2026-07-10T0409Z-intel

Verification & coverage notes

A standard-class window (gap ~16 h from the previous fire 2026-07-09T1211Z-intel; 24 h floor applied). The previous run record carries no publish_status (null) — its Phase 7 publish-status amendment was not recorded, so the operator cannot confirm from state alone that the 07-09 12:11 run reached the site; flagged here for awareness. S1–S4 all returned (Sonnet 5, per each agent's harness-injected model line); no S5 (no in-window intel/ drops). Six items cleared the gate: one deep dive (CitrixBleed 2 IAB kill chain), two high research/threat entries, three notable incidents (one an update_of). Two high entries, zero critical — consistent with a real-but-unspectacular window.

• Deep dive rationale: the CitrixBleed 2 → DragonForce IAB kill chain (STAC3725) clears deep-dive criterion 1 (active in-the-wild exploitation of a widely-deployed remote-access gateway with non-trivial exposure across Swiss/EU critical infrastructure) and carries the rare, mechanically-detailed tradecraft — a registry-symlink/AppMgmt SYSTEM escalation and session-token replay — that earns the long-form treatment. Category firewall-vpn-rce; no firewall-vpn-rce or ransomware-affiliate deep dive in the prior 7 days, so rotation is satisfied. window24h.deep_dives_today was 0 before this run.
• Single-source / carve-out: cert-lv-lvm-olpha-ransomware — primary disclosure is CERT.LV (Latvia's national CERT for its own jurisdiction — Admiralty A carve-out); incident facts are corroborated by The Record and Latvian press, but CERT.LV's assessment that the same actor has hit other NATO/EU institutions is a single-authority claim, stated as such in the entry's sourcing note (classification A2).
• Reduced-confidence inclusion: e-government-portal-watering-hole-cms-implant-espionage — confidence: medium, classification B3. Out-of-nexus by victim (Pakistani law enforcement); included under the breach/incident gate on (b) a transferable TTP — a citizen-and-staff e-government portal weaponised as a watering hole via a disguised "portal update" that reflectively loads a RAT — and (c) China-nexus actors that plausibly also target EU government. Framed on the transferable technique for public-sector portal operators (EU-supported "Smart Police Station" programme is the concrete hook), never the victim.
• Update vs new: odido-shinyhunters-vishing-dutch-police-attribution initially drafted as an update_of the June MSG ShinyHunters vishing entry, then converted to a standalone incident entry after the iteration-1 verifier noted (F11) that update_of semantically targets the same incident, whereas MSG and Odido are distinct victims and store precedent ships each ShinyHunters victim standalone. It now cross-links the earlier vishing playbook via references[]; the ShinyHunters vishing-to-spoofed-portal TTP is not re-taught, and the in-window hook is the 9 July Dutch police voice-analysis attribution plus two open Dutch DPA investigations (the underlying breach event is February 2026 — event_date reflects it, the entry is anchored on the in-window development).
• Dedup note: CVE-2025-5777 (CitrixBleed 2) is in cves_seen (recorded 2026-07-01 as lineage context for the CVE-2026-8451 entry) but appears in no 14-day entry's structured cves[], so the new threat entry carries it without a cross-run duplicate. The entry is about the STAC3725 kill chain (new tradecraft), not a re-coverage of the CVE.
• Nextcloud: S2 and S4 independently surfaced the same exposure; merged into one entry under the canonical key incident:nextcloud-gmbh-elasticsearch-exposure-2026. The inside-it.ch article (https://www.inside-it.ch/datenleck-bei-nextcloud-20260709) 403'd on WebFetch and jina, so it is NOT cited — the entry stands on Cybernews (discoverer/primary) + heise online, both fetched 200.
• borderline-drop: Sonatype Q2 2026 Open Source Malware Index (S3) — single-source and dominated by count-based figures (1.8M cumulative packages, 96.6% npm share); the genuinely-new deltas (install-time/CI execution point; PyPI/NuGet secrets-exfiltration skew) are marginal and substantially covered by prior npm supply-chain coverage. Dropped as an awareness/statistics roundup, not signal.
• borderline-drop: Gitea Docker CVE-2026-20896 (S1) — genuinely new to the store, but the freshest sourcing is 2026-07-06/07 with no in-window development; out-of-window.
• borderline-drop: Hermes WebUI CVE-2026-58122 (S1) — fresh in-window disclosure (2026-07-09) but no exploitation, no public PoC, no confirmed internet-exposure count; fails the "action beyond the regular patch cycle" bar.
• borderline-drop: leak-site claims for a French commune (Castries, "payload" group) and a Swiss fiduciary (PB Fiduciaire SA, "bravox" group) (S4) — both in-window and CH/EU-nexus, but neither has victim disclosure nor independent corroboration; fail the fake-news gate.
• borderline-drop: AssuranceAmerica (US insurer, ~7M records) and the Greek Intellexa/Predator lawsuit update (S4) — no CH/EU nexus / no transferable TTP, and a civil-litigation update on a known 2022 incident, respectively.
• Coverage gaps: ncsc-uk (consent-banner shell via WebFetch + jina for S1 and S2 — recipe gap); industrialcyber-co (403 across all transports for S3 and S4 — transport block); cert-at (news/warnings paths 404/403, only stale blog reachable); govcert-at (RSS feed empty); kudelski-security, intrinsec, ncc-research, lab52 (JS-hydration listings — recipe gaps); cert-eu (feed stale, newest 2026-06-10); vulncheck (blog stale + RSS empty). All non-essential except ncsc-uk.
• Essential-coverage: missed=ncsc-uk (Cookiebot/consent-banner shell via both WebFetch and jina; no advisory list surfaced — recipe review flagged, source not demoted). All other essential sources attempted and reachable (CISA KEV via API, NCSC-CH CSH via bridge, ANSSI/BSI/NCSC-NL/CERT-EU/CERT-PL/ENISA fetched — quiet or global-vuln-only in window).
• Watchlist: no product or supplier watchlist configured in config/org-profile.yaml — the sweeps are no-ops (S1 products checked=0/0, S4 suppliers checked=0/0); no Watchlist: line emitted per policy.