July 13, 2026 Emerging Threats Weekly

This week’s briefing covers:

00:00 – Intro

00:44 [THREAT ACTOR] China-Linked UAT-7810 Expands ORB Infrastructure with LONGLEASH
On July 7, 2026, Cisco Talos reported that it is tracking infrastructure and malware associated with UAT-7810, a China-nexus advanced persistent threat actor responsible for maintaining and expanding the LapDogs Operational Relay Box network.

02:51 [CAMPAIGN] Fake Interpol Ransomware Lures Target Small Businesses
Bitdefender reported that its Antispam Lab identified a phishing campaign impersonating Interpol and targeting small businesses across Europe, Asia, the Middle East and the United States.

06:20 [PHISHING] Fake Job Interview Campaign Steals Google Accounts Through Trusted Business Services
A phishing campaign is impersonating more than 30 well-known brands, including Adobe, Netflix, Coca-Cola, Adidas and OpenAI to steal Google account credentials from marketing professionals. The campaign uses fake job interview invitations and impersonates real recruiters by using their names and photographs to increase credibility.

09:08 [MALWARE] Remus Stealer Emerges as a Lumma-like Infostealer with Updated Infrastructure
A new infostealer marketed as Remus has gained traction within cybercriminal communities and shares significant similarities with the Lumma malware family.

12:07 [MALWARE] JadePuffer Shows End-to-End Agentic AI Ransomware Execution
Researchers have documented what they assess to be the first end-to-end ransomware and extortion operation executed autonomously by a large language model agent.

Dive deeper:

Kroll’s Monthly Threat Intelligence Spotlight Report: https://www.kroll.com/en/reports/cyber/threat-intelligence-reports/cti-spotlight-trends-report

Kroll’s Cyber Threat Intelligence: https://www.kroll.com/en/services/cyber/threat-intelligence-services

Kroll’s Q4 2024 Cyber Threat Landscape: https://www.kroll.com/en/reports/cyber/threat-intelligence-reports/q4-2024-threat-landscape-report-phishing

Kroll’s 2025 Cyber Threat Landscape Report: Cybercrime in the Crypto Era: https://www.kroll.com/Reports/Cyber/Threat-Intelligence-Reports/Threat-Landscape-Report-Lens-on-Crypto

Playlist of Kroll's Weekly Cyber Threat Intelligence Briefings: https://www.youtube.com/playlist

Kroll Cyber Blog: https://www.kroll.com/en/insights/cyber

Kroll Cyber Threat Intelligence: https://www.kroll.com/en/services/cyber/threat-intelligence-services

Kroll Threat Intelligence Reports: https://www.kroll.com/en/reports/cyber/threat-intelligence-reports

Kroll Cyber and Data Resilience: https://www.kroll.com/en/services/cyber

#krollcyber #threatintelligence #cyberthreats