2026-06-30-9aaa1114

• Items dropped (already covered, no fresh in-window delta): Operation Endgame II (Amadey/StealC/SocGholish takedown) — covered 2026-06-25; the 2026-06-24 announcement carries no new delta. Turla STOCKSTAY — covered 2026-06-27 (that day's deep dive). The Gentlemen RaaS (new Kaspersky technical analysis, 2026-06-29) — actor covered 2026-06-27 and in the W26 weekly long-running list; a new vendor write-up does not meet the long-running-campaign "critical change" bar for a second UPDATE inside one week.
• Items dropped (relevance / lens): Germany NIS2UmsG "30 June compliance milestone" — the date is legal/advisory-firm commentary, not a formal BSI deadline (formal obligations: registration March 2026, external audits December 2028); strategic/policy-horizon framing belongs to the weekly, not the daily's 1–7-day operational lens. AssuranceAmerica MGA breach (1.1M) — US-only, no CH/EU nexus, routine single-employee phishing breach with no novel TTP or transferable lesson beyond a 90-day notification gap. Fox Rothschild / Silent Ransom Group (Luna Moth) law-firm breach — US-only with no CH/EU nexus; the only in-window source (DataBreaches.net, 2026-06-29) is a persistent 403 the verifier could not corroborate, and the verifiable corroboration (Bloomberg Law) is dated 2026-06-09, outside the 36 h window. Dropped on recency + relevance; the SRG law-firm targeting wave was already covered 2026-05-28. Malicious "Perplexity AI" extension was retained in § 3 alongside StegoAd as a fresh in-window (2026-06-29/30) browser-extension research pair.
• Citation-date corrections this run (verifier-driven): Horizon3.ai's SimpleHelp disclosure page is dated 2026-06-12 (the technical analysis); the in-the-wild exploitation / Djinn deployment / CISA KEV listing is the 2026-06-29 development cited to BleepingComputer and CISA KEV. The npm lifecycle-script-hardening month was dropped (sources disagreed). The Mustang Panda prior-SaaS-C2 history (Dropbox/Google Drive) was removed as it was not in the fetchable cited sources.
• Held for the weekly's strategic lens: Swiss BACS CYRA Aargau resilience pilot (25 organisations; Inside IT, 2026-06-29) — single-source, self-reported governance/resilience finding; strong CH public-sector relevance but off the daily's operational lens. Flag for weekly pickup if a BACS primary appears on bacs.admin.ch.
• Single-source / national-CERT primary (PD-5 carve-out): SzafirHost CVE-2026-13165 rests on CERT Polska as the disclosing authority (carve-out applies). The § 5 deep dive rests on a single primary research report (The DFIR Report), standard for incident reconstructions; the Swisscom B2B CSIRT parallel-intrusion claim is sourced from within that report (no usable standalone Swisscom URL — only a generic service page existed, which was deliberately not cited).
• § 2 inclusion notes: CVE-2026-54305/54307 (n8n) included on CVSS 8.9/8.5 plus unauthenticated trigger-execution exposure on internet-exposed instances — no public PoC or ITW exploitation reported. CVE-2026-8037 (LoadMaster) included on pre-auth RCE plus watchTowr's public technical analysis — no ITW exploitation. CVE-2026-33691 (LoadMaster file-upload extension bypass) noted as the second bulletin CVE; lower severity, no exploitation, not given its own § 2 entry.
• KEV-deadline handling (PD-13): CVE-2026-48558 carries a CISA KEV remediation deadline (2026-07-02). That US FCEB compliance date is not the operational driver — the Immediate Action callout and § 2 entry lead on active exploitation and the ~1,000 vulnerable internet-exposed instances; the cisa-kev tag reflects only the exploitation-confirmation flag.
• Contradiction: Operation Endgame II seizure figure — Europol stated €41M in crypto seized while Risky Biz News reported "$47M"; the item was dropped as already-covered, so the discrepancy is not carried into the brief body.
• Coverage gaps (carry forward): rapid7-research (a sub-agent fetched the wrong endpoint https://www.rapid7.com/blog/feed/ → HTTP 404; the documented healthy feed is https://www.rapid7.com/rss.xml — source is fine, clarifying note added to sources.json); cert-fr-actu / anssi-fr (feed stale, latest entries Nov 2025 / 2026-06-19); databreaches-net (per-article 403 persistent — covered via RSS + alternate publishers); acronis-tru (article 403 — covered via The Hacker News); mandiant-gtig (Feedburner IncompleteRead — covered via Google TI blog); inside-it-ch (article body behind Cloudflare Managed Challenge); cert-eu (no in-window advisories; latest 2026-06-10); ncsc-ch-security-hub, bsi-de, dragos, claroty-team82, ico-uk, cnil-fr, sec-disclosures-edgar, us-treasury-ofac — no new in-window items.

Unmatched action items (migrated)

• Patch or de-internet SimpleHelp RMM today if you run an OIDC-enabled, internet-exposed instance — pre-auth bypass actively exploited to drop the Djinn infostealer (see § 0 Immediate Action and § 2). Upgrade to v5.5.16 / v6.0 RC2; review Technician session logs for logins not matched to MFA/VPN events.
• Patch Progress Kemp LoadMaster to v7.2.63.2 and move the management interface to a dedicated admin VLAN — pre-auth RCE to root, full mechanics public (§ 2).
• Add .vscode/tasks.json with runOn: "folderOpen" to CI/CD repo scanning and enforce VS Code Workspace Trust — the npm/Go supply-chain implant executes on folder-open, not on install (§ 1).
• Rotate / protect Signal Backup Recovery Keys for officials in scope and re-verify the NCSC-CH Signal guidance — the Russia-nexus crews now steal recovery keys for persistent backup access (§ 4).
• Pin or rebuild libssh2 from the patched commit in CI/CD images (no release tagged yet) and surface versions via SBOM — public PoC out for the pre-auth heap write (§ 4).
• Inventory and update SzafirHost to v1.2.2 on document-signing workstations interoperating with Polish public services (§ 1).
• Extend CASB/egress allowlisting to Zoho WorkDrive and alert on OAuth grants for non-sanctioned cloud apps — Mustang Panda's dead-drop C2 hides in legitimate SaaS API traffic (§ 1).

Migrated from briefs/2026-06-30.md (v2).