2026-08-07T0411Z-intel

Verification & coverage notes

Eight entries from ten candidates across four research domains, plus one item recovered by the end-of-triage completeness check after each of two domains passed it to the other. The window was a standard 24-hour gap with no scheduler irregularity; the previous fire's record shows publish_status: ok, so nothing was carried forward.

What the completeness sweep changed

• Recovered and published: the Sonatype "Flooding Dropper" npm campaign. The vulnerability-advisory domain surfaced it, judged it outside its own remit because no CVE is involved, and passed it to the research and incident domains; neither carried it back. Rather than let a hand-off between domains fall through the gap, it was read from the primary and decided directly. Published 2026-08-05, which is outside the 26-hour window but inside the 72-hour developing-story window — Sonatype states the campaign is active and that its naming convention is already evolving, which is what that wider window exists for. The previous fire had it in window and missed it.
• Two domains returned the same story. The research and incident domains both surfaced the Google Threat Intelligence Group post on UNC6671. Merged into one entry rather than two: one return carried the corroborating second source and the ransom economics, the other the technique mapping. One story, one entry.
• Confirmed negative results rather than assumed ones. The vulnerability-advisory sweep reported no in-window CISA KEV addition. Because a missed KEV addition is the most expensive false negative this pipeline can produce, the catalog was re-checked directly before composing: catalog version 2026.08.06, newest addition dated 2026-08-05 (the JetBrains TeamCity flaw already published here on 08-06), nothing dated 08-06 or 08-07. The negative result holds. The home-region sweep also searched specifically for a third Swiss or European SharePoint victim and for any European water/OT development, and found neither.

Corrections applied during composition

Four of the returned evidence quotes failed a literal substring check against the fetched pages and were repaired before anything was written, not after:

• A Microsoft sentence was truncated mid-clause and presented with a closing period, dropping "and automated security systems while maintaining access to intended macOS targets". Restored in full.
• A second Microsoft "quote" was three separate source sentences spliced into one, and it removed the source's own hedging — "usually remains unchanged" had become "remains unchanged", and "may be converted" had become "cause conversion". Replaced with a single contiguous sentence; the hedged behaviour is now described in the body in plain language instead.
• A Unit 42 quote differed only by a straight apostrophe where the source uses a curly one. Corrected to the source's character.
• A Sonatype quote contained a non-breaking space the extraction had not preserved. Replaced with a cleaner contiguous sentence from the same post that carries more operational value.

Two factual corrections also came out of reading the primaries rather than the summaries:

• Adobe CVE-2026-48331 impact. The research return carried NVD's description, which characterises the impact as privilege escalation. Adobe's own per-CVE table in APSB26-120 records arbitrary code execution at CVSS 10.0. The vendor bulletin is the authority for its own product and is what the entry follows; the discrepancy is noted in the entry's sourcing note.
• The UNC6671 brand linkage is an assessment, not a confirmation. Both returns framed GTIG as having confirmed the multi-brand continuation. GTIG's own sentence states the overlaps "support our assessment" and explicitly names splintered affiliates and shared phishing-as-a-service infrastructure as plausible alternatives. The entry carries it at the strength GTIG gives it, and the registry summary was written the same way.

One further precision point on the deep dive: GTIG's payment figure is not an average across all cases. Its sentence is that in over 53% of tracked cases final payments averaged $750,000, which is what the entry says.

Recency accounting, stated consistently

Three of the eight entries rest on primaries published just before this window opened at 2026-08-06T02:11Z, and the run should say so in one place rather than justify one and pass over the others. Sonatype's Flooding Dropper post (2026-08-05T20:43Z) is carried under the 72-hour developing-story window and says so in its own sourcing note. Microsoft's ClickFix analysis (2026-08-05T15:48Z, about 10 hours before window start) and Reuters' Meta report (2026-08-05T22:29Z, about 4 hours before) are carried on the same basis — both are actively developing stories, and the Meta one additionally reached this window through in-window relays on 08-06. The UK ICO item was dropped with the window as its leading ground, which reads inconsistently against those three; the honest ordering is that it fails the relevance test first (a records-management process failure rather than tradecraft a SOC detects) and the window boundary is secondary. Recorded so the reasoning matches the dispositions.

Contradiction

• Contradiction: Adobe CVE-2026-48331 impact — Adobe's own per-CVE table in APSB26-120 records "Arbitrary code execution" at CVSS 10.0, while NVD's description and NCSC-NL's advisory NCSC-2026-0278 both describe the same SSRF as enabling privilege escalation. The entry follows the vendor bulletin as the authority for its own product and names the disagreement in its sourcing note rather than picking a side silently. Two of the three parties disagree with the primary on wording; none disagrees on the score, the affected range or the fix.

Sourcing and classification

• Single-source entries, all under the original-research pattern rather than a carve-out: the macOS ClickFix gate (Microsoft Threat Intelligence), the Overlord RAT downloader (Jamf Threat Labs), AI token jacking (Unit 42) and Flooding Dropper (Sonatype Research Labs). Each is a lab's own first-hand analysis with no independent second assessor, so each carries credibility 2 rather than 1. A same-day press write-up of one of these posts would not have made any of them multi-source.
• Keycloak sourcing substitution. Keycloak's upstream GitHub Security Advisories are the natural per-CVE authority but github.com is unreachable from this environment, and OSV had not yet ingested the advisories, which were disclosed on 2026-08-05 (all seven returned HTTP 404). Red Hat's own per-CVE records were used instead — a first-party vendor authority for Keycloak and Red Hat Build of Keycloak — with CERT-FR independently corroborating the affected and fixed version boundaries. Every CVSS score the research return reported was confirmed against Red Hat's records. This also resolved a gap that return had flagged: GitHub had rendered a duplicate description for CVE-2026-16442 from a sibling advisory, so only that CVE's title and score were confirmed there; Red Hat's record describes its mechanics directly, so the entry states them without hedging.
• Meta incident attribution boundaries. The model name is The Information's reporting relayed by Reuters, not Meta's statement, which names no model — attributed accordingly. The shared-vendor finding does not rest on inference: Reuters names Irregular as Meta's evaluator, and Anthropic's own post names Irregular as the third-party evaluation partner behind its three incidents. Reuters also separates the root causes across the cluster (configuration error for Meta and Anthropic; an agent independently exploiting an unknown vulnerability in OpenAI's case), so the four disclosures are not presented as one mechanism.

Borderline drops

• borderline-drop: Snowflake mass credential-theft campaign — Canadian defendant pleads guilty (US DOJ, 2026-08-05) — legal closure on a 2024 campaign. Global scale is genuinely met, but the operative lesson (unprotected credentials on a cloud data platform are sufficient for a mass-victim breach) has been public since 2024 and is unchanged, no new technique is disclosed, and no Swiss or European victim is named. Nothing a responder does differently in the next seven days. If a future filing names EU victim organisations, that is a fresh nexus and a new entry.
• borderline-drop: press narrows the Swiss federal SharePoint breach CVE to two candidates (BleepingComputer, 2026-08-06) — both named CVEs are already in this store's CVE index from the July on-premises SharePoint wave, and the source itself says it remains unclear whether either was used. The entry published on 08-05 already tells exposed-SharePoint operators to run a compromise assessment and rotate machine keys, so the reader's actions do not change. An unconfirmed CVE attribution on a home-region incident is the shape that teaches readers to discount the brief. A confirmation from the federal authority or the victim would be a material delta and an immediate update.
• out-of-window: UK ICO enforcement notice and reprimand, Metropolitan Police Service — primary source 2026-08-05, window_hours=26 — published before this window opened and not an update, background, or patched-version reference. It would also have been dropped on relevance: unredacted-document disclosure and a bulk-email recipient exposure are records-management process failures rather than tradecraft a SOC detects. Flagged here because the item falls in the gap between two fires' windows and the previous fire did not carry it, which is a boundary effect the operator may want to know about rather than a defect in this run.

Returned-but-dropped items reviewed and upheld without restoring any: WordPress 7.0.3 / CVE-2026-64638 (needs a victim click, no exploitation, forced auto-update release); two Cisco advisory bundles (internally found, authentication required, no exploitation); an Oracle PeopleSoft alert whose page metadata dates to June; the ENISA CVE-programme announcement (administrative, no SOC action); two dcod.ch items that trace back to a July circular and a November 2025 disclosure; a netzwoche Liechtenstein follow-up naming two of four already-reported offline systems; a Zimperium post that rehashes a hunt.io primary; two CrowdStrike AI-agent architecture posts; a Recorded Future neurotechnology piece; Unit 42's and Microsoft's own CHAINDROP write-ups (corroborating an entry already published on 08-06). Three closer calls, also upheld: two Swiss ransomware leak-site claims in window (MITC AG and Pharma Test Apparatebau AG) with no victim statement and no high-reliability journalism behind them — the correct drop even with a home-region nexus, and worth re-checking next fire; and two French healthcare disclosures (Biosynex, Hospices Civils de Lyon) that are thin single-source victim statements with no named vector or actor, repeating a third-party-access pattern already well documented here. The French healthcare pair was the closest of all the drops given the direct sector and region nexus.

Coverage and telemetry

• Coverage gaps: ssd-disclosure (listing shell, no dated items enumerable — rotation priority, see fetch_failures); searchlight-cyber (listing carries no dates, so recency unanswerable; all visible titles already covered); infoguard-labs, cisa-directives, msrc-blog, google-tag, trellix, paradigm-shift-research (all previously documented recipe gaps, unchanged this run); prodaft (stale reader cache, root-caused above); cert-at, lab52, zataz, ncsc-ch-focus, ncsc-ch-incidents (reachable, genuinely nothing in window — quiet, not missed).
• Essential-coverage: no misses. All 15 essential-tier sources were attempted — the 11 allocated to the vulnerability-advisory domain and the 4 allocated to the home-region domain.
• access.redhat.com is now a cited-but-untracked source host: Red Hat Product Security carries the primary role on this run's top-ranked vulnerability entry but has no record in sources/sources.json, because adobe-psirt took this run's single candidate slot. Queued for the next fire's slot so the accrual is not lost.
• A structural observation for the weekly audit rather than a gap in this run: no research-lab source carries tier: essential, so the highest-yield publishers (Talos, Unit 42, Microsoft, Mandiant and the rest) are reachable only through the staleness rotation — and because they are swept most often they sort last in it, which means a 24-hour window would systematically miss the posts they published that day. This run compensated by giving the research domain an explicit standing-majors block of 23 publishers on top of its rotation slice, and three of its four items came from that block. The compensation worked, but it is a per-run instruction rather than a property of the source list.
• The url-liveness ledger holds 89 rows across 48 hosts while the returned telemetry reports roughly 140 fetch calls, so the ledger is materially under-populated relative to actual fetching. It is complete enough to have supported the triage spot-checks and the source bookkeeping, but the append discipline is not being followed uniformly and the next audit should treat the ledger as a partial record.
• source_health.py probed 175/175 sources in 85 s with zero UNSOLVED flags and no needs-bridge or needs-demote classifications, so no standing repair order fired this run.
• ATT&CK pin is at v19.1 with v19.2 published upstream on 2026-08-05. Left unchanged deliberately: a dataset bump mid-run can revoke ids the run's own entries depend on, and dataset freshness is the weekly routine's duty. Every technique id in this run's eight entries validates against the pinned v19.1.
• Watchlist: no product or supplier watchlist is configured in the org profile, so both sweeps are documented no-ops (products checked=0, hits=0; suppliers checked=0, hits=0) and no entry carries watchlist_hit.
• No closed-source intel: intel/ holds no in-window date directory, so no closed-source intake ran.
• Deep dive: one, on UNC6671, in the identity-infra category. That category was also used on 08-04, which the rotation rule demotes by one rank, and the run record owes an explanation: no other candidate independently earned long-form treatment, the window had published no deep dive yet, and the GTIG report genuinely supports the length — multi-brand infrastructure correlation, ransom economics, a documented targeting progression, and detection and hardening content specific enough to implement. The depth is in the source rather than manufactured to fill a slot.