2026-07-05T1208Z-intel

Verification & coverage notes

Quiet 8 h intraday intel run (gap 6 h since the 2026-07-05T06:09Z fire; window_hours=8, opening ~2026-07-05T04:09Z with the +2 h overlap). All four research sub-agents (S1–S4) swept their full essential + standard-rotation slices and each returned zero in-window candidates — a healthy quiet intraday window (PD-7: ≤12 h gap ⇒ 0–4 entries, zero expected on most intraday fires). No entry composed; no deep-dive candidate. This is the correct outcome, not a coverage failure — the mission is minimum-latency publication of new signal and nothing else. Independently corroborated by the immediately preceding 06:09Z run, which also returned zero across S1–S4 on an overlapping slice.

• Included (0): nothing cleared the recency gate. Every lead surfaced across the four domains was either already in prior_coverage.json or had its freshest available source published before the ~2026-07-05T04:09Z window floor with no in-window delta.
• Out-of-window / already-covered leads examined and dropped (no in-window delta):
  • out-of-window: Adobe ColdFusion / Campaign Classic exploitation follow-up (CVE-2026-48282 active exploitation "within hours", plus CVE-2026-48313/-48315/-48286) — primary source 2026-07-01, window_hours=8 (S1) — a genuine delta on the 2026-07-02 ColdFusion entry, but its freshest available source is older than the entry it would update and outside the 72 h developing-window floor (2026-07-02T12:08Z); flagged for a future run if a fresher source appears.
  • out-of-window: FortiBleed → INC/Lynx ransomware attribution (SOCRadar STRU + press) — primary source 2026-07-01/02, window_hours=8 (S1) — first confirmed link between mass FortiGate credential harvesting and ransomware deployment; materially new on incident:fortibleed-fortigate-credential-exposure but 3+ days stale and outside the 72 h developing-window. Flagged for the next run / the weekly W1 long-running-campaign sweep.
  • out-of-window: Romania Hipocrate hospital ransomware retrospective — underlying event Feb 2024, resurfaced 2026-07-02 blog (S2) — recycled anniversary rewrite, not fresh signal.
  • ToddyCat/Umbrij OAuth-token theft (Securelist 2026-06-30), Armored Likho/BusySnake (Securelist 2026-07-03), JADEPUFFER agentic-ransomware (already covered 2026-07-04), ChocoPoC trojanized-PoC campaign (2026-07-01/02), PRODAFT "The Gentlemen" RaaS deep-dive (~10 days old, entity actor:thegentlemen already tracked), OneConsult "BravoX" DACH ransomware note (2026-06-29) — all S3, all freshest sources outside the 8 h window with no delta on prior coverage.
  • MedusaLocker / Canton Zürich Baudirektion leak-site listing (S2) — already covered 2026-07-02; no material delta (claim status unchanged, no victim statement located).
  • AdaptHealth / Navient / 8x8 / River Financial 8-K filings, Medtronic, Kairos extortion (S4) — all already in prior_coverage.json or their underlying incidents out-of-window; SEC EDGAR Item 1.05 search surfaced no new in-window filer.
• Fake-news / leak-site claims investigated and dropped (PD-6):
  • Ferrum AG (Rupperswil, CH; industrial-machinery manufacturer) on the Anubis leak site (attackdate 2026-07-03) — no victim statement (ferrum.net, Swiss press incl. watson.ch checked) and no HIGH-reliability journalism; only low-reliability aggregator mirrors. Per verification.md's leak-site rule this cannot run as more than "group X claims"; combined with the 2+-day-stale, no-in-window-delta status it does not clear this run's gate. Flagged for a future run's pickup if Swiss press (inside-it.ch, NZZ, watson.ch) or NCSC-CH corroborates — this is the one home-region lead worth watching.
  • A "Deutsche Bank" claim by a previously-unseen leak-site actor ("unsafe", attackdate 2026-07-04) — dropped outright as a textbook inflated/fabricated leak-site claim (G-SIB target + unknown extortion brand + zero corroboration beyond leak-site mirrors).
• Single-source: none (no entries).
• Contradictions: none.
• Sources changed: inside-it-ch — rss_url set to the confirmed-working https://www.inside-it.ch/rss.xml (S2 re-confirmed /feed 403s, /rss.xml returns dated items via bridge); metadata-drift correction only, no tier/status change. No new candidate surfaced (one-per-run cap unused this quiet window); no demotions (all misses this run are transport-403 blocks, which never demote per the lifecycle rules).
• Coverage gaps: cisa-advisories, cisa-directives, cisa-news (403 on the listing-page bridge recipe — KEV JSON API substituted for exploitation ground truth; the HTML listing pages still need a working sub-path recipe); industrialcyber-co (403 on both plain WebFetch and the bridge — recipe re-check recommended); ncsc-uk (client-side-rendered SPA shell, server body carries only nav chrome — needs a structured endpoint/RSS investigated); govcert-at (rss.xml 404; German-only daily reports not linked from the fetched shell); cert-eu (feed ~monthly, newest 2026-006/2026-06-10); cert-fr (avis newest CERTFR-2026-06-26; actualité feed stuck on an Oct-2025 backlog — noted for source-health review, bridge call returned 200); enisa / cert-pl (200 but nothing in-window); prodaft, sans-newsbites, claroty-team82, projectzero (JS-rendered SPA shells or no in-window dated items — recipe gaps).
• Watchlist: not reported — config/org-profile.yaml configures no product or supplier watchlists; S1/S4 sweep duties were documented no-ops.
• Essential-coverage: cisa-advisories, cisa-directives missed (403 transport-block; KEV API substituted for the exploitation signal). All other essential sources (advisories-ncsc-nl, anssi-fr, bsi-de, cert-at, cert-eu, cert-pl, cisa-kev, enisa, ncsc-ch-focus, ncsc-ch-incidents, ncsc-ch-security-hub, ncsc-uk) were attempted and resolved.