================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Friday, July 3, 2026 - 4:07 PM EDT ================================================================ A new all-in-one Avalon malware framework carrying CrownX ransomware headlines a day thick with fresh nation-state espionage, developer-targeting supply-chain attacks, and AI woven into offense. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Adversaries are weaving AI into attacks, from Armored Likho's AI-generated loaders against power utilities to two new Chinese models that Dark Reading warns lower the bar for offense. see: Armored Likho Deploys BusySnake Stealer; Chinese LLMs Widen the Attacker-Defender Gap * [TREND] Malware crews increasingly ship all-in-one kits, exemplified by the Avalon framework that bundles credential theft, lateral movement, and CrownX ransomware into one phishing-delivered package. see: Avalon Framework Bundles CrownX Ransomware * [UPDATE (new)] North Korean operators seeded npm with counterfeit rollup-packages-polyfill-core packages impersonating a legitimate Rollup plugin to backdoor developer machines. see: North Korean npm Packages Mimic Rollup Polyfills * [UPDATE (new)] Prosecutors extradited 19-year-old Peter Stokes, an alleged Scattered Spider member tied to over 100 intrusions and more than $100 million in ransom payments. see: Alleged Scattered Spider Member Extradited * [TREND] Pittsburgh braces for a stormy Fourth, with extreme heat and severe weather threatening record fireworks security even as an overnight I-279 closure looms next week. see: Heat and Severe Storms Hit July 4 Weekend; Pittsburgh's Record July 4 Fireworks; I-279 and HOV Lanes to Close Overnight SECURITY ---------------------------------------------------------------- 1. ARMORED LIKHO DEPLOYS BUSYSNAKE STEALER Nation-State Activity · [apt, espionage, stealer] Latest developments: Kaspersky attributed a fresh espionage campaign July 3 to a previously undocumented actor it calls Armored Likho, which hits government agencies and the electric power sector across Russia, Brazil, and Kazakhstan using spear-phishing, AI-generated loaders, and a new Python tool named BusySnake Stealer. Armored Likho blends financially motivated attacks on individuals with targeted espionage against organizations, pairing AI-built loaders with the BusySnake Stealer to siphon data from power-sector and government targets. Affected sectors should watch for spear-phishing lures and Python-based stealer activity. - Securelist (Kaspersky): https://securelist.com/tr/armored-likho-apt-with-busysnake-stealer/120292/ - The Hacker News: https://thehackernews.com/2026/07/armored-likho-targets-government.html 2. AVALON FRAMEWORK BUNDLES CROWNX RANSOMWARE Ransomware and Cybercrime · [ransomware, malware, phishing] Latest developments: The Hacker News reported July 3 that researchers uncovered Avalon, a previously undocumented modular malware framework that a multi-stage phishing chain delivers, uniting credential collection, lateral movement, remote access, recovery disruption, and CrownX ransomware execution under one roof. Avalon consolidates an entire intrusion lifecycle into a single toolkit built to slip past traditional security controls, giving one operator credential theft through data destruction and encryption. Defenders should harden phishing defenses and hunt for the framework's multi-stage delivery chain. - The Hacker News: https://thehackernews.com/2026/07/new-avalon-malware-framework-packs.html 3. ALLEGED SCATTERED SPIDER MEMBER EXTRADITED Ransomware and Cybercrime · [cybercrime, arrest] Latest developments: SecurityWeek reported July 3 that prosecutors named the extradited suspect as 19-year-old Peter Stokes, whom they call a member of Scattered Spider, the crew linked to more than 100 network intrusions and over $100 million in ransom payments. Peter Stokes arrived in the United States to face charges tied to Scattered Spider's sprawling extortion campaigns, adding a named defendant to the ongoing law-enforcement push against the group. The case follows a string of arrests targeting the loosely organized crew. - SecurityWeek: https://www.securityweek.com/alleged-scattered-spider-hacker-extradited-to-us/ 4. NORTH KOREAN NPM PACKAGES MIMIC ROLLUP POLYFILLS Nation-State Activity · [supply-chain, apt, npm] Latest developments: JFrog tied North Korea-linked actors July 3 to two malicious npm packages, rollup-packages-polyfill-core and rollup-runtime-polyfill-core, that impersonate the legitimate rollup-plugin-polyfill-node project down to its description and repository metadata to grant remote access and steal developer secrets. The counterfeit packages copy a trusted Rollup polyfill tool to trick developers into installing backdoors on their build machines, extending North Korea's pattern of poisoning open-source registries. Developers should verify package provenance before pulling Rollup tooling. - The Hacker News: https://thehackernews.com/2026/07/north-korea-linked-npm-packages-mimic.html 5. CHINESE LLMS WIDEN THE ATTACKER-DEFENDER GAP AI Security · [ai, llm] Latest developments: Dark Reading reported July 3 that two new models from Chinese firms now rival top United States mainstream and frontier systems, raising fresh questions about whether cyber-defenders should worry that capable models lower the bar for attackers. The arrival of competitive Chinese large language models expands the pool of tools adversaries can turn toward offense, from loader generation to reconnaissance, tightening the race between attackers and defenders. Security teams should factor advancing model capability into their threat models. - Dark Reading: https://www.darkreading.com/cyber-risk/chinese-llms-broaden-gap-between-attackers-and-defenders 6. FLOCK CAMERAS SURVEIL CARS WITHOUT PLATES Surveillance and Privacy · [surveillance, privacy] Latest developments: Schneier on Security highlighted July 3 a 2024 Flock company presentation showing its Vehicle Fingerprint feature, which lets police search cars by decals, bumper stickers, roof and rear racks, and temporary state tags even without full license-plate information. Flock's Vehicle Fingerprint markets to law enforcement the ability to track and search vehicles by physical characteristics alone, extending automated surveillance beyond plate readers. The disclosure sharpens privacy concerns over the reach of Flock's camera network. - Schneier on Security: https://www.schneier.com/blog/archives/2026/07/flock-cameras-can-surveil-cars-without-license-plates.html BUSINESS AND POLITICS ---------------------------------------------------------------- * Iran Buries Khamenei Latest developments: Iran opened six days of state funeral ceremonies on July 3 for Supreme Leader Ayatollah Ali Khamenei, killed in the recent war with Israel and the United States. Authorities in Tehran predict 20 million mourners over six days as dignitaries from more than 100 nations pay respects to Ayatollah Ali Khamenei, whose death removes the cleric who ran Iran for decades and unsettles the leadership of a state fresh from war with Israel and the United States. - WSJ World News: https://www.wsj.com/world/middle-east/iran-supreme-leader-khamenei-funeral-7e1ad603 - FT World: https://www.ft.com/content/a23d758d-3b48-4ea4-a08c-5dba88543d08 PITTSBURGH ---------------------------------------------------------------- Weather: This Afternoon: Isolated Showers And Thunderstorms, high 98F. Tonight: Scattered Showers And Thunderstorms, low 74F. Independence Day: Mostly Sunny then Isolated Showers And Thunderstorms, high 95F. Business: * World Cup Fans Feed Pittsburgh Kitchens Latest developments: The Post-Gazette reported July 3 that Pittsburgh restaurants are theming menus around the nations competing in the 2026 World Cup to court visiting fans. As the World Cup draws crowds across the United States, Pittsburgh eateries are leaning into national dishes—poutine for Canada, barbecue for the United States—to pull in soccer fans and lift summer sales. - Pittsburgh Post-Gazette: https://www.post-gazette.com/business/pittsburgh-company-news/2026/07/03/world-cup-local-cuisine/stories/202607040004 * Katselas-Designed Shadyside Home Hits Market Latest developments: TribLive reported July 3 that a Woodland Road home in Shadyside designed by architect Tasso Katselas is newly listed for sale. A midcentury-modern house on Woodland Road in Shadyside, designed by Tasso Katselas—the architect behind the former Pittsburgh International Airport terminal—has gone up for sale. - TribLive: https://triblive.com/local/tasso-designed-mid-century-modern-home-on-market-in-shadyside/ Around town: * I-279 and HOV Lanes to Close Overnight Latest developments: WPXI reported July 3 that a stretch of Interstate 279 and its HOV lanes will fully close overnight next week. The overnight closure will shut a stretch of I-279 and the HOV lanes through Pittsburgh, Ross, and Ohio Township next week, forcing detours along the North Hills commuting corridor. - WPXI: https://www.wpxi.com/news/local/stretch-i-279-hov-lanes-scheduled-fully-close-overnight-next-week/NFUML6B6Q5CUJGAD3BVLESA7QM/ * Heat and Severe Storms Hit July 4 Weekend Latest developments: Forecasters extended the extreme heat warning through Saturday, July 4, and flagged a Severe Weather Alert Day Saturday with an Impact Day Sunday. Western Pennsylvania faces heat-index values above 105 degrees alongside a severe thunderstorm threat over the holiday weekend, with the National Weather Service extending its extreme heat warning through Saturday, July 4, and storms likely to disrupt Fourth of July plans. - WTAE: https://www.wtae.com/article/july-4th-weekend-for-western-pa-steamy-and-stormy/71814905 - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/weather-news/2026/07/03/pittsburgh-weather-july-4-extreme-heat-warning-severe-storms/stories/202607030033 * Buchtan Sues Over Bartolotta Primary Latest developments: The Post-Gazette reported July 3 that Republican Al Buchtan filed suit alleging Washington County leaders swayed the primary in which he tried to unseat state Senator Camera Bartolotta. Al Buchtan, who challenged Pennsylvania state Senator Camera Bartolotta in the Republican primary, alleges in a lawsuit that Washington County officials tilted the election against him. - Pittsburgh Post-Gazette: https://www.post-gazette.com/news/politics-local/2026/07/03/al-buchtan-camera-bartolotta-primary-election-lawsuit/stories/202607030034 Events: * Pittsburgh's Record July 4 Fireworks Latest developments: WTAE reported July 3 that Pittsburgh added drone surveillance, extra security, and parental advisories for Saturday's celebration, even as forecasters warn severe storms could disrupt it. Pittsburgh caps America's 250th birthday on Saturday, July 4, with what the city bills as its largest fireworks show ever, staged downtown for an expected record crowd, with drone surveillance and heightened security in place. - WTAE: https://www.wtae.com/article/pittsburgh-enhances-safety-measures-for-july-4-celebrations/71817346 SPORTS ---------------------------------------------------------------- Pirates (44-44) Thu Jul 2 · Pirates 6 · Phillies 1 · Final Valdez helps Pirates beat Phillies 6-1 to split their four-game series https://plaintextsports.com/mlb/2026-07-02/pit-phi Up Next · Pirates @ Nationals · Fri Jul 3, 6:45 PM https://plaintextsports.com/mlb/2026-07-03/pit-wsh Around the Teams: * Cam Heyward Hosts Marcus Freeman Latest developments: Steelers captain Cam Heyward's 'Not Just Football' podcast released a July 1 interview with Notre Dame head coach Marcus Freeman. On his 'Not Just Football' show, Steelers defensive tackle Cam Heyward interviewed Notre Dame head coach Marcus Freeman, a former Ohio State linebacker and Heyward's onetime teammate, on leadership, recruiting, and developing NFL talent; Freeman also explained why Notre Dame declined the Pop-Tarts Bowl and gushed over running back Jeremiyah Love. - Not Just Football with Cam Heyward: https://www.youtube.com/watch?v=rfvLY672_Zo * Pirates Open Weekend Series in Washington Latest developments: A Post-Gazette beat writer teamed with a Nationals beat writer on July 3 to preview the Pirates' weekend series in the nation's capital. Pirates and Nationals beat writers set the stage for Pittsburgh's weekend series at Nationals Park, sizing up the matchups as the Pirates try to climb out of the worst month of their season. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/03/pirates-nationals-wild-card-series-washington/stories/202607030017 Team USA: * Balogun Suspended for Belgium Match Latest developments: ESPN and the Guardian reported July 3 that FIFA held Folarin Balogun's suspension to a single match, so he sits out only the United States' round-of-16 game against Belgium after his red card against Bosnia and Herzegovina. Folarin Balogun, whose sending-off in the round-of-32 win over Bosnia and Herzegovina drew debate, misses the United States' round-of-16 match against Belgium; coach Mauricio Pochettino weighs Ricardo Pepi and Haji Wright to lead the line in his place. - Guardian World Cup 2026: https://www.theguardian.com/football/2026/jul/03/folarin-balogun-red-card-suspension-belgium-world-cup - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49256530/how-usmnt-cope-red-card-striker-folarin-balogun-world-cup-round-16-belgium READING ---------------------------------------------------------------- * Ed Zitron -- The AI Industry Is Losing Zitron argues that the AI industry burns enormous capital while failing to turn a profit or deliver the returns its boosters promise, and that the losses are mounting toward a reckoning. https://www.wheresyoured.at/the-ai-industry-is-losing/ * Cal Newport -- Beware of Productivity Paradoxes Newport recalls how the personal computer looked like a certain productivity windfall yet delivered muddier gains, and he cautions that AI could follow the same paradoxical path. https://calnewport.com/beware-of-productivity-paradoxes/ * Stratechery -- An Interview with Figma CEO Dylan Field About Design and AI Field talks through how he built Figma and lays out why he believes AI gives the design company a tailwind rather than a threat. https://stratechery.com/2026/an-interview-with-figma-ceo-dylan-field-about-design-and-ai/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,452.06 ▲ +0.6% Dow 52,316.67 ▲ +1.1% Nasdaq 25,840.84 ▲ +0.1% WTI crude 69.35 ▼ -5.5% EUR/USD 1.1392 ▼ -0.2% GBP/USD 1.3234 ▲ +0.2% USD/JPY 162.14 ▲ +0.4% ================================================================ Generated 2026-07-03 16:07 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================