2026-07-13T1212Z-intel

Verification & coverage notes

Intraday fire, 8.03 h after the previous run (2026-07-13T0410Z-intel, a zero-entry quiet window); window held at the 24 h floor, developing window 72 h. Three entries published, all genuinely new signal absent from the 14-day prior-coverage index and the store-wide CVE index; no updates. Four cti-research sub-agents (S1–S4, all Sonnet 5) returned; no S5 (no in-window intel/ drops).

Published:

• FSB Centre 16 / Static Tundra router-hijacking campaign (threat, high, deep dive — category apt-campaign, well-rotated: no apt-campaign deep dive in the prior 30 days, none earlier today). Corroborated across S1, S2 and S4 (19-agency joint advisory + NCSC-UK + UK gov + CERT Polska). Active exploitation of the CISA-KEV Smart Install flaw CVE-2018-0171 plus SNMP default-credential abuse against energy/government/telecom CI, with the same-day formal UK/EU attribution of the destructive Dec-2025 Poland grid attack and the first joint EU/UK cyber-sanctions package. Direct Swiss/EU critical-infrastructure relevance.
• Progress ShareFile Storage Zone Controller emergency shutdown (incident, high). Corroborated across S2 and S4. Vendor-ordered full shutdown of an internet-facing on-prem component over an undisclosed "credible external threat," unresolved on day three, no patch or CVE published; exposure of the component concentrates in the US and Germany. No prior coverage in the store.
• WAGO I/O System Field CVE-2026-4769 (vulnerability, notable). S1. Same-day CERT@VDE advisory: an undocumented, unauthenticated early-boot diagnostic interface allowing full compromise of OT field couplers used in energy/water estates. single-source-national-cert (CERT@VDE as CNA; ENISA EUVD republishes the same data). actions: [] — no exploitation (EPSS 0.0), narrow early-boot window; the patch/segmentation guidance is body content, folded into the constituency's OT patch cycle rather than a do-now task.

Attribution contradiction (recorded, not silently resolved). The cluster label for the 29 Dec 2025 Poland energy-grid attack is contested: CERT Polska (infrastructure overlap) and the 2026-07-13 UK/EU government attribution assign it to the Static Tundra / Berserk Bear cluster under FSB Centre 16, while earlier ESET reporting (via BleepingComputer, 2026-01-24) attributed the same DynoWiper attack to the GRU-linked Sandworm cluster, and the EU Council statement names FSB Centre 16 as a parent unit also controlling Turla/Secret Blizzard. The deep-dive entry holds all three framings, attributes each to its source, and treats "FSB Centre 16" as an umbrella unit rather than a single group; sourcing_note carries the caveat. Registry: actor:static-tundra created distinct from the existing actor:secretblizzard (which already carries "FSB Centre 16" as an alias) precisely because the two are separate clusters under a shared parent — no alias collision introduced.

Completeness sweep (Phase 2) re-read all four findings sets including borderline items; two genuinely-surfaced items were dropped, both recorded here for recoverability:

• borderline-drop: Swiss Cyber Command migrates off Microsoft 365 to OpenDesk (S2) — a public-sector sovereignty/vendor-dependency policy story with no near-term SOC operational action; the underlying decision was first reported 2026-07-09/10 (outside the 24 h window) and today's Inside IT piece is trade-press repackaging with no new fact. Strategic lens belongs to the weekly run, not an operational intel fire. Highly relevant to the constituency's posture but not an operational-actionable item.
• borderline-drop: Lexfo — three M365 AiTM/device-code phishing operations exposed (S4) — genuinely fresh primary research (2026-07-13), but M365 device-code/AiTM tradecraft is saturated in-window: ARToken (07-02), Railway/LSHIY (07-10), Helix (07-10), Forg365 (07-10, a commercial PhaaS bundling device-code + AiTM) and the W27/W28 weekly syntheses all cover the same mechanism and the same defences (block the device-code grant via Conditional Access, FIDO2/passkeys, Entra sign-in-log anomaly on device-code grant_type). No new defender decision; the novel nuggets ("The Quarry" PhaaS ecosystem, AI-assisted kit development) do not clear the standalone actionability bar and would add volume to a topic synthesised one day ago. Dropping it leaves no defender blind spot.

Coverage notes:

• Watchlist: not reported — no product/supplier watchlist configured in this deployment (both sweeps no-ops).
• Coverage gaps: industrialcyber-co (S3 — Cloudflare anti-bot challenge on both direct fetch and jina reader, 3rd consecutive run; no in-window OT/ICS content confirmed via WebSearch, so no coverage lost); consilium.europa.eu (S4 — EU Council press release 403 on both transports; the UK gov.uk / NCSC-UK national-authority primaries and BleepingComputer/SecurityWeek corroboration fully substitute, so covered anyway); cert-eu, cert-at, cert-pl news, anssi-fr, ccb-belgium, ncsc-ch-* (reached, no in-window items — freshest CERT-EU advisory 2026-06-10, freshest ANSSI 2026-07-10); github-advisory (S1 — client-rendered listing, no structured recipe surfaced today); us-treasury-ofac (S2 — JS shell, no structured OFAC subcommand; UK/EU sanctions corroborated via gov.uk/BleepingComputer instead). fetch_failures: [] — no transport block cost any coverage.
• Essential-coverage: none missed — all essential-tier sources in the S1/S2 slices were attempted.
• Source-health: 158/158 probed, 0 UNSOLVED (96 ok, 62 bridge-ok); no source demoted. One new candidate added (certvde); no other source drift.