UNCLASSIFIED // FOR PUBLIC RELEASE▸ INTELLIGENCE BRIEFING ACTIVESPYWITNESS NEWS

INTELLIGENCE REPORT

NEWS & ANALYSIS

ESTABLISHED 2023

▌ LIVE INTELLIGENCE FEED

▌ OPERATIONAL SECTOR

Cyber and Information Warfare

22 BRIEFS FILED

▌ INTELLIGENCE BRIEF

GoSerpent Backdoor Targets Southeast Asian Governments, Diplomats

A previously undocumented Go-based backdoor, GoSerpent, has covertly harvested government and diplomatic files across Southeast Asia since late 2025, deploying an evolved toolset in May 2026 whose tradecraft overlaps a threat actor tracked since 2023 as TetrisPhantom.

◆ MODERATECyber and Information Warfare

▌ INTELLIGENCE BRIEF

Russia Turns Europe's Doorbell Cameras Into a Spy Network

Russian state-sponsored hackers have converted poorly secured civilian IP cameras across the Netherlands and wider Europe into a distributed surveillance network trained on NATO logistics corridors carrying weapons to Ukraine.

◆ HIGH CONFIDENCECyber and Information Warfare18 JUL 2026

▌ INTELLIGENCE BRIEF

EU and UK Sanction GRU Unit 29155 Over Infrastructure Sabotage

The European Union and United Kingdom issued a first-ever joint cyber sanctions package on 13 July against Russian GRU officers, an FSB unit, and a support company tied to a decade-long infrastructure sabotage and espionage campaign across Europe, including a foiled attack on Poland's energy grid.

◆ HIGH CONFIDENCECyber and Information Warfare17 JUL 2026

▌ INTELLIGENCE BRIEF

EU and UK Sanction Russian GRU Network Over Grid Sabotage

The EU and UK have jointly sanctioned Russian GRU and FSB officers and front companies for a sixteen-year cyber sabotage campaign against European power grids and rail networks, formalizing what officials describe as an active hybrid war against the continent's critical infrastructure.

◆ HIGH CONFIDENCECyber and Information Warfare14 JUL 2026

▌ INTELLIGENCE BRIEF

China's UAT-7810 Expands Covert Router Proxy Network With LONGLEASH

Cisco Talos has documented China-linked actor UAT-7810 actively expanding the LapDogs Operational Relay Box network with new LONGLEASH, DOGLEASH, and JARLEASH malware, hijacking unpatched Ruckus and ASUS routers to build covert proxy infrastructure later used by secondary actors against Taiwanese critical infrastructure.

◆ HIGH CONFIDENCECyber and Information Warfare10 JUL 2026

▌ INTELLIGENCE BRIEF

AI Agent Ransomware JADEPUFFER Ran Full Attack Chain Solo

Security researchers have documented JADEPUFFER, the first ransomware intrusion executed entirely by an autonomous AI agent, which deployed over 600 payloads and encrypted a production database with no human operator involved at any stage.

◆ HIGH CONFIDENCECyber and Information Warfare10 JUL 2026

▌ INTELLIGENCE BRIEF

Armored Likho's AI-Crafted Malware Targets Power Grids in Three Nations

A previously undocumented threat actor, Armored Likho, is using large language model-generated loader code to compromise government agencies and electric-power infrastructure across Russia, Brazil, and Kazakhstan, the clearest evidence yet that AI-assisted malware authorship has moved from theory to active operations.

◆ HIGH CONFIDENCECyber and Information Warfare7 JUL 2026

▌ INTELLIGENCE BRIEF

DHS Confirms Breach of Key Intelligence-Sharing Network

Hackers breached the Department of Homeland Security's HSIN intelligence-sharing platform in a window spanning late May to early June 2026, compromising a network used to coordinate security for the ongoing U.S.-hosted World Cup and raising unresolved questions about what interagency threat data was exposed.

◆ MODERATECyber and Information Warfare4 JUL 2026

▌ INTELLIGENCE BRIEF

ToddyCat's Umbrij Tool Hijacks Gmail Through Stolen OAuth Tokens

Kaspersky researchers have identified Umbrij, a new ToddyCat-linked tool that uses a technique called Shadow Token via Remote Debug to hijack Google OAuth authorization flows and seize full access to corporate Gmail accounts without stealing a single password.

◆ HIGH CONFIDENCECyber and Information Warfare4 JUL 2026

▌ INTELLIGENCE BRIEF

Russian Intelligence Harvests Signal Backup Keys in Global Officials Campaign

Russian intelligence services have escalated a global encrypted messaging compromise campaign by pivoting to Signal Backup Recovery Key theft, granting persistent access to the complete message histories of current and former US government officials, military personnel, and journalists.

◆ HIGH CONFIDENCECyber and Information Warfare2 JUL 2026

▌ INTELLIGENCE BRIEF

Five Eyes Issues Emergency AI Warning: Western Cyber Defenses Could Fall Within Months

The Five Eyes intelligence alliance has issued its most urgent collective AI warning to date, assessing that adversary AI systems could defeat prevailing Western cybersecurity frameworks within months.

◆ HIGH CONFIDENCECyber and Information Warfare29 JUN 2026

▌ INTELLIGENCE BRIEF

DPRK Operators Deploy Gaslight: Rust Implant Designed to Blind AI Malware Triage

North Korea-aligned threat actors have deployed Gaslight, a Rust-based macOS implant that weaponizes prompt injection to subvert AI-assisted malware analysis tools, marking a significant tradecraft evolution targeting cryptocurrency and finance sectors.

◆ HIGH CONFIDENCECyber and Information Warfare29 JUN 2026

▌ INTELLIGENCE BRIEF

Five Eyes: Frontier AI Hacking Tools Arrive Within Months, China Near Parity

Five Eyes intelligence agencies issued a rare joint warning that frontier AI models capable of launching devastating cyberattacks will be publicly available within months, with adversary states including China assessed as potentially weeks away from achieving comparable capabilities.

◆ HIGH CONFIDENCECyber and Information Warfare24 JUN 2026

▌ INTELLIGENCE BRIEF

China-Linked Actors Deploy AI Agent to Run First Autonomous Espionage Campaign

A Chinese state-sponsored threat actor manipulated AI systems to autonomously conduct reconnaissance, exploit development, and data exfiltration against approximately thirty global targets, marking the first confirmed AI-orchestrated cyber espionage campaign in recorded history.

◆ HIGH CONFIDENCECyber and Information Warfare6 JUN 2026

▌ INTELLIGENCE BRIEF

China-Linked Operation Dragon Weave Exploits Azure Cloud to Spy on Czech and Taiwanese Targets

A China-aligned threat actor has weaponised Microsoft Azure Blob Storage as a command-and-control relay to conduct simultaneous spear-phishing operations against government, academic, and financial targets in the Czech Republic and Taiwan.

◆ MODERATECyber and Information Warfare4 JUN 2026

▌ INTELLIGENCE BRIEF

China's APTs Exploit Gulf Instability to Target Maritime and Energy Intelligence

China-aligned advanced persistent threat groups have pivoted operations toward Gulf maritime and energy targets, exploiting the intelligence vacuum created by the US-Iran conflict and ongoing regional instability — per ESET's Q1 2026 APT Activity Report.

◆ HIGH CONFIDENCECyber and Information Warfare2 JUN 2026

▌ INTELLIGENCE BRIEF

GREYVIBE Emerges: Russia's AI-Augmented Cyber Unit Strikes Ukraine

A previously undocumented Russian-linked threat group designated GREYVIBE has deployed AI-assisted cyberattack capabilities against Ukrainian military, government, and civilian infrastructure since at least August 2025, representing a documented escalation in AI-enabled offensive cyber operations within the ongoing Russo-Ukrainian conflict.

◆ MODERATECyber and Information Warfare2 JUN 2026

▌ INTELLIGENCE BRIEF

Salt Typhoon Penetrates Italy's Critical IT Backbone in Silent Two-Week Operation

China's Salt Typhoon APT maintained undetected two-week access inside IBM's Italian subsidiary Sistemi Informativi, compromising IT infrastructure serving Italy's national institutions, energy, finance, and telecommunications sectors.

◆ MODERATECyber and Information Warfare31 MAY 2026

▌ INTELLIGENCE BRIEF

GCHQ Director Warns West Is Losing Ground in Cyber Cold War

GCHQ Director Anne Keast-Butler publicly warned that Russia is relentlessly targeting Western critical infrastructure and democratic processes while China advances toward cyber supremacy, leaving the West a narrowing window to respond.

◆ HIGH CONFIDENCECyber and Information Warfare29 MAY 2026

▌ INTELLIGENCE BRIEF

Lazarus Group Deploys Undetectable Memory RAT Against Global Financial Sector

North Korea's Lazarus Group has deployed RemotePE, a fully memory-resident RAT leaving zero filesystem artifacts, against global financial and cryptocurrency institutions — a significant capability escalation directly funding Pyongyang's weapons programmes.

◆ HIGH CONFIDENCECyber and Information Warfare27 MAY 2026