2026-06-22-dece656d

• Items dropped:
  • NCSC UK — "75% of CNI incidents attributed to state actors" (RUSI lecture, 2026-06-17): primary source outside the window (≈5 days) and the framing is strategic-arc / long-horizon, which belongs to the weekly lens under PD-8. Deferred to the weekly.
  • Prinz Eugen ransomware (ThreatDown / BleepingComputer, 2026-06-20): already covered as the 2026-06-21 deep dive with no material new development this run (PD-8). The S4 return re-surfaced it; not re-reported.
  • INC Ransomware Rust/BYOVD evolution (Acronis TRU 2026-06-10; The Hacker News 2026-06-18): already consolidated in the weekly 2026-W25 research roll-up, and the primary source is outside the window — the daily does not repeat the weekly (PD-8).
  • BabaDeda Loader (Morphisec, 2026-06-16): primary source ≈6 days old, outside the 72 h developing window; single-source. Dropped on recency.
  • FulcrumSec / Global Schools Group injunction-failure UPDATE (claimed 2026-06-20): the delta-bearing primary (DataBreaches.net) returned HTTP 403 and was not bridge-fetchable this run; the reachable corroborator (Bar and Bench, 2026-06-19) documents only the granting of the Bombay High Court injunction, not its reported failure; CH/EU nexus is marginal (indirect, via one UK campus). Dropped rather than cite an unfetchable primary for the load-bearing claim.
• § 2 intentionally empty: no newly-disclosed or freshly-weaponised standalone CVE cleared the § 2 gates in-window. CVEs examined and excluded as already-covered or out-of-window: CVE-2026-4020 (Gravity SMTP — covered 2026-06-21), CVE-2026-20253 (Splunk — covered 2026-06-14/20), CVE-2026-12569 (PTC Windchill — covered 2026-06-20), CVE-2026-42271 (LiteLLM), CVE-2026-48558 (SimpleHelp) — sources outside window. No new CISA KEV additions since 2026-06-18 (CVE-2026-20253). The AryStinger CVEs (CVE-2013-3307, CVE-2016-5681, CVE-2025-11837) are covered in § 5 as the botnet's access vectors, not as standalone trending vulns.
• Single-source / reduced-confidence items:
  • Brazil Cell Broadcast hijack (§ 1): [SINGLE-SOURCE] on primary technical detail — The Next Web is the reachable primary; the Bloomberg corroborator returned HTTP 403 this run. Confidence MEDIUM: the access vector is undisclosed and the Federal Police investigation is open.
  • eBanking IPv4-mapped IPv6 phishing (§ 3): [SINGLE-SOURCE] — SANS ISC (handler diary). Accepted under the PD-5 carve-out (SANS ISC as HIGH-reliability disclosing party for its own observation). Confidence HIGH on the technique.
• Recency notes: the eBanking diary (SANS ISC, 2026-06-19) sits at the 72 h developing-window edge, outside the 36 h standard window; included because the technique is freshly weaponised and directly actionable for CH/EU financial defenders. AryStinger's XLab primary (2026-06-17) is outside the 36 h window, but the in-window BleepingComputer coverage (2026-06-21) anchors the item; first-coverage in this brief.
• Contradictions: none material this run.
• Sub-agents: all four returned (S1–S4, Claude Sonnet 4.6). Note: S2 and S3 findings-YAML ended_at values were internally inconsistent with their return **Timestamps:** lines; state/run_log.json uses the verbatim return-line values.
• Source list: one new candidate added this run — swisscybersecurity-net (Swiss cybersecurity trade press; surfaced by S4 covering the EFK audit).
• Quiet-day note: in-window signal was genuinely thin — no new KEV additions, CH/EU national-CERT advisory feeds (NCSC-CH, CERT-EU, NCSC-NL, ANSSI, BSI) all last posted 2026-06-19 or earlier. Brief size reflects signal, not omission.
• Coverage gaps: databreaches-net (article-level HTTP 403, not bridge-fetchable — RSS listing only); inside-it-ch (article-level HTTP 403 — RSS listing only); group-ib (HTTP 503); bloomberg (HTTP 403); cisco-psirt (RSS timeout); chrome-releases (RSS 302); ncsc-ch-security-hub, cert-eu, ncsc-nl, anssi-fr, bsi-de, cnil-fr, sec-disclosures-edgar, volexity, recorded-future-insikt, mandiant-gtig, dragos — reachable, no in-window qualifying items.

Unmatched action items (migrated)

• Inventory and replace end-of-life D-Link edge devices; patch QNAP Malware Remover (§ 5, AryStinger). DIR-850L / DIR-818LW and same-era RTL819X models have no firmware path — replace them. Bring QNAP Malware Remover to 6.6.8.20251023+. Hunt for unexpected SSH daemons on non-standard ports and out-of-band iptables changes on Linux network/NAS appliances, and for high-volume outbound DNS from edge/IoT VLANs.
• Confirm your federal/cantonal Cyber Security Hub data-sharing posture (§ 1, EFK audit). Because BACS cannot forward incident data to SEPOS/FS BIS without the originating agency opting in, verify whether SEPOS sharing is enabled for your reports — "reported to BACS" does not guarantee the strategic-oversight layer received it.
• Harden the emergency-alert administration plane (§ 1, Brazil Cell Broadcast). For ALERTSWISS/EU-Alert operators: enforce MFA and PAM on broadcast-console admin accounts, apply least-privilege to broadcast-issuing roles, and add anomaly detection on outbound broadcast commands (severity tier, volume, off-hours issuance).
• Test mail/web URL inspection against IPv4-mapped IPv6 notation (§ 3, eBanking phishing). Confirm your gateway/proxy normalises [::ffff:<ipv4>] to its IPv4 form before reputation lookup; extend URL-extraction regex to match \[::ffff:[0-9a-fA-F:]+\]; treat bracketed-IPv6 URLs in inbound mail as high-suspicion.

Migrated from briefs/2026-06-22.md (v2).