# Daily Intelligence Briefing — Sunday, July 5, 2026

> On 2026-07-05, Threadlinqs published 19 new threat reports and updated 11, 10 rated critical and 15 high, spanning 253 MITRE ATT&CK techniques and 12 named threat actors. Coverage that day added 270 new detection rules and 865 extracted indicators.

- **Edition:** 2026-07-05 (Sunday)
- **Canonical:** https://intel.threadlinqs.com/debrief/2026-07-05
- **Last updated:** 2026-07-11
- **New threats:** 19 (11 updated)
- **Critical / high:** 10 critical, 15 high, 3 medium, 0 low
- **ATT&CK techniques:** 253
- **Threat actors:** 12
- **Indicators (count only):** 865
- **New detection rules (count only):** 270

## Summary & highlights

Browser-Only Ransomware (InfernoGrabber v9.0) Abuses Chrome File System Access API to Encrypt Android Photos. AI-Generated Browser-Only Ransomware Abuses Chrome File System Access API (InfernoGrabber 9000 / DeepSeek). Nebula — AI-Integrated Open-Source Penetration Testing Tool (BerylliumSec) — Dual-Use Tool Tracking, No CVE/Active Exploitation.

- [TL-2026-1104](https://intel.threadlinqs.com/threat/TL-2026-1104) — PamStealer: Rust-Based macOS Infostealer Masquerades as Maccy Clipboard Manager, Validates Stolen Passwords via PAM
- [TL-2026-1105](https://intel.threadlinqs.com/threat/TL-2026-1105) — Bad Epoll (CVE-2026-46242): Use-After-Free Zero-Day in Linux Kernel epoll Subsystem Enables Root Privilege Escalation
- [TL-2026-1106](https://intel.threadlinqs.com/threat/TL-2026-1106) — "Bad Epoll" Linux Kernel Use-After-Free (CVE-2026-46242) Enables Unprivileged Root Escalation, Impacts Android
- [TL-2026-1107](https://intel.threadlinqs.com/threat/TL-2026-1107) — ARToken PhaaS Platform Exposes EvilTokens-Affiliated Microsoft 365 Device Code Phishing Toolkit
- [TL-2026-1111](https://intel.threadlinqs.com/threat/TL-2026-1111) — North Korea-Linked "Contagious Interview"/Famous Chollima Actors Hide JavaScript Loaders (PolinRider) in Open-Source Packages

## Theme of the day

defense-evasion, credential-theft, social-engineering, data-exfiltration, financially-motivated

## Threats published

- [TL-2026-1110](https://intel.threadlinqs.com/threat/TL-2026-1110) — CRITICAL — Pegasus Spyware Used Against Former MEP Stelios Kouloglou While Serving on PEGA Committee
- [TL-2026-1117](https://intel.threadlinqs.com/threat/TL-2026-1117) — CRITICAL — JADEPUFFER: AI Agent Exploits Langflow RCE (CVE-2025-3248) to Automate Database Ransomware/Extortion Attack
- [TL-2026-1118](https://intel.threadlinqs.com/threat/TL-2026-1118) — CRITICAL — FortiBleed Credential Theft Campaign Linked to INC and Lynx Ransomware Operations
- [TL-2026-1122](https://intel.threadlinqs.com/threat/TL-2026-1122) — CRITICAL — SimpleHelp Authentication Bypass via Forged OIDC Tokens (CVE-2026-48558) Actively Exploited, Added to CISA KEV
- [TL-2026-1132](https://intel.threadlinqs.com/threat/TL-2026-1132) — CRITICAL — CVE-2026-8037: Pre-Authentication Remote Code Execution in Progress Kemp LoadMaster via escape_quotes() Heap Out-of-Bounds Read
- [TL-2026-1103](https://intel.threadlinqs.com/threat/TL-2026-1103) — CRITICAL — CVE-2026-20253: Critical Unauthenticated Remote Code Execution in Splunk Enterprise via PostgreSQL Sidecar Service (update)
- [TL-2026-1116](https://intel.threadlinqs.com/threat/TL-2026-1116) — CRITICAL — JADEPUFFER Agentic Ransomware Exploits Langflow CVE-2025-3248 and Nacos CVE-2021-29441 via Base64-Encoded Python Payloads (update)
- [TL-2026-1120](https://intel.threadlinqs.com/threat/TL-2026-1120) — CRITICAL — PolinRider: North Korea-Linked Supply Chain Campaign Expands Across npm, Packagist, Go Modules, and Chrome Extensions (update)
- [TL-2026-1123](https://intel.threadlinqs.com/threat/TL-2026-1123) — CRITICAL — CISA KEV Addition: Microsoft SharePoint Server Deserialization RCE (CVE-2026-45659) Actively Exploited by Storm-2603 / Warlock Ransomware (update)
- [TL-2026-1124](https://intel.threadlinqs.com/threat/TL-2026-1124) — CRITICAL — FortiBleed Credential Theft Campaign: FortigateSniffer Tool Deployed Against 430,000+ FortiGate Firewalls, Linked to INC Ransom and Lynx Ransomware (update)
- [TL-2026-1104](https://intel.threadlinqs.com/threat/TL-2026-1104) — HIGH — PamStealer: Rust-Based macOS Infostealer Masquerades as Maccy Clipboard Manager, Validates Stolen Passwords via PAM
- [TL-2026-1105](https://intel.threadlinqs.com/threat/TL-2026-1105) — HIGH — Bad Epoll (CVE-2026-46242): Use-After-Free Zero-Day in Linux Kernel epoll Subsystem Enables Root Privilege Escalation
- [TL-2026-1106](https://intel.threadlinqs.com/threat/TL-2026-1106) — HIGH — "Bad Epoll" Linux Kernel Use-After-Free (CVE-2026-46242) Enables Unprivileged Root Escalation, Impacts Android
- [TL-2026-1107](https://intel.threadlinqs.com/threat/TL-2026-1107) — HIGH — ARToken PhaaS Platform Exposes EvilTokens-Affiliated Microsoft 365 Device Code Phishing Toolkit
- [TL-2026-1111](https://intel.threadlinqs.com/threat/TL-2026-1111) — HIGH — North Korea-Linked "Contagious Interview"/Famous Chollima Actors Hide JavaScript Loaders (PolinRider) in Open-Source Packages
- [TL-2026-1113](https://intel.threadlinqs.com/threat/TL-2026-1113) — HIGH — Microsoft Exchange SSRF Vulnerability (CVE-2026-45504) — Public PoC Exploit Enables Authenticated Arbitrary File Read
- [TL-2026-1127](https://intel.threadlinqs.com/threat/TL-2026-1127) — HIGH — ClickFix Social-Engineering Technique Becomes Dominant Malware Delivery and Defense-Evasion Vector (CrashFix, FileFix, ConsentFix Variants)
- [TL-2026-1128](https://intel.threadlinqs.com/threat/TL-2026-1128) — HIGH — EvilTokens/ARToken Device-Code Phishing Kit Bypasses MFA to Compromise Microsoft 365 Accounts
- [TL-2026-1130](https://intel.threadlinqs.com/threat/TL-2026-1130) — HIGH — ClickFix / KongTuke Clipboard-Hijacking Social-Engineering Technique (MITRE T1204.004) — Fake-CAPTCHA Lures Delivering Infostealers, RATs, and Ransomware
- [TL-2026-1133](https://intel.threadlinqs.com/threat/TL-2026-1133) — HIGH — Remcos RAT: Technical Analysis of Windows Remote Access Trojan Operations
- [TL-2026-1108](https://intel.threadlinqs.com/threat/TL-2026-1108) — HIGH — Armored Likho APT Targets Government and Power Sector with New BusySnake Stealer via CVE-2025-9491 LNK Abuse (update)
- [TL-2026-1114](https://intel.threadlinqs.com/threat/TL-2026-1114) — HIGH — AsyncRAT Campaign Abuses TryCloudflare Tunnels and Python Scripts for Malware Delivery (AsyncRAT/VenomRAT/XWorm) (update)
- [TL-2026-1125](https://intel.threadlinqs.com/threat/TL-2026-1125) — HIGH — ChocoPoC: Python RAT Distributed via Trojanized PoC Exploits Targeting Security Researchers (update)
- [TL-2026-1126](https://intel.threadlinqs.com/threat/TL-2026-1126) — HIGH — Cross-Platform Phishing Campaigns Auto-Adapt Payloads to Victim Device/OS via Fingerprinting (update)
- [TL-2026-1131](https://intel.threadlinqs.com/threat/TL-2026-1131) — HIGH — GuardFall: Shell-Injection Guardrail Bypass Exposes Open-Source AI Coding Agents to Supply-Chain Attacks (update)
- [TL-2026-1119](https://intel.threadlinqs.com/threat/TL-2026-1119) — MEDIUM — Browser-Only Ransomware (InfernoGrabber v9.0) Abuses Chrome File System Access API to Encrypt Android Photos
- [TL-2026-1129](https://intel.threadlinqs.com/threat/TL-2026-1129) — MEDIUM — AI-Generated Browser-Only Ransomware Abuses Chrome File System Access API (InfernoGrabber 9000 / DeepSeek)
- [TL-2026-1115](https://intel.threadlinqs.com/threat/TL-2026-1115) — MEDIUM — Claude Cowork Sandbox Escape: RPC Parameter Bypass Enables Root Command Execution (update)
- [TL-2026-1109](https://intel.threadlinqs.com/threat/TL-2026-1109) — INFO — Nebula — AI-Integrated Open-Source Penetration Testing Tool (BerylliumSec) — Dual-Use Tool Tracking, No CVE/Active Exploitation
- [TL-2026-1121](https://intel.threadlinqs.com/threat/TL-2026-1121) — INFO — La Trobe University research: network-based detection of SMB shared-storage ransomware encryption

## Techniques observed

[T1003](https://intel.threadlinqs.com/technique/T1003), [T1003.001](https://intel.threadlinqs.com/technique/T1003.001), [T1003.008](https://intel.threadlinqs.com/technique/T1003.008), [T1005](https://intel.threadlinqs.com/technique/T1005), [T1008](https://intel.threadlinqs.com/technique/T1008), [T1014](https://intel.threadlinqs.com/technique/T1014), [T1016](https://intel.threadlinqs.com/technique/T1016), [T1018](https://intel.threadlinqs.com/technique/T1018), [T1020](https://intel.threadlinqs.com/technique/T1020), [T1021](https://intel.threadlinqs.com/technique/T1021), [T1021.001](https://intel.threadlinqs.com/technique/T1021.001), [T1021.002](https://intel.threadlinqs.com/technique/T1021.002), [T1027](https://intel.threadlinqs.com/technique/T1027), [T1027.002](https://intel.threadlinqs.com/technique/T1027.002), [T1033](https://intel.threadlinqs.com/technique/T1033), [T1036](https://intel.threadlinqs.com/technique/T1036), [T1036.003](https://intel.threadlinqs.com/technique/T1036.003), [T1036.005](https://intel.threadlinqs.com/technique/T1036.005), [T1036.008](https://intel.threadlinqs.com/technique/T1036.008), [T1037](https://intel.threadlinqs.com/technique/T1037), [T1039](https://intel.threadlinqs.com/technique/T1039), [T1040](https://intel.threadlinqs.com/technique/T1040), [T1041](https://intel.threadlinqs.com/technique/T1041), [T1046](https://intel.threadlinqs.com/technique/T1046), [T1047](https://intel.threadlinqs.com/technique/T1047), [T1048](https://intel.threadlinqs.com/technique/T1048), [T1049](https://intel.threadlinqs.com/technique/T1049), [T1053](https://intel.threadlinqs.com/technique/T1053), [T1053.003](https://intel.threadlinqs.com/technique/T1053.003), [T1053.005](https://intel.threadlinqs.com/technique/T1053.005), [T1055](https://intel.threadlinqs.com/technique/T1055), [T1055.012](https://intel.threadlinqs.com/technique/T1055.012), [T1056](https://intel.threadlinqs.com/technique/T1056), [T1056.001](https://intel.threadlinqs.com/technique/T1056.001), [T1056.002](https://intel.threadlinqs.com/technique/T1056.002), [T1057](https://intel.threadlinqs.com/technique/T1057), [T1059](https://intel.threadlinqs.com/technique/T1059), [T1059.001](https://intel.threadlinqs.com/technique/T1059.001), [T1059.002](https://intel.threadlinqs.com/technique/T1059.002), [T1059.003](https://intel.threadlinqs.com/technique/T1059.003), [T1059.004](https://intel.threadlinqs.com/technique/T1059.004), [T1059.005](https://intel.threadlinqs.com/technique/T1059.005), [T1059.006](https://intel.threadlinqs.com/technique/T1059.006), [T1059.007](https://intel.threadlinqs.com/technique/T1059.007), [T1068](https://intel.threadlinqs.com/technique/T1068), [T1069](https://intel.threadlinqs.com/technique/T1069), [T1070](https://intel.threadlinqs.com/technique/T1070), [T1070.004](https://intel.threadlinqs.com/technique/T1070.004), [T1070.006](https://intel.threadlinqs.com/technique/T1070.006), [T1071](https://intel.threadlinqs.com/technique/T1071), [T1071.001](https://intel.threadlinqs.com/technique/T1071.001), T1071.002, [T1072](https://intel.threadlinqs.com/technique/T1072), [T1074](https://intel.threadlinqs.com/technique/T1074), [T1074.001](https://intel.threadlinqs.com/technique/T1074.001), [T1078](https://intel.threadlinqs.com/technique/T1078), [T1078.001](https://intel.threadlinqs.com/technique/T1078.001), [T1082](https://intel.threadlinqs.com/technique/T1082), [T1083](https://intel.threadlinqs.com/technique/T1083), [T1087](https://intel.threadlinqs.com/technique/T1087), [T1087.001](https://intel.threadlinqs.com/technique/T1087.001), [T1087.004](https://intel.threadlinqs.com/technique/T1087.004), [T1090](https://intel.threadlinqs.com/technique/T1090), [T1090.001](https://intel.threadlinqs.com/technique/T1090.001), [T1090.002](https://intel.threadlinqs.com/technique/T1090.002), [T1090.004](https://intel.threadlinqs.com/technique/T1090.004), [T1098](https://intel.threadlinqs.com/technique/T1098), [T1102](https://intel.threadlinqs.com/technique/T1102), [T1102.001](https://intel.threadlinqs.com/technique/T1102.001), [T1102.002](https://intel.threadlinqs.com/technique/T1102.002), [T1105](https://intel.threadlinqs.com/technique/T1105), [T1106](https://intel.threadlinqs.com/technique/T1106), [T1110](https://intel.threadlinqs.com/technique/T1110), [T1110.001](https://intel.threadlinqs.com/technique/T1110.001), [T1111](https://intel.threadlinqs.com/technique/T1111), [T1112](https://intel.threadlinqs.com/technique/T1112), [T1113](https://intel.threadlinqs.com/technique/T1113), [T1114](https://intel.threadlinqs.com/technique/T1114), [T1115](https://intel.threadlinqs.com/technique/T1115), [T1119](https://intel.threadlinqs.com/technique/T1119), [T1123](https://intel.threadlinqs.com/technique/T1123), [T1125](https://intel.threadlinqs.com/technique/T1125), [T1127](https://intel.threadlinqs.com/technique/T1127), [T1129](https://intel.threadlinqs.com/technique/T1129), [T1132](https://intel.threadlinqs.com/technique/T1132), [T1132.001](https://intel.threadlinqs.com/technique/T1132.001), [T1133](https://intel.threadlinqs.com/technique/T1133), [T1136](https://intel.threadlinqs.com/technique/T1136), [T1136.001](https://intel.threadlinqs.com/technique/T1136.001), [T1137](https://intel.threadlinqs.com/technique/T1137), [T1140](https://intel.threadlinqs.com/technique/T1140), [T1176](https://intel.threadlinqs.com/technique/T1176), [T1185](https://intel.threadlinqs.com/technique/T1185), [T1187](https://intel.threadlinqs.com/technique/T1187), [T1189](https://intel.threadlinqs.com/technique/T1189), [T1190](https://intel.threadlinqs.com/technique/T1190), [T1195](https://intel.threadlinqs.com/technique/T1195), [T1195.001](https://intel.threadlinqs.com/technique/T1195.001), [T1195.002](https://intel.threadlinqs.com/technique/T1195.002), [T1199](https://intel.threadlinqs.com/technique/T1199), [T1202](https://intel.threadlinqs.com/technique/T1202), [T1203](https://intel.threadlinqs.com/technique/T1203), [T1204](https://intel.threadlinqs.com/technique/T1204), [T1204.001](https://intel.threadlinqs.com/technique/T1204.001), [T1204.002](https://intel.threadlinqs.com/technique/T1204.002), [T1204.004](https://intel.threadlinqs.com/technique/T1204.004), [T1210](https://intel.threadlinqs.com/technique/T1210), [T1211](https://intel.threadlinqs.com/technique/T1211), [T1212](https://intel.threadlinqs.com/technique/T1212), [T1213](https://intel.threadlinqs.com/technique/T1213), [T1217](https://intel.threadlinqs.com/technique/T1217), [T1218](https://intel.threadlinqs.com/technique/T1218), T1218.003, [T1218.005](https://intel.threadlinqs.com/technique/T1218.005), [T1218.007](https://intel.threadlinqs.com/technique/T1218.007), [T1218.011](https://intel.threadlinqs.com/technique/T1218.011), [T1219](https://intel.threadlinqs.com/technique/T1219), [T1404](https://intel.threadlinqs.com/technique/T1404), [T1407](https://intel.threadlinqs.com/technique/T1407), [T1409](https://intel.threadlinqs.com/technique/T1409), [T1414](https://intel.threadlinqs.com/technique/T1414), [T1420](https://intel.threadlinqs.com/technique/T1420), T1421, T1424, [T1426](https://intel.threadlinqs.com/technique/T1426), [T1429](https://intel.threadlinqs.com/technique/T1429), [T1430](https://intel.threadlinqs.com/technique/T1430), [T1456](https://intel.threadlinqs.com/technique/T1456), [T1480.001](https://intel.threadlinqs.com/technique/T1480.001), [T1482](https://intel.threadlinqs.com/technique/T1482), [T1484](https://intel.threadlinqs.com/technique/T1484), [T1485](https://intel.threadlinqs.com/technique/T1485), [T1486](https://intel.threadlinqs.com/technique/T1486), [T1489](https://intel.threadlinqs.com/technique/T1489), [T1490](https://intel.threadlinqs.com/technique/T1490), [T1491.001](https://intel.threadlinqs.com/technique/T1491.001), [T1497](https://intel.threadlinqs.com/technique/T1497), [T1497.001](https://intel.threadlinqs.com/technique/T1497.001), [T1498](https://intel.threadlinqs.com/technique/T1498), [T1505](https://intel.threadlinqs.com/technique/T1505), [T1505.003](https://intel.threadlinqs.com/technique/T1505.003), [T1512](https://intel.threadlinqs.com/technique/T1512), [T1517](https://intel.threadlinqs.com/technique/T1517), [T1518](https://intel.threadlinqs.com/technique/T1518), [T1518.001](https://intel.threadlinqs.com/technique/T1518.001), [T1521](https://intel.threadlinqs.com/technique/T1521), [T1526](https://intel.threadlinqs.com/technique/T1526), [T1528](https://intel.threadlinqs.com/technique/T1528), [T1531](https://intel.threadlinqs.com/technique/T1531), [T1533](https://intel.threadlinqs.com/technique/T1533), [T1537](https://intel.threadlinqs.com/technique/T1537), [T1539](https://intel.threadlinqs.com/technique/T1539), [T1542](https://intel.threadlinqs.com/technique/T1542), [T1543](https://intel.threadlinqs.com/technique/T1543), [T1543.003](https://intel.threadlinqs.com/technique/T1543.003), [T1547](https://intel.threadlinqs.com/technique/T1547), [T1547.001](https://intel.threadlinqs.com/technique/T1547.001), T1547.014, T1547.015, [T1548](https://intel.threadlinqs.com/technique/T1548), [T1548.001](https://intel.threadlinqs.com/technique/T1548.001), [T1548.002](https://intel.threadlinqs.com/technique/T1548.002), [T1548.003](https://intel.threadlinqs.com/technique/T1548.003), [T1550](https://intel.threadlinqs.com/technique/T1550), [T1550.001](https://intel.threadlinqs.com/technique/T1550.001), [T1552](https://intel.threadlinqs.com/technique/T1552), [T1552.001](https://intel.threadlinqs.com/technique/T1552.001), [T1552.004](https://intel.threadlinqs.com/technique/T1552.004), [T1553](https://intel.threadlinqs.com/technique/T1553), [T1553.001](https://intel.threadlinqs.com/technique/T1553.001), [T1553.002](https://intel.threadlinqs.com/technique/T1553.002), [T1554](https://intel.threadlinqs.com/technique/T1554), [T1555](https://intel.threadlinqs.com/technique/T1555), [T1555.001](https://intel.threadlinqs.com/technique/T1555.001), [T1555.003](https://intel.threadlinqs.com/technique/T1555.003), [T1556](https://intel.threadlinqs.com/technique/T1556), [T1558](https://intel.threadlinqs.com/technique/T1558), [T1560](https://intel.threadlinqs.com/technique/T1560), [T1561](https://intel.threadlinqs.com/technique/T1561), T1562, T1562.001, T1562.004, [T1564](https://intel.threadlinqs.com/technique/T1564), [T1564.001](https://intel.threadlinqs.com/technique/T1564.001), [T1564.003](https://intel.threadlinqs.com/technique/T1564.003), [T1565](https://intel.threadlinqs.com/technique/T1565), [T1565.002](https://intel.threadlinqs.com/technique/T1565.002), [T1566](https://intel.threadlinqs.com/technique/T1566), [T1566.001](https://intel.threadlinqs.com/technique/T1566.001), [T1566.002](https://intel.threadlinqs.com/technique/T1566.002), [T1566.003](https://intel.threadlinqs.com/technique/T1566.003), [T1567](https://intel.threadlinqs.com/technique/T1567), [T1567.002](https://intel.threadlinqs.com/technique/T1567.002), [T1567.004](https://intel.threadlinqs.com/technique/T1567.004), [T1568](https://intel.threadlinqs.com/technique/T1568), [T1568.002](https://intel.threadlinqs.com/technique/T1568.002), [T1569](https://intel.threadlinqs.com/technique/T1569), [T1570](https://intel.threadlinqs.com/technique/T1570), [T1571](https://intel.threadlinqs.com/technique/T1571), [T1572](https://intel.threadlinqs.com/technique/T1572), [T1573](https://intel.threadlinqs.com/technique/T1573), [T1573.001](https://intel.threadlinqs.com/technique/T1573.001), [T1573.002](https://intel.threadlinqs.com/technique/T1573.002), [T1574](https://intel.threadlinqs.com/technique/T1574), T1574.002, [T1583](https://intel.threadlinqs.com/technique/T1583), [T1583.001](https://intel.threadlinqs.com/technique/T1583.001), [T1583.004](https://intel.threadlinqs.com/technique/T1583.004), [T1583.006](https://intel.threadlinqs.com/technique/T1583.006), [T1583.008](https://intel.threadlinqs.com/technique/T1583.008), [T1584](https://intel.threadlinqs.com/technique/T1584), [T1585](https://intel.threadlinqs.com/technique/T1585), [T1585.001](https://intel.threadlinqs.com/technique/T1585.001), [T1585.003](https://intel.threadlinqs.com/technique/T1585.003), [T1586](https://intel.threadlinqs.com/technique/T1586), [T1587](https://intel.threadlinqs.com/technique/T1587), [T1587.001](https://intel.threadlinqs.com/technique/T1587.001), [T1587.004](https://intel.threadlinqs.com/technique/T1587.004), [T1588](https://intel.threadlinqs.com/technique/T1588), [T1588.001](https://intel.threadlinqs.com/technique/T1588.001), [T1588.002](https://intel.threadlinqs.com/technique/T1588.002), [T1588.003](https://intel.threadlinqs.com/technique/T1588.003), [T1588.005](https://intel.threadlinqs.com/technique/T1588.005), [T1588.006](https://intel.threadlinqs.com/technique/T1588.006), [T1588.007](https://intel.threadlinqs.com/technique/T1588.007), [T1589](https://intel.threadlinqs.com/technique/T1589), [T1591](https://intel.threadlinqs.com/technique/T1591), [T1592](https://intel.threadlinqs.com/technique/T1592), [T1592.002](https://intel.threadlinqs.com/technique/T1592.002), [T1595](https://intel.threadlinqs.com/technique/T1595), [T1595.002](https://intel.threadlinqs.com/technique/T1595.002), [T1596](https://intel.threadlinqs.com/technique/T1596), [T1598](https://intel.threadlinqs.com/technique/T1598), T1600, [T1606](https://intel.threadlinqs.com/technique/T1606), [T1608](https://intel.threadlinqs.com/technique/T1608), [T1608.001](https://intel.threadlinqs.com/technique/T1608.001), [T1611](https://intel.threadlinqs.com/technique/T1611), [T1613](https://intel.threadlinqs.com/technique/T1613), [T1614](https://intel.threadlinqs.com/technique/T1614), [T1614.001](https://intel.threadlinqs.com/technique/T1614.001), T1616, [T1619](https://intel.threadlinqs.com/technique/T1619), [T1620](https://intel.threadlinqs.com/technique/T1620), [T1622](https://intel.threadlinqs.com/technique/T1622), [T1629](https://intel.threadlinqs.com/technique/T1629), T1631, [T1636](https://intel.threadlinqs.com/technique/T1636), T1637, T1639, [T1646](https://intel.threadlinqs.com/technique/T1646), T1656, [T1657](https://intel.threadlinqs.com/technique/T1657)

## Threat actors

LockBit — referenced only as the illustrative test sample in the cited detection research, [WageMole](https://intel.threadlinqs.com/actor/WageMole), [EvilTokens PhaaS Operators](https://intel.threadlinqs.com/actor/EvilTokens%20PhaaS%20Operators), [KongTuke](https://intel.threadlinqs.com/actor/KongTuke), Unidentified NSO Group Pegasus Customer, [JADEPUFFER](https://intel.threadlinqs.com/actor/JADEPUFFER), [FortiBleed Initial Access Broker](https://intel.threadlinqs.com/actor/FortiBleed%20Initial%20Access%20Broker), [Armored Likho](https://intel.threadlinqs.com/actor/Armored%20Likho), not attributed to a named APT), [Contagious Interview](https://intel.threadlinqs.com/actor/Contagious%20Interview), [Storm-2603](https://intel.threadlinqs.com/actor/Storm-2603), [INC Ransom](https://intel.threadlinqs.com/actor/INC%20Ransom)

Nation-state attribution: Russia (affiliate nationals per 2024 DOJ/Operation Cronos indictments; LockBit is a financially motivated criminal RaaS operation, not confirmed state-sponsored), North Korea, Russia, North Korea (DPRK), China

Threat categories: MALWARE, RANSOMWARE, THREAT_INTEL, VULNERABILITY, PHISHING, SUPPLY_CHAIN

## Severity breakdown

- critical: 10
- high: 15
- medium: 3
- low: 0

## Indicator & detection coverage

Counts only; indicator values require Red and above, detection rule text requires Blue and above.

- Indicators of compromise: 865 (behavioral 182, file 174, network 167, tool 109, entity 71, malware 62, infrastructure 56, package 32, technique 12)
- New detection rules: 270 (100% of the day’s threats covered)

## More editions

- Previous: [2026-07-02](https://intel.threadlinqs.com/debrief/2026-07-02)
- Next: [2026-07-10](https://intel.threadlinqs.com/debrief/2026-07-10)
- [Archive of daily debriefs](https://intel.threadlinqs.com/debrief/archive)
- [Latest debrief](https://intel.threadlinqs.com/debrief)

Canonical: https://intel.threadlinqs.com/debrief/2026-07-05