2026-06-21-2b75e32c

• Items dropped:
  • PTC Windchill / FlexPLM CVE-2026-12569 — surfaced again by S2 (NCSC-CH #12713, BSI after-hours outreach) but covered in full on 2026-06-20 (deep dive + § 0 Immediate Action callout + § 2). No material new in-window development (no new victim, CVE, patch or attribution), so not re-reported per PD-8. CVSS is consistent with the prior coverage (10.0 CVSS 3.1 / 9.3 CVSS 4.0).
  • INC ransomware "830+ victims" report (Acronis TRU / The Hacker News) — the primary (Acronis TRU) is dated 2026-06-10, outside both the 36 h and 72 h windows; the only near-window source is an aggregator synthesis (The Hacker News, 2026-06-18) and the lead figures are vendor victim-count metrics. Dropped per PD-7 (out-of-window primary) and PD-4 (vanity metrics). The technical substance (Rust-rewritten Windows/Linux encryptors, BYOVD EDR evasion, a Veeam-targeting credential dumper, and initial access via known Citrix NetScaler, Fortinet EMS, SimpleHelp and Citrix Bleed 2 exploits) may warrant pickup by the weekly if it stays current.
  • Sophos X-Ops AI infostealer-triage pipeline — Sophos blog dated 2026-06-16, outside the window and single-source; included by S3 only to honour the sophos-xops rotation obligation. Dropped per PD-7.
• Single-source items (PD-5):
  • HCRG Care Group notification delay (§ 1) — cited to HIPAA Pulse only; the DataBreaches.net article body returned HTTP 403 on every bridge attempt this run, so only the corroborating publication was independently readable. Core claim (16-month delay on a Feb-2025 Medusa breach) is consistent across the feed summary and HIPAA Pulse.
  • One Medical / ShinyHunters (§ 1) — cited to BankInfoSecurity only; One Medical's own security-event-notice page was not reached in this run and is therefore not cited. The 8.8 TB figure and the 2026-06-22 deadline are ShinyHunters' unverified claims, not confirmed facts.
• Contradictions: Texas Parks & Wildlife SSN scope — TPWD's public statement says Social Security numbers were not involved; The Register reports the agency's own filing to the Texas Attorney General's breach portal indicates SSNs were included. The brief reports both and flags the discrepancy rather than resolving it, on the basis that the AG filing is the more formal disclosure channel.
• Reduced-confidence items: none beyond the single-source flags above.
• Recency: standard daily window (gap to prior brief 24 h; window_hours = 36, developing-window 72 h). All published items have an in-window source; § 4 UPDATEs cite an in-window delta (BleepingComputer 2026-06-20) even where the underlying primary (Microsoft 2026-06-17) is just outside the 36 h window, per the PD-7 UPDATE carve-out.
• Sub-agents: all four (S1–S4) returned within budget; none stalled.
• Tooling: the end-of-run tools/source_health.py accessibility probe did not complete within its wall-clock budget this run (timed out); state/source_health.json is unchanged from the prior run and the per-source accessibility snapshot was not refreshed. No impact on the brief; flagged for the next run.
• Coverage gaps: cert-fr (feed stale / no in-window advisory); bsi-de (no 2026-06-20/21 items in feed); ncsc-nl (no 2026-06-20/21 advisory); cert-eu (latest advisory 2026-06-10, outside window); inside-it-ch (RSS reachable but no in-window security items — recurring rotation gap, 5+ runs); databreaches-net (feed 200 but article bodies 403 via WAF — recurring rotation gap, 4+ runs); heise-sec (article bodies TollBit-gated; used RSS summary + EN edition); sec-disclosures-edgar (bridge returned HTTP 500, retry returned 0 Item-1.05 8-K filings in window); cnil-fr (no in-window enforcement actions); dragos, dfirreport, acronis-tru (no in-window primary, or 403).

Unmatched action items (migrated)

• Close the RDP-credential initial-access path and audit RMM tooling against the Prinz Eugen pattern (§ 5). Restrict RDP to VPN/jump-host with MFA, inventory and revoke dormant RemotePC/RMM licences, and add detection for the RDP-logon-then-local-admin-creation sequence (Event IDs 4624 → 4720 → 4732). Verify frequent short-interval, access-controlled backups exist given the family's recent-files-first encryption ordering.
• Audit package-scope and private-registry ACLs for dormant accounts with retained publish rights (§ 4, Mastra/Sapphire Sleet). Enforce time-bound or MFA-gated publish tokens and revoke publish access on contributor offboarding; this is the structural control the DPRK attribution makes urgent.
• Inventory and prune OAuth grants to third-party SaaS integration platforms (§ 4, Klue/Icarus). Revoke tokens for inactive integrations, enforce IP restrictions on Salesforce connected-app policies, and add Salesforce Event Monitoring detection for python-urllib API callers and anomalous /services/data/v*/query/ volume from non-user principals.
• Bring legacy and "decommissioned" third-party storage into third-party risk scope (§ 1, One Medical / Texas / HCRG pattern). Archival systems holding clinical/PII data outside normal operational scope are the recurring breach surface; require contractual breach-notification timelines and segmentation guarantees, and reconcile any public breach statement against your regulator filing before publishing.

Migrated from briefs/2026-06-21.md (v2).