayed open.

Havana and the KGB's 1995 Malware Campaign

Nonlethal Toolkits

The Havana Proxy

May 1995

The Noforn Gap

Sources