================================================================ INFOSECFOLLOW -- security, markets, business, pittsburgh Sunday, July 5, 2026 - 9:07 AM EDT ================================================================ Data-theft extortion, AI-assisted espionage, and unpatched open-source flaws keep defenders stretched even as courts jail a hacktivist and Google severs a two-million-device proxy botnet. CONTENTS: Emerging Trends and Key Updates | Security | Business and Politics | Pittsburgh | Sports | Reading | Markets EMERGING TRENDS AND KEY UPDATES ---------------------------------------------------------------- * [TREND] Extortion crews are decoupling ransomware from encryption, as Kairos pried $1 million from a U.S. government entity on stolen files alone while Avalon's chain still deploys CrownX ransomware. see: Kairos Extorts US Government Without Encryption; Avalon Framework Bundles CrownX Ransomware * [TREND] Attackers are wiring AI into their toolkits, with Armored Likho pairing AI-generated loaders and its new BusySnake Stealer against government and electric-power targets across Russia, Brazil, and Kazakhstan. see: Armored Likho Targets Power Sector With BusySnake * [TREND] Tiny ubiquitous open-source code keeps spawning critical bugs, as runZero's seven unpatched FatFs flaws and the patched Bad Epoll kernel hole threaten Linux systems and millions of embedded devices. see: FatFs and Bad Epoll Expose Devices and Kernels * [UPDATE (new)] Google helped dismantle the NetNut residential proxy botnet, cutting off roughly 2 million compromised Android devices including smart TVs and streaming boxes. see: NetNut Proxy Botnet Disrupted * [TREND] The Reading list debates AI's payoff, as Ed Zitron argues the industry is losing money, Cal Newport warns of productivity paradoxes, and Figma's Dylan Field sees a tailwind. see: The AI Industry Is Losing; Beware of Productivity Paradoxes; An Interview with Figma CEO Dylan Field About Design and AI * [UPDATE (new)] Courts jailed an Anonymous-linked Canadian hacktivist and sentenced Venezuelan nationals for ATM jackpotting in the United States. see: Courts Jail Hacktivist, Sentence ATM Jackpotters SECURITY ---------------------------------------------------------------- 1. KAIROS EXTORTS US GOVERNMENT WITHOUT ENCRYPTION Ransomware and Cybercrime · [extortion, breach, ransomware] Latest developments: The Hacker News published a detailed July 4 account showing that Kairos, despite ransomware-style branding, never locked a single file, reconstructed from a leaked negotiation chat and the blockchain trail the $1 million payment left. Kairos extorted a U.S. government entity out of roughly $1 million by threatening to leak stolen files, running pure data-theft extortion with no encryption. Rakesh Krishnan's Ransom-ISAC case study reconstructed the case; defenders should treat exfiltration-only extortion as a first-order risk and lock down data-exfiltration paths. - The Hacker News: https://thehackernews.com/2026/07/us-government-entity-paid-kairos-group.html 2. FATFS AND BAD EPOLL EXPOSE DEVICES AND KERNELS Vulnerabilities and Exploits · [zero-day, patch, supply-chain] Latest developments: runZero disclosed seven still-unpatched flaws in FatFs the same stretch of the news cycle that the patched Bad Epoll kernel flaw surfaced, sitting in the code where Anthropic's Mythos model recently caught a different bug. runZero found seven vulnerabilities in FatFs, the small filesystem library that reads USB drives and SD cards inside security cameras, drones, industrial controllers, and hardware crypto wallets, while Bad Epoll (CVE-2026-46242) hands any unprivileged user root on Linux desktops, servers, and Android. Patch Linux immediately; embedded-device operators must press vendors for FatFs fixes. - The Hacker News: https://thehackernews.com/2026/07/unpatched-flaws-disclosed-in-filesystem.html - The Hacker News: https://thehackernews.com/2026/07/new-bad-epoll-linux-kernel-flaw-lets.html 3. AVALON FRAMEWORK BUNDLES CROWNX RANSOMWARE Ransomware and Cybercrime · [ransomware, phishing, malware] Latest developments: Researchers detailed Avalon for the first time, a modular framework whose multi-stage phishing chain bypasses traditional controls and then executes CrownX ransomware. Avalon is a previously undocumented modular malware framework that a multi-stage phishing chain delivers, combining credential theft, lateral movement, remote access, recovery disruption, and CrownX ransomware in one package. Its control-bypassing delivery makes phishing hardening and backup protection urgent. - The Hacker News: https://thehackernews.com/2026/07/new-avalon-malware-framework-packs.html 4. NETNUT PROXY BOTNET DISRUPTED Ransomware and Cybercrime · [botnet, takedown, malware] Latest developments: A joint operation involving Google cut off NetNut's roughly 2 million compromised Android devices, including smart TVs and streaming boxes, dismantling the residential proxy network. NetNut resold access to about 2 million infected Android devices as residential proxies that attackers used to mask malicious traffic. The Google-led takedown severs a major source of hard-to-block residential-IP abuse. - BleepingComputer: https://www.bleepingcomputer.com/news/security/netnut-proxy-network-disrupted-2-million-infected-devices-cut-off/ 5. COURTS JAIL HACKTIVIST, SENTENCE ATM JACKPOTTERS Ransomware and Cybercrime · [cybercrime, fraud] Latest developments: SecurityWeek's July 3 roundup reported that courts jailed an Anonymous-linked Canadian hacker and sentenced Venezuelan nationals in the United States for ATM jackpotting, while a researcher separately published zero-days in open-source projects. Law enforcement notched two convictions: an Anonymous-linked Canadian hacker went to jail and Venezuelan nationals drew U.S. sentences for ATM jackpotting, the technique that forces cash machines to empty themselves. The same roundup flagged a researcher dropping zero-days in open-source projects. - SecurityWeek: https://www.securityweek.com/in-other-news-canadian-hacker-jailed-open-source-zero-days-two-sentenced-for-atm-jackpotting/ 6. ARMORED LIKHO TARGETS POWER SECTOR WITH BUSYSNAKE Nation-State Activity · [apt, espionage, stealer] Latest developments: Kaspersky attributed a fresh campaign to Armored Likho, naming its new Python tool BusySnake Stealer and AI-generated loaders aimed at government agencies and the electric power sector across Russia, Brazil, and Kazakhstan. Armored Likho, a previously undocumented actor, blends financially motivated theft against individuals with espionage against organizations, using spear-phishing, AI-generated loaders, and BusySnake Stealer. Government and power-sector defenders should harden email defenses and hunt for the BusySnake toolset. - The Hacker News: https://thehackernews.com/2026/07/armored-likho-targets-government.html BUSINESS AND POLITICS ---------------------------------------------------------------- * Iran Buries Khamenei Amid Succession Doubt Latest developments: Iran's top leaders and the ayatollah's sons flanked the coffin on July 5, but Mojtaba Khamenei—long seen as a possible successor—stayed away, spotlighting an unresolved succession. Iran is holding a six-day state funeral in Tehran for supreme leader Ayatollah Ali Khamenei, who died in the war with Israel and the United States; the Islamic Republic staged a show of elite unity even as the absence of his son Mojtaba underscored the unsettled question of who will rule. - Financial Times: https://www.ft.com/content/a3dedf8e-f0fa-4646-a18e-5842c7359e3c * OPEC+ Hikes Output as Hormuz Recovers Latest developments: OPEC and its allies raised production for a fifth straight month on July 5 just as tanker traffic through the Strait of Hormuz, which the war had disrupted, began recovering. OPEC and its partners continued unwinding the production cuts they imposed in recent years, adding barrels to the market as shipping through the Strait of Hormuz normalizes after the Iran conflict, easing the supply picture for global crude. - Wall Street Journal: https://www.wsj.com/business/energy-oil/opec-allies-hike-output-again-as-hormuz-traffic-starts-recovering-0094a1a4 PITTSBURGH ---------------------------------------------------------------- Weather: Today: Showers And Thunderstorms Likely, high 87F. Tonight: Showers And Thunderstorms Likely, low 70F. Monday: Patchy Fog then Chance Showers And Thunderstorms, high 85F. Business: * Grim Wizard Café Expands in Allentown Latest developments: Grim Wizard Coffee, the heavy-metal-themed café, moved into a larger storefront in Pittsburgh's Allentown neighborhood, pairing its coffee bar with a room of pinball machines. Grim Wizard Coffee, an Allentown café built around a heavy-metal aesthetic—a deep-red arch, Rainbow's 1976 'Stargazer' lyrics stenciled in gold—grew into a bigger space, adding a pinball room beside its espresso bar. - TribLive: https://triblive.com/lifestyles/food-drink/heavy-metal-cafe-grim-wizard-grows-into-larger-space-in-pittsburghs-allentown-neighborhood/ * Pitt Video Game Sharpens ER Trauma Decisions Latest developments: A University of Pittsburgh study found that a video game built by a local physician measurably improved emergency-room doctors' decisions in treating older trauma patients. Researchers at the University of Pittsburgh reported that a training video game, created by a Pittsburgh doctor, improved how ER physicians decide care for older trauma patients, a group whose injuries clinicians often under-triage. - TribLive: https://triblive.com/news/health-now/university-of-pittsburgh-study-finds-video-game-improves-er-doctors-decisions-for-older-trauma-patients/ Around town: * Heat Wave Ends, Flooding Now the Threat Latest developments: The heat wave broke after a fifth 90-degree day; Saturday storms knocked out power to thousands, and forecasters now flag flooding as the main risk heading into a cooler, humid, rainy week. Western Pennsylvania's heat wave ended as scattered storms crossed the Pittsburgh region, cutting power to thousands of customers Saturday and saturating ground so that Sunday's rain raises flash-flood concerns; KDKA forecasts cooler, humid conditions through the week. - KDKA: https://www.cbsnews.com/pittsburgh/news/pittsburghs-hot-weather-turns-into-cool-humid-and-rainy-conditions-this-week/ - WPXI: https://www.wpxi.com/news/local/thousands-without-power-following-strong-storms-pittsburgh-region/NC5R3AKQF5CBRL5YLZU56O434I/ * Irwin Officials Frustrated Over Office Remodel Latest developments: Irwin council members' frustration boiled over at a meeting as they faulted contractors for work they see as missed or incomplete on a remodeling project meant to create new municipal offices. In Irwin, a Westmoreland County borough, council members clashed over the conversion of a building into new municipal offices, criticizing what they call unfinished or overlooked work. - TribLive: https://triblive.com/local/westmoreland/irwin-officials-frustration-mounts-over-office-project/ SPORTS ---------------------------------------------------------------- Pirates (45-45) Sat Jul 4 · Pirates 7 · Nationals 1 · Final Ashcraft wins 4th straight start as Pirates topple Nationals 7-1 https://plaintextsports.com/mlb/2026-07-04/pit-wsh Up Next · Pirates @ Nationals · Sun Jul 5, 1:00 PM https://plaintextsports.com/mlb/2026-07-05/pit-wsh Around the Teams: * Hiles Diagnoses Skenes' Slump Latest developments: In a July 3 deep dive, Post-Gazette columnist Noah Hiles spread blame for Paul Skenes' recent struggles across his catchers, his coaching, and his mechanics. Post-Gazette columnist Noah Hiles examined the causes of Pirates ace Paul Skenes' rough stretch—capped by a career-high eight runs against the Phillies—and found plenty of shared responsibility around the pitcher. - Post-Gazette Pirates: https://www.post-gazette.com/sports/pirates/2026/07/03/hiles-skenes-blame-marin-murphy-kelly-pitcher/stories/202607020064 * Carter Fields Steelers Offseason Questions Latest developments: In a July 2 live chat, Post-Gazette writer Christopher Carter took reader questions on quarterback Aaron Rodgers, receiver DK Metcalf, and cornerback Joey Porter Jr. Post-Gazette Steelers writer Christopher Carter answered readers in a July 2 chat spanning the offseason roster, from Aaron Rodgers under center to DK Metcalf's fit and the contract questions surrounding Joey Porter Jr. - Post-Gazette Steelers: https://www.post-gazette.com/sports/steelers/2026/07/02/live-chat-nfl-offseason-rodgers-pittman-metcalf-porter/stories/202607020013 Team USA: * USMNT Meets Belgium Monday in Seattle Latest developments: A day from kickoff, captain Tim Ream called the squad 'a true representation of America' as the United States readied for its round-of-16 match against Belgium on Monday, July 6, in Seattle, still without suspended striker Folarin Balogun. The United States men's national team, co-hosting the 2026 World Cup, faces Belgium in the round of 16 on Monday, July 6, in Seattle; ESPN weighed how the Americans replace suspended forward Folarin Balogun, while defender Tim Ream cast the team's diverse roster as a reflection of the country. - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49270695/usmnt-true-representation-america-tim-ream - ESPN Soccer: https://www.espn.com/soccer/story/_/id/49256530/how-usmnt-cope-red-card-striker-folarin-balogun-world-cup-round-16-belgium READING ---------------------------------------------------------------- * Ed Zitron -- The AI Industry Is Losing Ed Zitron argues the AI industry is losing—pouring enormous capital into products that generate little profit, and heading toward a reckoning its valuations cannot justify. https://www.wheresyoured.at/the-ai-industry-is-losing/ * Cal Newport -- Beware of Productivity Paradoxes Cal Newport warns that technologies sold as obvious productivity wins—the personal computer chief among them—often fail to lift measured output, a paradox that should temper expectations for new tools like AI. https://calnewport.com/beware-of-productivity-paradoxes/ * Stratechery -- An Interview with Figma CEO Dylan Field About Design and AI Ben Thompson interviews Figma CEO Dylan Field on building the design company and why Field believes AI gives Figma a tailwind in design work. https://stratechery.com/2026/an-interview-with-figma-ceo-dylan-field-about-design-and-ai/ MARKETS (weekly average, change vs prior week) ---------------------------------------------------------------- S&P 500 7,452.06 ▲ +0.6% Dow 52,316.67 ▲ +1.1% Nasdaq 25,840.84 ▲ +0.1% WTI crude 69.26 ▼ -3.7% EUR/USD 1.1415 ▲ +0.3% GBP/USD 1.3295 ▲ +0.7% USD/JPY 161.98 ▲ +0.2% ================================================================ Generated 2026-07-05 09:07 EDT. Sources: 24 security feeds; 9 Pittsburgh feeds; 4 Pittsburgh arts and events feeds; 6 Pittsburgh sports beat and podcast feeds; 4 Team USA feeds; the Wall Street Journal, the Economist, and the Financial Times; and Ed Zitron, Stratechery, Cal Newport. Markets from Yahoo Finance, weather from the NWS, scores from ESPN. Summaries are AI-generated from the linked reporting; verify at the sources. ================================================================