UNCLASSIFIED // FOR PUBLIC RELEASE▸ INTELLIGENCE BRIEFING ACTIVESPYWITNESS NEWS
INTELLIGENCE REPORT
SPYWITNESS
NEWS & ANALYSIS
ESTABLISHED 2023
▌ LIVE INTELLIGENCE FEED
▌ LATEST INTELLIGENCETUESDAY, 7 JULY 2026
Sharing Intelligence Network Breached
▌ INTELLIGENCE BRIEF

DHS Confirms Breach of Key Intelligence-Sharing Network

◆ MODERATECyber and Information Warfare4 JUL 2026

Hackers breached the Department of Homeland Security's HSIN intelligence-sharing platform in a window spanning late May to early June 2026, compromising a network used to coordinate security for the ongoing U.S.-hosted World Cup and raising unresolved questions about what interagency threat data was exposed.

Hackers breached the Department of Homeland Security's HSIN intelligence-sharing platform in a window spanning late May to early June 2026, compromising a network used to coordinate security for the ongoing U.S.-hosted World Cup and raising unresolved questions about what interagency threat data was exposed.

ALSO FILED
▌ INTELLIGENCE BRIEF

Trump-Ordered Master Spy List Sparks Revolt Inside CIA, FBI

The White House has directed US intelligence agencies to compile a consolidated master list of suspected foreign spies and recruitment targets, and senior CIA and FBI counterintelligence officials are resisting the order over fears it would create a single point of catastrophic compromise.

◆ MODERATEIntelligence Community
▌ INTELLIGENCE BRIEF

Ukraine Strikes Russian Oil Terminal, Naval Base Ahead of NATO Summit

Ukraine's coordinated strikes on Russia's St. Petersburg oil terminal and Kronstadt naval base, days before a NATO summit expected to pledge $80 billion in aid, signal Kyiv is escalating economic and military pressure on Moscow even as Washington pushes both sides toward ceasefire talks.

◆ MODERATEConflict and War
INTELLIGENCE ARCHIVE
▌ INTELLIGENCE BRIEF

Trump-Ordered Master Spy List Sparks Revolt Inside CIA, FBI

The White House has directed US intelligence agencies to compile a consolidated master list of suspected foreign spies and recruitment targets, and senior CIA and FBI counterintelligence officials are resisting the order over fears it would create a single point of catastrophic compromise.

◆ MODERATEIntelligence Community
▌ INTELLIGENCE BRIEF

Ukraine Strikes Russian Oil Terminal, Naval Base Ahead of NATO Summit

Ukraine's coordinated strikes on Russia's St. Petersburg oil terminal and Kronstadt naval base, days before a NATO summit expected to pledge $80 billion in aid, signal Kyiv is escalating economic and military pressure on Moscow even as Washington pushes both sides toward ceasefire talks.

◆ MODERATEConflict and War
▌ INTELLIGENCE BRIEF

DHS Confirms Weeks-Long Breach of World Cup Security Network

Hackers maintained undetected access to the Homeland Security Information Network — the platform coordinating World Cup 2026 security across federal, state, and international partners — for several weeks before DHS disclosed the intrusion on 1 July.

◆ MODERATECyber and Information Warfare
▌ INTELLIGENCE BRIEF

Iran's Absent Heir Deepens Succession Crisis Amid State Funeral

Iran's new Supreme Leader Mojtaba Khamenei has not appeared publicly in four months, stalling US-Iran technical talks and exposing an unresolved legitimacy contest inside Tehran's clerical-military power structure.

◆ MODERATEGeopolitical Analysis
▌ INTELLIGENCE BRIEF

Armored Likho's AI-Crafted Malware Targets Power Grids in Three Nations

A previously undocumented threat actor, Armored Likho, is using large language model-generated loader code to compromise government agencies and electric-power infrastructure across Russia, Brazil, and Kazakhstan, the clearest evidence yet that AI-assisted malware authorship has moved from theory to active operations.

◆ HIGH CONFIDENCECyber and Information Warfare
▌ INTELLIGENCE BRIEF

IISS Report Ties Russian Shadow Fleet to 144 NATO Drone Incursions

A new IISS assessment concludes it is highly likely that Russia used shadow-fleet vessels operating from international waters to launch a systematic drone reconnaissance campaign against NATO military, nuclear, and critical-infrastructure sites between August 2024 and February 2026, though no government has yet produced forensic evidence tying a specific drone to a specific vessel.

◆ MODERATESecurity and Defence
▌ INTELLIGENCE BRIEF

ToddyCat's Umbrij Tool Hijacks Gmail Through Stolen OAuth Tokens

Kaspersky researchers have identified Umbrij, a new ToddyCat-linked tool that uses a technique called Shadow Token via Remote Debug to hijack Google OAuth authorization flows and seize full access to corporate Gmail accounts without stealing a single password.

◆ HIGH CONFIDENCECyber and Information Warfare4 JUL 2026
▌ INTELLIGENCE BRIEF

Shadow Fleet as Weapons Platform: IISS Confirms Russia's Drone War Over NATO Europe

IISS assesses with high confidence that Russia's shadow fleet served as launch infrastructure for 144 drone sorties over NATO Europe, targeting nuclear storage sites, SSBN bases, and critical infrastructure across 13 states.

◆ HIGH CONFIDENCESecurity and Defence4 JUL 2026
▌ INTELLIGENCE BRIEF

CIA and FBI Refuse White House Demand for Centralized Foreign Spy Registry

The CIA and FBI are defying a White House and ODNI directive to compile a centralized master registry of all known foreign intelligence operatives, citing catastrophic operational security risks if such a list were ever compromised.

◆ HIGH CONFIDENCEIntelligence Community4 JUL 2026