ctipilot.ch

CTI Daily Brief — 2026-05-16

Typedaily
Date2026-05-16
GeneratorClaude Opus 4.7 (`claude-opus-4-7`)
ClassificationTLP:CLEAR
LanguageEnglish
Promptv2.59
Items9
CVEs15
On this page

On this page

Tags (21)
Regions (4)
References (25)

0. TL;DR

  • Microsoft Exchange Server CVE-2026-42897 (CVSS 8.1) actively exploited via crafted-email XSS in OWA; CISA KEV-added 2026-05-15; no permanent patch — only EEMS auto-mitigation; air-gapped servers need EOMT manual install; Exchange 2016/2019 permanent fix gated behind Period 2 ESU enrolment (Microsoft MSRC, 2026-05-14 · NCSC-CH Security Hub #12577, 2026-05-15).
  • Microsoft Threat Intelligence publishes anatomy of Secret Blizzard (Turla / FSB Centre 16) Kazuar P2P botnet: three-module Kernel/Bridge/Worker architecture with Mailslot leadership election, EWS / WSS / HTTP C2, ~150 config types, AMSI/WLDP/ETW bypasses, hostname-bound payload encryption; target set documented as ministries of foreign affairs, embassies, government offices, defence departments and defence-related companies worldwide — European environments fall squarely within that scope (Microsoft Threat Intelligence, 2026-05-14).
  • GTIG analyses UNC6671 "BlackFile" vishing-driven AiTM extortion: real-time helpdesk impersonation → attacker-registered lookalike SSO portals → MFA token capture and rogue MFA device registration → programmatic SharePoint exfiltration of 1M+ files per victim via Python requests spoofing the Microsoft Office ClientAppId; DLS shutdown signals probable rebrand (Google Threat Intelligence Group, 2026-05-15).
  • node-ipc npm package (widely-used Node.js IPC library) hijacked via expired-domain account takeover; three malicious versions (9.1.6, 9.2.3, 12.0.1) exfiltrate ~90 categories of cloud / CI/CD / SSH / Keychain credentials over DNS TXT and HTTPS to attacker C2; rotate any secret accessible from a workstation that installed the package on 2026-05-14 (Socket Security, 2026-05-14 · StepSecurity, 2026-05-14).
  • Cyera Research discloses OpenClaw "Claw Chain" — four chainable vulnerabilities (CVE-2026-44112 CVSS 9.6 / CVE-2026-44115 8.8 / CVE-2026-44118 7.8 / CVE-2026-44113 7.7) in the autonomous-agent platform enabling sandbox escape → credential leak → privilege escalation → file disclosure; ~245 K publicly accessible instances; fixed by the 2026-04-23 OpenClaw release (GHSA-5h3g-6xhh-rg6p / wppj-c6mr-83jj / r6xh-pqhr-v4xh / x3h8-jrgh-p8jx) (Cyera Research, 2026-05-15).

Immediate Action — Verify EEMS Mitigation M2 deployed on every on-premises Exchange Server 2016 / 2019 / SE; deploy EOMT manually on air-gapped Exchange. CVE-2026-42897 is a CVSS 8.1 stored XSS in Outlook Web Access that is actively exploited in the wild as of 2026-05-14, with no permanent patch — Microsoft has confirmed Exploitation Detected and is shipping only a temporary URL-rewrite mitigation through the Exchange Emergency Mitigation Service. EEMS is enabled by default on Exchange 2016 SP1 and later; on Exchange servers that have lost outbound connectivity to the EEMS endpoint, on Exchange 2013, or on hardened deployments where EEMS was explicitly disabled, the mitigation does not auto-apply and operators must download and run the Exchange On-Premises Mitigation Tool (EOMT) from aka.ms/UnifiedEOMT to apply Mitigation M2 manually before the next OWA-using user opens email. Once mitigation is verified, audit IIS access logs on the Exchange front end for OWA URLs carrying script-injection payloads since 2026-05-09 — the EEMS mitigation does not retroactively remediate any prior XSS execution (NCSC-CH Security Hub #12577, 2026-05-15 · Microsoft Exchange Team, 2026-05-14).

3. Research & Investigative Reporting

Unit 42: Gremlin Stealer evolved with .NET-resource XOR obfuscation, real-time crypto-clipper, and WebSocket browser-process session-hijack module [SINGLE-SOURCE]

Palo Alto Networks Unit 42 published on 2026-05-15 an analysis of evolved variants of the Gremlin information stealer, adding three new capability tiers operationally relevant to defenders running endpoint detections tuned for older Gremlin samples (Palo Alto Networks Unit 42, 2026-05-15). Obfuscation has shifted to embedding encrypted payloads in .NET resource sections (XOR-keyed) combined with single- or double-character identifier renaming and a runtime string-decoder function (_003CModule_003E.c()) — defeating static signature analysis of string literals that previous-generation Gremlin samples used. A new crypto-clipper component continuously monitors the system clipboard and replaces Bitcoin and Ethereum wallet addresses with attacker-controlled equivalents in real time, T1115. The most operationally interesting addition is a WebSocket-based session-hijack module that reads active browser process memory (Chrome-based browsers) to extract session tokens directly from running processes, bypassing the cookie-encryption mitigations modern browsers apply at disk — T1185 Browser Session Hijacking. Credential scope includes browser cookies, session tokens, saved passwords, payment-card details, FTP and VPN credentials, Discord tokens (dedicated regex scanner), clipboard content, and cryptocurrency wallet files. Exfiltration is HTTPS POST to a private web panel; a Telegram Bot API channel is the secondary channel. Detection: Sysmon EID 10 (process access) targeting chrome.exe or msedge.exe (and other Chrome-based browser processes) from unexpected parent processes; clipboard-monitoring hook registration from non-standard processes (generic Windows clipboard-listener API surface). Hardening: browser isolation for high-value sessions; clipboard-API access audited in EDR telemetry. Single-source — Unit 42 only; flagged for verification.

SentinelOne: "Living Off the Pipeline" — CI/CD subversion taxonomy with three real intrusion cases (TeamCity, GitLab service-account pivot, Contagious Interview) [SINGLE-SOURCE]

SentinelOne published on 2026-05-15 a practitioner-focused taxonomy of CI/CD pipeline subversion techniques, illustrated with three real intrusion case studies that are immediately useful for SOC and DevSecOps teams running JetBrains TeamCity, GitLab, or GitHub Actions (SentinelOne, 2026-05-15). Case 1: an unpatched TeamCity server (CVE-2023-42793) exploited to deploy backdoors via privileged build tasks, remaining undetected for 12+ months. Case 2: a GitLab service-account token compromise enabling creation of malicious Ansible playbooks that were then automatically executed by pipelines — a clean demonstration of how service-account over-privilege translates directly into production code execution. Case 3: the Contagious Interview campaign using fraudulent job offers directing developer victims to fake skill-assessment sites that deploy malware silently to developer workstations. Additional vectors covered include attacker-registered self-hosted runners, workflow triggers from repository discussion comments, dependency poisoning with reconnaissance preinstall scripts, and maintainer-account compromise appending malicious code; the article cross-links a separate SentinelOne analysis of the "Sha1-Hulud" NPM compromise as a related supply-chain case. MITRE ATT&CK: T1195.002, T1547 (rogue runner registration as persistence), T1555 (pipeline secret extraction), T1204 (user execution via fake job-offer social engineering), T1072 (software-deployment-tool abuse via Ansible). Defender monitoring priorities surfaced in the report: GitHub / GitLab audit logs for runner.registered events with unfamiliar names or unexpected source IP ranges; new or modified pipelines authored by service accounts; suspicious child-process spawn from build agents (cmd.exe, powershell.exe, curl, wget outside baseline); credential-access and reverse-tunnel traffic originating from build infrastructure; and secret-injection patterns in workflow-config modifications. Single-source — SentinelOne only.

4. Updates to Prior Coverage

No updates this run — no material new development surfaced on items covered in the last 7 days. The Cisco Catalyst SD-WAN CVE-2026-20182 / UAT-8616 chain (deep-dive 2026-05-15), the Microsoft May 2026 Patch Tuesday cluster (covered 2026-05-13), Ivanti EPMM May 2026 series (covered 2026-05-12), TeamPCP / Mini Shai-Hulud OpenAI disclosure (covered 2026-05-15 § 4), and the NGINX Rift CVE-2026-42945 + Linux Fragnesia CVE-2026-46300 + Nextcloud CVE-2026-45691 trio (all covered 2026-05-15) had no in-window fresh deltas at this run's research time.

5. Deep Dive — Microsoft Exchange CVE-2026-42897: Active Exploitation Without a Patch

Background. On-premises Microsoft Exchange has been a sustained, high-value target for advanced and opportunistic actors for the entire 2021–2026 window. ProxyLogon (CVE-2021-26855 + chain) in March 2021 was exploited at scale by Hafnium and dozens of follow-on clusters before mitigations stuck; ProxyShell (CVE-2021-34473 + chain) repeated the pattern in August 2021 (Microsoft Threat Intelligence, 2021-03-02 · CISA Alert AA21-321A, 2021-11-17). The Exchange Emergency Mitigation Service (EEMS), introduced in Exchange Server 2016 CU22 and 2019 CU11, was Microsoft's explicit response to that pattern: a small auto-update mechanism that ships URL-rewrite rules to live Exchange front-ends in the gap between an in-the-wild zero-day and a permanent CU (Microsoft, 2021-09-28). CVE-2026-42897 is the first 2026 case where EEMS — not a Patch Tuesday CU — is the line of defence against active exploitation; the deep dive that follows is therefore as much about EEMS verification and bypass conditions as about the XSS itself.

Vulnerability mechanics. CVE-2026-42897 is classified by Microsoft as a spoofing vulnerability (impact category) underpinned by CWE-79, improper neutralisation of input during web-page generation, in the Outlook Web Access (OWA) component (Microsoft MSRC, 2026-05-14). The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N describes a network-deliverable XSS that requires the victim to open the malicious message in OWA: no authentication is required of the attacker, only of the recipient. Microsoft assesses severity Critical despite the 8.1 base score — the "Critical" label reflects the impact reach (session-token theft, content tampering in the OWA session, downstream phishing from a now-trusted internal mailbox), not the base metric. Microsoft has not published the precise attacker-controlled fragment that delivers the JavaScript payload — consistent with Exploitation Detected status, the team is withholding payload format pending the permanent SU — but the MSRC FAQ confirms the chain shape: crafted email → OWA render → script execution → spoofing actions taken under the victim's authenticated OWA context. Affected versions are Exchange Server 2016 (all CU levels), Exchange Server 2019 (all CU levels), and Exchange Server Subscription Edition (RTM and current CUs); Exchange Online is unaffected.

Exploitation status and attribution. Microsoft confirmed Exploitation Detected on 2026-05-14 with the published advisory (Microsoft MSRC, 2026-05-14). The NCSC Switzerland Cyber Security Hub independently restated the active-exploitation finding in advisory #12577 on 2026-05-15 (NCSC-CH Security Hub #12577, 2026-05-15). CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-05-15 with a federal civilian-branch remediation deadline of 2026-05-29; per PD-13 in this brief series, that deadline has no jurisdictional weight in Switzerland or the EU and is recorded here only as confirmation of the exploitation signal — defenders should drive the remediation timeline off the Microsoft-confirmed active exploitation, not the BOD 22-01 date. No named threat-actor attribution has been published; Microsoft notes the scale and identity of the exploitation activity are not yet detailed publicly (The Hacker News, 2026-05-15).

Attack chain. From the limited disclosure, the operationally credible kill chain is:

  1. T1566.001 Phishing: Spearphishing Attachment — attacker delivers a specifically crafted email to a target whose mailbox is hosted on a vulnerable on-premises Exchange Server.
  2. T1059.007 Command and Scripting Interpreter: JavaScript — when the target opens the message in OWA, browser-side JavaScript executes in the OWA origin's context.
  3. T1185 Browser Session Hijacking — payload reads OWA session cookies / auth tokens and exfiltrates to attacker-controlled infrastructure.
  4. T1078 Valid Accounts — attacker re-uses the exfiltrated session material to issue authenticated OWA requests as the victim, with full mailbox read/send privileges.
  5. T1534 Internal Spearphishing — onward phishing from the now-trusted internal sender to high-value recipients (executives, finance, identity admins), spreading the access.

EEMS — what it does, when it doesn't apply. The Exchange Emergency Mitigation Service is a small Windows service installed by the Exchange setup process on Exchange 2016 CU22 / Exchange 2019 CU11 and later; it polls a Microsoft-hosted Office Config Service endpoint hourly for new mitigation rules and applies URL-rewrite rules to the IIS configuration when one matches the server's installed Exchange version. For CVE-2026-42897, Microsoft has published Mitigation M2, which rewrites the specific request format the in-the-wild exploit uses to deliver the XSS payload — the mitigation does not require an Exchange restart and applies automatically on any internet-connected, EEMS-enabled Exchange server (Microsoft Exchange Team, 2026-05-14). EEMS does not apply automatically in the following operationally common configurations: (a) Exchange Server 2013, on which EEMS is not available; (b) Exchange servers with no outbound HTTPS connectivity to officeclient.microsoft.com (air-gapped networks, segmented DMZs, environments with strict egress controls); (c) Exchange servers where EEMS has been manually disabled (Set-OrganizationConfig -MitigationsEnabled $false, Set-Server -MitigationsEnabled $false, or via Group Policy); (d) Exchange servers that have been hardened with custom IIS rewrite rules that conflict with the EEMS rule placement. For all four cases, operators must run the Exchange On-Premises Mitigation Tool (EOMT) — downloadable from aka.ms/UnifiedEOMT — via the Exchange Management Shell as Administrator, which applies the same URL-rewrite Mitigation M2 manually.

EEMS verification — what to actually run on every Exchange server. The canonical check is:

  • Get-ExchangeDiagnosticInfo -Server <server> -Process MSExchangeHMWorker -Component EemsMitigation -SettingName MitigationsApplied and confirm the Mitigation M2 identifier published in the MSRC advisory appears in the output.
  • Get-OrganizationConfig | Select-Object MitigationsEnabled and Get-Server <server> | Select-Object MitigationsEnabled should both return True.
  • IIS Manager → Default Web Site → URL Rewrite should show the EEMS-injected rewrite rule corresponding to CVE-2026-42897.

If any check fails, run EOMT immediately; do not wait for the next EEMS poll cycle.

Permanent-patch availability — the Period 2 ESU constraint. Microsoft has signalled that the permanent fix will ship as a CU for Exchange Server Subscription Edition (publicly available SU) and as a security update for Exchange 2016 CU23 and Exchange 2019 CU14 / CU15 — but the Exchange 2016 / 2019 updates will only be distributed to organisations enrolled in the Period 2 Exchange Server Extended Security Update programme (Microsoft Exchange Team, 2026-05-14). Any Swiss or European public-sector organisation running Exchange 2016 / 2019 in production today should verify ESU enrolment status with its Microsoft licensing partner before relying on the permanent update path; organisations that are not enrolled face a structural constraint where EEMS Mitigation M2 is the permanent operational mitigation, not the bridge.

Hunt and detection concepts. The mitigation prevents future exploitation; it does not retroactively detect or remediate prior exploitation. Defenders should look back to 2026-05-09 (a generous overlap window prior to public disclosure):

  • IIS access logs (front-end Exchange role) — /owa/ URLs with <script>, javascript:, or HTML-encoded equivalents in query strings; OWA URLs with anomalous referrer headers from external mail-rendering paths.
  • Exchange transport logs — emails with HTML bodies that embed encoded JavaScript fragments delivered to mailboxes whose owners are OWA users (cross-correlate with Get-CASMailbox -OWAEnabled $true).
  • EDR telemetry on Exchange front-end servers — w3wp.exe (IIS worker process, Exchange app pool) spawning unexpected children (cmd.exe, powershell.exe, cscript.exe, browser launchers) is the post-exploitation tell of XSS-to-execution chains observed in prior Exchange compromises.
  • Exchange Application Event Log EID 4 (MSExchange Management) — for EEMS mitigation-state changes; flag any disable / re-enable cycle that does not correspond to a documented change.
  • OWA session anomalies — Get-MailboxAuditLog for unusual mailbox-folder reads or message-send activity from sessions whose source IP differs from the user's established pattern.

Hardening and mitigation. The non-negotiable immediate action is verifying EEMS Mitigation M2 is applied on every Exchange Server 2016, 2019, and SE in the estate and applying EOMT where it is not. Beyond that, defenders should: (a) confirm Period 2 ESU enrolment for any Exchange 2016 / 2019 production deployment that is not on a migration path to SE or Online; (b) restrict OWA access at the perimeter to users behind Conditional Access compliant-device policy where possible, reducing the population of XSS-deliverable mailboxes; (c) plan migration to Exchange Server SE or Exchange Online — repeated EEMS-only mitigations across the 2021–2026 Exchange CVE history are the operational signal that on-premises Exchange has become structurally expensive to defend on the 2016 / 2019 codebases.

6. Action Items

  • Verify EEMS Mitigation M2 deployed on every on-premises Exchange Server 2016 / 2019 / SE — and apply EOMT manually on air-gapped / EEMS-disconnected / hardened servers. CVE-2026-42897 is actively exploited with no permanent patch; EEMS auto-applies the URL-rewrite mitigation only on Exchange 2016 SP1+ with outbound HTTPS to officeclient.microsoft.com. Run Get-ExchangeDiagnosticInfo -Server <name> -Process MSExchangeHMWorker -Component EemsMitigation -SettingName MitigationsApplied on every Exchange server; where the M2 identifier is absent, download and execute EOMT from aka.ms/UnifiedEOMT as Administrator. Then look back to 2026-05-09 in IIS access logs on the front-end Exchange role for /owa/ URLs with script-injection payloads — EEMS prevents future exploitation, not prior. See § 2 (CVE-2026-42897 entry) and § 5 (Deep Dive).

  • Confirm Period 2 Exchange Server Extended Security Update enrolment for any Exchange 2016 / 2019 production deployment. The permanent CVE-2026-42897 fix for Exchange 2016 / 2019 will be distributed only to Period 2 ESU-enrolled organisations; Exchange SE will receive a publicly available SU. CH/EU public-sector organisations on Exchange 2016 / 2019 should verify ESU enrolment status with their Microsoft licensing partner this week — and where enrolment is not in place, treat EEMS Mitigation M2 as the permanent operational control until migration to Exchange SE or Exchange Online completes. See § 5 (Deep Dive, "Permanent-patch availability" paragraph).

  • Inventory every node-ipc install across developer workstations and CI/CD runners (transitive deps included); rotate every credential accessible from any environment that installed 9.1.6 / 9.2.3 / 12.0.1. Run npm ls node-ipc against every project; flag any install whose timestamp falls between 2026-05-14 publish-time and registry removal. Treat any match as a full developer-secret compromise: cloud SDK profiles, SSH keys, Kubernetes contexts, GitHub / npm / Git tokens, Terraform state, .env files, and macOS Keychain databases were all in scope. Going forward, enforce npm ci --ignore-scripts and lockfile-based installs in CI, monitor outbound DNS to the bt.node.js suffix, and add domain-expiry monitoring for maintainer email domains of critical dependencies. See § 1 (node-ipc entry).

  • Apply the OpenClaw / Clawdbot 2026-04-23 fixes (GHSA-5h3g-6xhh-rg6p / wppj-c6mr-83jj / r6xh-pqhr-v4xh / x3h8-jrgh-p8jx) or block OpenClaw instances from the internet; audit plugin supply chain. The Claw Chain (CVE-2026-44112 CVSS 9.6 + CVE-2026-44115 / 44118 / 44113) requires code execution inside the sandbox boundary — but the chain's entry point (malicious plugin install, prompt injection, or supply-chain compromise of a plugin) is realistic for any environment running OpenClaw against untrusted inputs. Where the fix release cannot be deployed immediately, remove public internet exposure of the OpenClaw management interface; review installed plugins and rotate credentials accessible from the agent context. See § 2 (Claw Chain entry).

  • Apply the May 2026 Microsoft Windows cumulative update — confirms AMD microcode mitigation for AMD-SB-7052 / CVE-2025-54518 is installed on Zen 2 hosts; apply Xen XSA-490 on bare-metal hypervisors. Local privilege-escalation primitives with hypervisor-isolation implications matter for any multi-tenant context: VDI estates, university HPC clusters, cloud-hosted VMs on Zen 2 silicon. For Linux hypervisors apply distro kernel + microcode updates (Fedora has shipped corresponding bodhi updates per NCSC-NL CSAF); for Lenovo hardware consult Lenovo PSIRT for BIOS / UEFI guidance. See § 2 (AMD-SB-7052 entry).

  • Add the BlackFile vishing → AiTM → rogue-MFA → SharePoint-API exfiltration detections to M365 / Okta monitoring. Concretely: alert on Okta system.multifactor.factor.setup events without a preceding user-initiated session; alert on M365 audit FileAccessed events with AppAccessContext.ClientAppId == d3590ed6-52b3-4102-aeff-aad2292ab01c AND user-agent containing python-requests or PowerShell; require Conditional Access compliant-device for Graph API access by administrative accounts; move helpdesk-privileged accounts to FIDO2 phishing-resistant MFA so the live-vishing capture-and-replay chain fails at the second factor. See § 1 (BlackFile entry).

  • Hunt for Kazuar P2P artefacts on systems hosting European government, diplomatic, or defence workloads. Concretely: Sysmon EID 17 / 18 for Mailslot creation from non-standard processes; registry audit on HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages for unsigned DLL additions; flag programmatic Exchange Web Services authentication originating from non-Exchange processes against the organisation's own mail servers. Where Aqua Blizzard / Gamaredon presence has been previously detected, treat Kazuar implant presence as a concurrent hypothesis. See § 1 (Secret Blizzard entry).

7. Verification Notes

  • Items dropped (duplicate of prior coverage):
    • Exim CVE-2026-45185 ("Dead.Letter" pre-auth heap UAF via BDAT/GnuTLS) — already covered as a § 2 Trending Vulnerability in briefs/2026-05-13.md (primary source XBOW research blog 2026-05-12). S1's re-surfacing in this run includes the discoverer attribution (Federico Kirschbaum / XBOW) and patch detail (4.99.3 fixes by resetting input-processing stack on TLS close_notify during BDAT) — none of which constitute material new development under PD-8. No § 4 UPDATE warranted.
  • Items dropped / deferred (out-of-window recency, PD-7):
    • Microsoft IR case study "Undermining the trust boundary — 106-day stealth intrusion via trusted HPE Operations Manager (HPOM)" (Microsoft IR, 2026-05-12): primary source published 2026-05-12, more than 36 h before this run's start; no fresher in-window development. Substantive technical research with strong defender takeaways (HPOM VBScript push as living-off-trusted-tools persistence, Updater.dll network-provider DLL credential interception, 106-day undetected dwell) — deferred to the weekly summary for cross-day consolidation. out-of-window: primary source 2026-05-12, window_hours=36.
    • Cushman & Wakefield vishing breach (ShinyHunters Salesforce CRM data + Qilin separate listing): initial disclosure 2026-05-05, victim statement 2026-05-05, HIBP indexing 2026-05-12. All evidence dates fall outside the 36-hour window. Pattern (vishing → SaaS-CRM credential capture → bulk record exfil) is consistent with previously-covered ShinyHunters operations and adds no fresh TTP. out-of-window: primary sources 2026-05-05 to 2026-05-12, window_hours=36.
  • F5 BIG-IP / BIG-IQ May 2026 Quarterly Security Notification (K000160932): NCSC-NL flagged the bundle as HIGH on 2026-05-15 (NCSC-NL NCSC-2026-0162, 2026-05-15). Per-CVE enumeration requires authenticated myF5 portal access and could not be obtained from the public CSAF excerpt in this run. Operators of F5 BIG-IP / BIG-IQ in Swiss financial-sector, telco, and large public-sector perimeters should pull the K-article matrix directly; we will surface the per-CVE detail in the next brief that pivots through an authenticated review or a corroborating researcher write-up.
  • Sub-agent telemetry: S1 returned (Claude Sonnet 4.6, 236 s, 7 webfetch + 6 websearch + 18 bridge). S2 returned (Claude Sonnet 4.6, 245 s, 14 webfetch + 8 websearch + 12 bridge). S3 returned (Claude Sonnet 4.6, 616 s, 12 webfetch + 0 websearch + 8 bridge). S4 returned (Claude Sonnet 4.6, 524 s, 12 webfetch + 12 websearch + 11 bridge).
  • Item-overlap consolidation: CVE-2026-42897 Exchange OWA XSS was independently surfaced by S1, S2, S3, and S4 — consolidated into one § 2 item, one § 5 deep dive, and the § 0 Immediate Action callout, with sources pooled across all four sub-agent returns. Kazuar / Secret Blizzard was surfaced by S2 and S3 — consolidated into one § 1 item. node-ipc npm was surfaced by S3 and S4 — consolidated into one § 1 item.
  • Single-source items: Gremlin Stealer evolved (Palo Alto Networks Unit 42, 2026-05-15) — sole reputable primary, no independent corroboration found in window. SentinelOne "Living Off the Pipeline" CI/CD subversion taxonomy (SentinelOne, 2026-05-15) — sole primary; the analytical content draws on prior public CVE-2023-42793 / Contagious Interview reporting, but the synthesis is single-sourced.
  • Coverage gaps / fetch failures:
    • databreaches-net: WebFetch returned 403 (5th consecutive run failing); WebSearch fallback used for breach-story discovery, no unique stories lost in this run. Rotation-priority signal preserved for the next run.
    • inside-it-ch: Cloudflare Managed Challenge blocked WebFetch (4th consecutive run); WebSearch fallback found no CH-specific items beyond what NCSC-CH posts surfaced. Rotation-priority signal preserved.
    • bleepingcomputer: rotation-priority source — multiple article URLs returned 403; URLs successfully fetched by S2 (e.g. the Microsoft Exchange zero-day article) used after cross-confirmation; broader feed listing not enumerated.
    • helpnetsecurity: rotation-priority source — known 429 rate-limit; one article cited (CVE-2026-42897 coverage) fetched successfully and corroborated.
    • cert-eu: no new advisories in the 36-hour window (latest 2026-006 dated 2026-05-06).
    • anssi-fr (CERT-FR): most recent avis bulletins outside the 36-hour window (latest 2026-05-12 / 13).
    • sophos-xops: feed returned HTTP 503; no items retrieved this run.
    • sekoia: no new posts in window (latest 2026-04-23).
    • cert-pl: SPA listing not navigated this run.
    • cnil-fr: site under scheduled maintenance 2026-05-13 to 2026-05-18 per maintenance notice.
    • sec-disclosures-edgar: SEC EDGAR Item 1.05 bridge returned 0 cyber-disclosure filings for the 2026-05-12 to 2026-05-16 window — quiet period for material cyber disclosures.
  • Coverage gaps: databreaches-net (403 5×); inside-it-ch (Cloudflare 4×); cert-eu (no in-window advisories); anssi-fr (no in-window AVI); sophos-xops (feed 503); sekoia (no in-window posts); cert-pl (SPA listing not navigated); cnil-fr (scheduled maintenance); sec-disclosures-edgar (no in-window 8-K Item 1.05 filings).
  • Verification status: CLEAN at iteration 4 (4 iterations, model-rotated). Iter 1 (Opus): 4 truth findings (Period 2 ESU citation, BlackFile ClientAppId location, Gremlin SetClipboardViewer API, node-ipc 822K download count) — all fixed. Iter 2 (Sonnet): 2 truth + 1 editorial + 2 advisory (AMD-SB-7052 CVE/CVSS missing → CVE-2025-54518 CVSS 7.3 added, node-ipc DNS TXT count unsupported → dropped, Gremlin detection SetClipboardViewer still unsupported → softened, Fedora/Lenovo advisory IDs unverified → IDs dropped, helpdesk-priviledged typo) — all fixed. Iter 3 (Opus, cold): 4 truth + 1 advisory (Gremlin Brave browser, OpenClaw "2026.4.22" version label, Kazuar "European" narrowing, SentinelOne Sha1-Hulud pattern claim, Aqua Blizzard paraphrase strength) — all fixed. Iter 4 (Sonnet, with deltas): CLEAN — all iter-3 remediations verified correct against re-fetched primary sources. verification_residual_count: 0.