UNCLASSIFIED // FOR PUBLIC RELEASE▸ INTELLIGENCE BRIEFING ACTIVESPYWITNESS NEWS
INTELLIGENCE REPORT
SPYWITNESS
NEWS & ANALYSIS
ESTABLISHED 2023
▌ LIVE INTELLIGENCE FEED
▌ LATEST INTELLIGENCETHURSDAY, 9 JULY 2026
Master Spy List
▌ INTELLIGENCE BRIEF

Trump-Ordered Master Spy List Sparks Revolt Inside CIA, FBI

◆ MODERATEIntelligence Community8 JUL 2026

The White House has directed US intelligence agencies to compile a consolidated master list of suspected foreign spies and recruitment targets, and senior CIA and FBI counterintelligence officials are resisting the order over fears it would create a single point of catastrophic compromise.

The White House has directed US intelligence agencies to compile a consolidated master list of suspected foreign spies and recruitment targets, and senior CIA and FBI counterintelligence officials are resisting the order over fears it would create a single point of catastrophic compromise.

ALSO FILED
▌ INTELLIGENCE BRIEF

China's UAT-7810 Expands Covert Router Proxy Network With LONGLEASH

Cisco Talos has documented China-linked actor UAT-7810 actively expanding the LapDogs Operational Relay Box network with new LONGLEASH, DOGLEASH, and JARLEASH malware, hijacking unpatched Ruckus and ASUS routers to build covert proxy infrastructure later used by secondary actors against Taiwanese critical infrastructure.

◆ HIGH CONFIDENCECyber and Information Warfare
▌ INTELLIGENCE BRIEF

AI Agent Ransomware JADEPUFFER Ran Full Attack Chain Solo

Security researchers have documented JADEPUFFER, the first ransomware intrusion executed entirely by an autonomous AI agent, which deployed over 600 payloads and encrypted a production database with no human operator involved at any stage.

◆ HIGH CONFIDENCECyber and Information Warfare
INTELLIGENCE ARCHIVE
▌ INTELLIGENCE BRIEF

China's UAT-7810 Expands Covert Router Proxy Network With LONGLEASH

Cisco Talos has documented China-linked actor UAT-7810 actively expanding the LapDogs Operational Relay Box network with new LONGLEASH, DOGLEASH, and JARLEASH malware, hijacking unpatched Ruckus and ASUS routers to build covert proxy infrastructure later used by secondary actors against Taiwanese critical infrastructure.

◆ HIGH CONFIDENCECyber and Information Warfare
▌ INTELLIGENCE BRIEF

AI Agent Ransomware JADEPUFFER Ran Full Attack Chain Solo

Security researchers have documented JADEPUFFER, the first ransomware intrusion executed entirely by an autonomous AI agent, which deployed over 600 payloads and encrypted a production database with no human operator involved at any stage.

◆ HIGH CONFIDENCECyber and Information Warfare
▌ INTELLIGENCE BRIEF

Hormuz Ceasefire Collapses as Iran Strikes Bahrain, Kuwait

The US-Iran ceasefire has effectively collapsed after tanker attacks in the Strait of Hormuz drew retaliatory US strikes on more than 80 Iranian targets and an IRGC missile-and-drone response against American and allied positions in Bahrain and Kuwait, raising the probability of a wider Gulf war.

◆ HIGH CONFIDENCEConflict and War
▌ INTELLIGENCE BRIEF

DHS Confirms Breach of Network Guarding World Cup Security

The Department of Homeland Security has confirmed hackers breached the Homeland Security Information Network, the platform coordinating security for the 2026 World Cup across sixteen host cities, and has not yet identified the intrusion's source or the scope of any data exfiltrated.

◆ MODERATECyber and Information Warfare
▌ INTELLIGENCE BRIEF

Ukraine Strikes Russian Oil Terminal, Naval Base Ahead of NATO Summit

Ukraine's coordinated strikes on Russia's St. Petersburg oil terminal and Kronstadt naval base, days before a NATO summit expected to pledge $80 billion in aid, signal Kyiv is escalating economic and military pressure on Moscow even as Washington pushes both sides toward ceasefire talks.

◆ MODERATEConflict and War
▌ INTELLIGENCE BRIEF

Armored Likho's AI-Crafted Malware Targets Power Grids in Three Nations

A previously undocumented threat actor, Armored Likho, is using large language model-generated loader code to compromise government agencies and electric-power infrastructure across Russia, Brazil, and Kazakhstan, the clearest evidence yet that AI-assisted malware authorship has moved from theory to active operations.

◆ HIGH CONFIDENCECyber and Information Warfare7 JUL 2026
▌ INTELLIGENCE BRIEF

DHS Confirms Breach of Key Intelligence-Sharing Network

Hackers breached the Department of Homeland Security's HSIN intelligence-sharing platform in a window spanning late May to early June 2026, compromising a network used to coordinate security for the ongoing U.S.-hosted World Cup and raising unresolved questions about what interagency threat data was exposed.

◆ MODERATECyber and Information Warfare4 JUL 2026
▌ INTELLIGENCE BRIEF

ToddyCat's Umbrij Tool Hijacks Gmail Through Stolen OAuth Tokens

Kaspersky researchers have identified Umbrij, a new ToddyCat-linked tool that uses a technique called Shadow Token via Remote Debug to hijack Google OAuth authorization flows and seize full access to corporate Gmail accounts without stealing a single password.

◆ HIGH CONFIDENCECyber and Information Warfare4 JUL 2026
▌ INTELLIGENCE BRIEF

Shadow Fleet as Weapons Platform: IISS Confirms Russia's Drone War Over NATO Europe

IISS assesses with high confidence that Russia's shadow fleet served as launch infrastructure for 144 drone sorties over NATO Europe, targeting nuclear storage sites, SSBN bases, and critical infrastructure across 13 states.

◆ HIGH CONFIDENCESecurity and Defence4 JUL 2026