Weekly Cyber Intelligence for Leaders -July 1 2026

This was the week the defenders struck back. A coordinated international operation reached deep into the machinery of cybercrime and pulled it apart, recovering tens of millions of stolen passwords and freezing the proceeds. For once, the disruption flowed toward the criminals.

Yet the adversaries adapted in the same breath. Russian intelligence moved to harvest the recovery keys that unlock encrypted message histories. Iranian operators reached for a water utility. Attackers kept probing the management consoles and edge appliances that grant entry to everything behind them. The through-line is clear: progress and pressure now move together, and advantage belongs to whoever sees the shift first and acts while the window stays open.

Here is your weekly five-minute distillation of the 10 most consequential movements in cyber security.

1. The Assembly Line Comes Apart: Operation Endgame Dismantles StealC and Amadey, Recovering 27 Million Credentials

THE BIG DEAL On 24 June, Europol and Microsoft announced the latest phase of Operation Endgame, dismantling the infrastructure behind the StealC and Amadey infostealers, the credential-harvesting layer of the cybercrime supply chain. Law enforcement and private partners actioned 326 servers and 142 domains, froze roughly €41 million (about A$70 million) in criminal cryptocurrency, and recovered around 27 million stolen credentials from more than 385,000 compromised systems. Microsoft’s Digital Crimes Unit used AI, including Copilot, to prove the two malware families shared infrastructure, enabling a single court-authorised takedown of more than 200 command-and-control servers. The action followed the SocGholish disruption a week earlier.

SOURCE BleepingComputer ‐ Operation Endgame Disrupts StealC and Amadey

2. The Human Layer Is the Target: Russian Intelligence Moves to Steal Signal Backup Recovery Keys

THE BIG DEAL On 26 June, the FBI and CISA updated a March advisory (PSA I-062626-PSA), warning that a Russian intelligence phishing campaign now coaxes targets into surrendering their Signal Backup Recovery Key. With the key, an operator can restore the account backup and read the full private and group message history, and the key keeps working even after the account is re-created on the same number. The activity, tracked as UNC5792 and UNC4221 and tied to Russia’s FSB and military services, focuses on government officials, military personnel, political figures, journalists and Ukrainian officials. The encryption held; the human was the way in.

SOURCE BleepingComputer ‐ FBI Warns of Signal Recovery-Key Theft

3. Western AI Becomes the Prize: Anthropic Tells the US Senate That Alibaba-Linked Operators Harvested Claude’s Cyber Capability

THE BIG DEAL In a letter to the United States Senate Banking Committee disclosed this week, Anthropic alleged that operators affiliated with Alibaba and its Qwen lab ran some 28.8 million exchanges through roughly 25,000 fraudulent accounts between 22 April and 5 June, distilling the coding, agentic-reasoning and cyber security capabilities of its frontier Mythos Preview model. Distillation trains a competing model on the outputs of a stronger one; Anthropic alleged state complicity, the figures are its own account, and Alibaba denies the allegations. The disclosure lands two weeks after Washington restricted Anthropic’s most capable models on national-security grounds.

SOURCE CNBC ‐ Anthropic Accuses Alibaba of Distillation Campaign

4. The Factory Floor Is Exposed: CISA Flags Active Exploitation of a Critical PTC Windchill Flaw

THE BIG DEAL On 25 June, the United States Cybersecurity and Infrastructure Security Agency added a critical remote-code-execution flaw in PTC Windchill PDMLink and FlexPLM, tracked as CVE-2026-12569 (CVSS 9.3), to its Known Exploited Vulnerabilities catalogue, citing active exploitation. The flaw allows an unauthenticated attacker to run arbitrary code by sending a crafted request, through deserialisation of untrusted data. PTC released patches the prior week and has confirmed continued reports of heightened threat activity. Windchill and FlexPLM hold the product designs, bills of material and engineering data at the heart of manufacturing operations.

SOURCE CISA ‐ Known Exploited Vulnerabilities Catalogue

5. Patch Now: Cisco Unified Communications Manager Under Active Exploitation as CISA Sets a Federal Deadline

THE BIG DEAL CISA directed federal agencies to patch an actively exploited server-side request-forgery flaw in Cisco Unified Communications Manager, tracked as CVE-2026-20230, the platform that runs enterprise voice and collaboration. The vulnerability lets attackers reach the management plane of a widely deployed communications system, and CISA added it to its Known Exploited Vulnerabilities catalogue under Binding Operational Directive 26-04 with a short remediation window. The addition reflects a sustained pattern this year of adversaries targeting the administrative interfaces of core enterprise infrastructure rather than user endpoints.

SOURCE Cisco ‐ Security Advisory: Unified Communications Manager SSRF

6. Water in the Crosshairs: Iran-Linked Handala Strikes a California Utility as Mandiant Investigates

THE BIG DEAL Mandiant is helping a California water utility investigate a cyberattack attributed to the Iran-linked group Handala, amid heightened warnings that Iranian operators are targeting United States critical infrastructure, water systems included. Water utilities remain a soft target, often running lean security teams and legacy operational technology. The incident fits a broader shift this year, with state-linked actors moving from espionage toward operations that carry the potential for physical disruption of essential services.

SOURCE SecurityWeek ‐ Mandiant Aids California Water Utility After Iranian Attack

7. Closer to Home: Australia’s Cyber Authority Warns of ClickFix Social Engineering Through Compromised Websites

THE BIG DEAL The Australian Signals Directorate’s Australian Cyber Security Centre warned that threat actors are targeting Australian networks with ClickFix, a social-engineering technique that distributes malware through compromised WordPress websites. The lure presents a fake prompt that persuades a user to run a command, which installs malware, often a credential-stealer of the kind dismantled in Operation Endgame. The advisory, aimed at organisations, critical infrastructure and government, sits within a rising tempo of ACSC alerts as state-sponsored actors and cybercriminals continue to target Australian networks.

SOURCE ASD’s ACSC ‐ Alerts and Advisories

8. The Front End Is the Breach: Polymarket Reimburses US$3 Million After a Supplier Compromise

THE BIG DEAL The prediction-market platform Polymarket confirmed it will fully reimburse customers who lost an estimated US$3 million after attackers compromised a third-party vendor and injected a malicious script into the platform’s front end. The injected code targeted a subset of users directly through the website they trusted, with no need to breach Polymarket’s own core systems. The incident shows how a single supplier in the delivery chain can become the doorway to a company’s customers.

SOURCE BleepingComputer ‐ Polymarket Supply-Chain Attack

9. A Regional Warning: INTERPOL Records a Sharp Rise in Cybercrime Across Asia and the South Pacific

THE BIG DEAL On 22 June, INTERPOL released its 2025/2026 Asia and South Pacific Cyberthreat Assessment, describing a dramatic increase in cybercrime across the region, driven by rapid digitalisation, organised criminal networks and uneven cyber-security maturity. Phishing emerged as the most widespread threat, alongside rising ransomware and a surge in AI-enabled scams. The assessment frames a regional threat environment in which Australia and its neighbours face professionalised, cross-border cybercrime operating at scale.

SOURCE INTERPOL ‐ Asia and South Pacific Cyberthreat Assessment

10. The Estate Question: Microsoft Extends Windows 10 Security Updates to October 2027

THE BIG DEAL Microsoft extended its consumer Extended Security Updates programme for Windows 10, allowing enrolled devices to keep receiving security updates until 12 October 2027. The extension buys time for the large installed base still running the operating system after its October 2025 end of mainstream support. End-of-life devices that sit unpatched and internet-exposed remain a primary feeding ground for botnets and ransomware, as a year of advisories has shown.

SOURCE BleepingComputer ‐ Windows 10 ESU Extended to 2027

The Executive Verdict

The week traced a single contest between disruption and adaptation. Defenders reached into the cybercrime supply chain and pulled out its credential-harvesting heart, recovering tens of millions of stolen logins and freezing the proceeds. In the same days, adversaries moved to the human layer for Signal recovery keys, reached for a water utility, harvested the cyber capability of a Western AI model, and kept probing the management consoles that grant entry to everything behind them. Progress and pressure advanced together.

For Australian boards and agencies, the discipline holds steady. Assume credentials will leak and suppliers will be compromised, and invest in the capacity to see compromise the moment it surfaces, wherever it surfaces. Govern third-party access and front-end code as rigorously as your own systems, treat operational technology and secure communications as first-order risks, and read each authority’s advisory as an action queue. The organisations that lead through the year ahead will be those that learn of their exposure first, and act while the window stays open.