2026-07-04T0609Z-intel

Verification & coverage notes

Intraday fire, gap 6 h from the previous run (2026-07-04T0009Z-intel), strict recency window 8 h (developing-story window 72 h). Three of four research sub-agents (S1 active-threats/vulns, S2 home-region/sector, S4 incidents/disclosures) returned zero in-window items — a genuinely quiet intraday window, which is the expected shape for a ≤12 h gap. Every essential home-region/EU/vuln source was attempted; near every source's freshest item predated the 8 h window (mostly by 1–3 days) or duplicated stories already in the last-7-days prior coverage.

• Borderline include (recency): both published entries. S3 surfaced two previously-uncovered research pieces whose primary sources are dated 2026-07-02 and corroborating The Hacker News write-ups 2026-07-03 — outside the strict 8 h window but inside the 72 h developing-story allowance, and verified net-new against the last-7-days prior-coverage index (no match). They fill a genuine S3 coverage gap left by successive tight intraday windows rather than re-surfacing stale beaten news. Both cited primaries were main-agent spot-checked this run (Blackpoint Cyber and Jamf Threat Labs, HTTP 200) and every evidence quote confirmed verbatim. event_date: 2026-07-02 records the true disclosure date so the reader is not misled about freshness. Priority notable for both — solid detection-relevant research, not TL;DR-worthy, not immediate-action.
• Single-source: 2026-07-04/avalon-framework-msbuild-etw-loader-crownx-ransomware — verification single-source. Sole first-hand observer is Blackpoint Cyber (Adversary Pursuit Group); the paired The Hacker News piece (2026-07-03) is a rewrite of that primary (outbound-links to and names Blackpoint's researchers) and adds no independent observation. Blackpoint is not on the national-CERT carve-out list, so plain single-source with a sourcing_note. (Verifier F12, iteration 1 — remediated.)
• Single-source: 2026-07-04/pamstealer-macos-infostealer-pam-api-password-validation — verification single-source. Sole first-hand observer is Jamf Threat Labs; the paired The Hacker News piece (2026-07-03) is a rewrite of that primary. single-source with a sourcing_note. (Verifier F12, iteration 1 — remediated.)
• Verifier F3 (iteration 1, remediated): the Avalon entry's detailed capability sentence (AES-GCM, credential-manager/SSH/RDP theft, admin-share lateral movement, scheduled tasks, WinRE/System Restore) was originally cited to The Hacker News, which does not state those specifics; re-attributed to the Blackpoint Cyber primary (confirmed against the main-agent spot-fetch of the Blackpoint post this run), with the secondary-reporting framing kept on the THN citation.
• Verifier F4 (iteration 2, Sonnet rotation, remediated): the Avalon evidence[0] quote was not a verbatim substring of the Blackpoint primary (missing leading clause + tense shift); iteration 1 (Opus) had reported it verbatim, so the Sonnet rotation caught what the Opus pass missed — the model-rotation design working as intended. Fixed by re-fetching the primary and restoring the exact sentence; a fabricated trailing period on evidence[1] was also trimmed.
• borderline-drop: Ferrum AG (Switzerland) Anubis ransomware leak-site claim — single-source leak-site claim only (ransomware.live / aggregator mirrors), no victim statement or HIGH-reliability journalism on cross-check; fails PD-6 fake-news guard AND primary source ~29 h outside the window. Left as a watch item for a future run if the victim confirms or the press corroborates.
• Coverage gaps: cisa-advisories, cisa-directives, cisa-news (bridge HTTP 403, 3rd consecutive run — KEV API used as exploitation-signal fallback); cert-eu (advisories RSS lags ~3–4 weeks — recipe re-audit recommended); anssi-fr (actu/alerte bridge feed stale through 2025-11-24 — recipe re-audit recommended); ncsc-uk (reports-advisories JS-rendered; bridge returns nav chrome only, HTML fallback newest item 2026-04-07 — stale); prodaft (bridge returns Next.js SPA shell only); sans-newsbites (JS-driven archive returned no issue links); claroty-team82 (listing carries no per-post dates via bridge or WebFetch).
• Watchlist: none configured — sweep is a no-op (S1 products checked=0/hits=0; S4 suppliers checked=0/hits=0).
• Essential-coverage: cisa-advisories, cisa-directives, cisa-news not fetched (HTTP 403 bridge, transport-blocked; KEV covered the exploitation-confirmation function).
• Source-health probe (tools/source_health.py, 96 ok / 52 bridge-ok / 2 client-error / 3 bridge-fail): CISA advisories/directives/news flagged needs-demote by the probe, but NOT demoted — HTTP 403 is transport blocking, which the source-lifecycle rules explicitly exclude from content-axis demotion (only consecutive_fetch_failures bumped). github-advisory flagged needs-bridge (browser UA HTTP 403) — deferred: no verified bridge recipe was constructible this run without over-fetching; logged for a future run's recipe work rather than committing an unverified recipe.