SpyWitness News — Intelligence & Global Security

▌ LATEST INTELLIGENCEFRIDAY, 10 JULY 2026

Israel Warns US of New Iranian Plot to Kill Trump

◆ MODERATEIntelligence Community10 JUL 2026

Israel has shared unverified intelligence with Washington warning of a new Iranian plot to assassinate President Trump, a disclosure surfacing amid an open rift between Trump and Netanyahu over how to handle post-war Iran.

ALSO FILED

▌ INTELLIGENCE BRIEF

Iran-US Truce Collapses as IRGC Strikes Gulf Bases

IRGC strikes on four U.S. bases in Kuwait and Bahrain have effectively collapsed the June ceasefire with Iran, following renewed U.S. airstrikes and Iranian attacks on Strait of Hormuz shipping.

◆ HIGH CONFIDENCEConflict and War10 JUL 2026

▌ INTELLIGENCE BRIEF

China's UAT-7810 Expands Covert Router Proxy Network With LONGLEASH

Cisco Talos has documented China-linked actor UAT-7810 actively expanding the LapDogs Operational Relay Box network with new LONGLEASH, DOGLEASH, and JARLEASH malware, hijacking unpatched Ruckus and ASUS routers to build covert proxy infrastructure later used by secondary actors against Taiwanese critical infrastructure.

◆ HIGH CONFIDENCECyber and Information Warfare10 JUL 2026

INTELLIGENCE ARCHIVE

▌ INTELLIGENCE BRIEF

Iran-US Truce Collapses as IRGC Strikes Gulf Bases

IRGC strikes on four U.S. bases in Kuwait and Bahrain have effectively collapsed the June ceasefire with Iran, following renewed U.S. airstrikes and Iranian attacks on Strait of Hormuz shipping.

◆ HIGH CONFIDENCEConflict and War10 JUL 2026

▌ INTELLIGENCE BRIEF

China's UAT-7810 Expands Covert Router Proxy Network With LONGLEASH

◆ HIGH CONFIDENCECyber and Information Warfare10 JUL 2026

▌ INTELLIGENCE BRIEF

AI Agent Ransomware JADEPUFFER Ran Full Attack Chain Solo

Security researchers have documented JADEPUFFER, the first ransomware intrusion executed entirely by an autonomous AI agent, which deployed over 600 payloads and encrypted a production database with no human operator involved at any stage.

◆ HIGH CONFIDENCECyber and Information Warfare10 JUL 2026

▌ INTELLIGENCE BRIEF

Hormuz Ceasefire Collapses as Iran Strikes Bahrain, Kuwait

The US-Iran ceasefire has effectively collapsed after tanker attacks in the Strait of Hormuz drew retaliatory US strikes on more than 80 Iranian targets and an IRGC missile-and-drone response against American and allied positions in Bahrain and Kuwait, raising the probability of a wider Gulf war.

◆ HIGH CONFIDENCEConflict and War10 JUL 2026

▌ INTELLIGENCE BRIEF

Trump-Ordered Master Spy List Sparks Revolt Inside CIA, FBI

The White House has directed US intelligence agencies to compile a consolidated master list of suspected foreign spies and recruitment targets, and senior CIA and FBI counterintelligence officials are resisting the order over fears it would create a single point of catastrophic compromise.

◆ MODERATEIntelligence Community8 JUL 2026

▌ INTELLIGENCE BRIEF

Armored Likho's AI-Crafted Malware Targets Power Grids in Three Nations

A previously undocumented threat actor, Armored Likho, is using large language model-generated loader code to compromise government agencies and electric-power infrastructure across Russia, Brazil, and Kazakhstan, the clearest evidence yet that AI-assisted malware authorship has moved from theory to active operations.

◆ HIGH CONFIDENCECyber and Information Warfare7 JUL 2026

▌ INTELLIGENCE BRIEF

DHS Confirms Breach of Key Intelligence-Sharing Network

Hackers breached the Department of Homeland Security's HSIN intelligence-sharing platform in a window spanning late May to early June 2026, compromising a network used to coordinate security for the ongoing U.S.-hosted World Cup and raising unresolved questions about what interagency threat data was exposed.

◆ MODERATECyber and Information Warfare4 JUL 2026

▌ INTELLIGENCE BRIEF

ToddyCat's Umbrij Tool Hijacks Gmail Through Stolen OAuth Tokens

Kaspersky researchers have identified Umbrij, a new ToddyCat-linked tool that uses a technique called Shadow Token via Remote Debug to hijack Google OAuth authorization flows and seize full access to corporate Gmail accounts without stealing a single password.

◆ HIGH CONFIDENCECyber and Information Warfare4 JUL 2026

▌ INTELLIGENCE BRIEF

Shadow Fleet as Weapons Platform: IISS Confirms Russia's Drone War Over NATO Europe

IISS assesses with high confidence that Russia's shadow fleet served as launch infrastructure for 144 drone sorties over NATO Europe, targeting nuclear storage sites, SSBN bases, and critical infrastructure across 13 states.

◆ HIGH CONFIDENCESecurity and Defence4 JUL 2026