UNCLASSIFIED // FOR PUBLIC RELEASE▸ INTELLIGENCE BRIEFING ACTIVESPYWITNESS NEWS
INTELLIGENCE REPORT
SPYWITNESS
NEWS & ANALYSIS
ESTABLISHED 2023
▌ LIVE INTELLIGENCE FEED
▌ LATEST INTELLIGENCESUNDAY, 5 JULY 2026
Sharing Intelligence Network Breached
▌ INTELLIGENCE BRIEF

DHS Confirms Breach of Key Intelligence-Sharing Network

◆ MODERATECyber and Information Warfare4 JUL 2026

Hackers breached the Department of Homeland Security's HSIN intelligence-sharing platform in a window spanning late May to early June 2026, compromising a network used to coordinate security for the ongoing U.S.-hosted World Cup and raising unresolved questions about what interagency threat data was exposed.

Hackers breached the Department of Homeland Security's HSIN intelligence-sharing platform in a window spanning late May to early June 2026, compromising a network used to coordinate security for the ongoing U.S.-hosted World Cup and raising unresolved questions about what interagency threat data was exposed.

ALSO FILED
▌ INTELLIGENCE BRIEF

Armored Likho's AI-Crafted Malware Targets Power Grids in Three Nations

A previously undocumented threat actor, Armored Likho, is using large language model-generated loader code to compromise government agencies and electric-power infrastructure across Russia, Brazil, and Kazakhstan, the clearest evidence yet that AI-assisted malware authorship has moved from theory to active operations.

◆ HIGH CONFIDENCECyber and Information Warfare
▌ INTELLIGENCE BRIEF

IISS Report Ties Russian Shadow Fleet to 144 NATO Drone Incursions

A new IISS assessment concludes it is highly likely that Russia used shadow-fleet vessels operating from international waters to launch a systematic drone reconnaissance campaign against NATO military, nuclear, and critical-infrastructure sites between August 2024 and February 2026, though no government has yet produced forensic evidence tying a specific drone to a specific vessel.

◆ MODERATESecurity and Defence
INTELLIGENCE ARCHIVE
▌ INTELLIGENCE BRIEF

Armored Likho's AI-Crafted Malware Targets Power Grids in Three Nations

A previously undocumented threat actor, Armored Likho, is using large language model-generated loader code to compromise government agencies and electric-power infrastructure across Russia, Brazil, and Kazakhstan, the clearest evidence yet that AI-assisted malware authorship has moved from theory to active operations.

◆ HIGH CONFIDENCECyber and Information Warfare
▌ INTELLIGENCE BRIEF

IISS Report Ties Russian Shadow Fleet to 144 NATO Drone Incursions

A new IISS assessment concludes it is highly likely that Russia used shadow-fleet vessels operating from international waters to launch a systematic drone reconnaissance campaign against NATO military, nuclear, and critical-infrastructure sites between August 2024 and February 2026, though no government has yet produced forensic evidence tying a specific drone to a specific vessel.

◆ MODERATESecurity and Defence
▌ INTELLIGENCE BRIEF

ToddyCat's Umbrij Tool Hijacks Gmail Through Stolen OAuth Tokens

Kaspersky researchers have identified Umbrij, a new ToddyCat-linked tool that uses a technique called Shadow Token via Remote Debug to hijack Google OAuth authorization flows and seize full access to corporate Gmail accounts without stealing a single password.

◆ HIGH CONFIDENCECyber and Information Warfare4 JUL 2026
▌ INTELLIGENCE BRIEF

Shadow Fleet as Weapons Platform: IISS Confirms Russia's Drone War Over NATO Europe

IISS assesses with high confidence that Russia's shadow fleet served as launch infrastructure for 144 drone sorties over NATO Europe, targeting nuclear storage sites, SSBN bases, and critical infrastructure across 13 states.

◆ HIGH CONFIDENCESecurity and Defence4 JUL 2026
▌ INTELLIGENCE BRIEF

CIA and FBI Refuse White House Demand for Centralized Foreign Spy Registry

The CIA and FBI are defying a White House and ODNI directive to compile a centralized master registry of all known foreign intelligence operatives, citing catastrophic operational security risks if such a list were ever compromised.

◆ HIGH CONFIDENCEIntelligence Community4 JUL 2026
▌ INTELLIGENCE BRIEF

Divided House: DIA and CIA Split on Iran Nuclear Strike Damage as Doha Talks Resume

Contradictory DIA and CIA assessments of US strike effectiveness on Iran's nuclear programme have exposed a structural intelligence dispute at the moment most consequential to ongoing ceasefire negotiations.

◆ MODERATEIntelligence Community4 JUL 2026
▌ INTELLIGENCE BRIEF

CIA and FBI Resist White House Order to Build Master Spy Registry

A White House directive to build a centralised master list of all foreign intelligence operatives has triggered open institutional resistance from the CIA and FBI, who warn the repository would constitute an unprecedented single point of failure in US counterintelligence history.

◆ HIGH CONFIDENCEIntelligence Community3 JUL 2026
▌ INTELLIGENCE BRIEF

Inside the Pipeline: How China Is Secretly Training Russia's Army

Classified Russian documents confirm Defence Minister Belousov personally authorised covert military training for approximately 200 Russian troops at People's Liberation Army facilities in Beijing and Nanjing, covering drones, electronic warfare, and radiological, biological, and chemical warfare tactics.

◆ HIGH CONFIDENCECovert Operations3 JUL 2026
▌ INTELLIGENCE BRIEF

Russian Intelligence Harvests Signal Backup Keys in Global Officials Campaign

Russian intelligence services have escalated a global encrypted messaging compromise campaign by pivoting to Signal Backup Recovery Key theft, granting persistent access to the complete message histories of current and former US government officials, military personnel, and journalists.

◆ HIGH CONFIDENCECyber and Information Warfare2 JUL 2026