2026-08-20T0409Z-intel

Verification & coverage notes

Ten entries. Seventeen candidates came from four surfacing passes and two scoped deep-read follow-ups; nine were published from those, and the tenth was recovered by the verification loop itself, which found an in-window five-agency joint advisory on an active threat to Siemens S7 PLCs that no surfacing pass had seen. The window was 26 h against a 24 h gap, so this was a standard window with no catch-up disclosure owed.

Sourcing and single-source items.

• Single-source: 2026-08-20/castilla-la-mancha-panzer-extortion-claim-confirmed-attack — the regional government's confirmation reaches the public through one outlet only. A second Spanish publication covering the same claim was reviewed and deliberately not cited: it discloses that its content is produced with AI assistance, and verification established it carries no fact the primary does not already state, including the intrusion date it had been credited with adding. The entry was composed as multi-source, corrected to single-source, and then had the second source removed outright.
• Single-source: 2026-08-20/grandoreiro-dll-sideload-inverted-sandbox-check — one publisher, no corroborating analysis of this wave located. Three limits in the source are load-bearing and are stated in the entry rather than smoothed over: the delivery vector is the discloser's own moderate-confidence assessment, the command-and-control server was offline during analysis so the protocol description is static analysis rather than observed traffic, and the discloser marks its own DNS-over-HTTPS technique mapping as provisional, which is why that mapping is absent from the entry's frontmatter.
• The Citrix vendor bulletin could not be read directly — the support portal renders client-side — so the NetScaler entry cites the vendor's determinations through a national-level CERT advisory that reproduces them and through an independent analysis that supplies the scoring basis and its own exploitation observation. The entry says so.
• The Zimbra exploitation determination rests on one assessor, ENISA's database, which the French national CERT relays rather than assessing independently. No vendor, authority or lab reports observed intrusions, a proof of concept or scanning. Recorded in the entry's sourcing note; the credibility rating is set at 2 accordingly, not 1.
• The MLflow advisory was read through a mirror because the originating host refuses the transports available to this run. The mirror is cited as the reachable copy of that advisory, not as an independent assessor.
• Contradiction carried, not resolved: for the Latvia breach, the national CERT and the affected authority state an 8-10 August data-exfiltration window while a Latvian outlet dates the attack to the night of 7-8 August, and the two sources sequence the board resignations differently. Both are attributed separately in the entry rather than merged.

Borderline drops. Every one of these was researched and verified; each is dropped for a stated reason rather than for space.

• borderline-drop: Berlin state network (Landesnetz) compromise — clearly relevant and fully verified, and dropped only because no cited source states an access vector or any other attacker behaviour: the Senate Chancellery says a compromise was established, and the sole "a vulnerability was exploited" claim is a broadcaster's characterisation attributed to unnamed government sources that never says the surface was internet-facing. An incident entry must carry an evidence-bound technique mapping, and bolting an access vector on to satisfy that rule is the exact defect an earlier audit repaired. This is not a silent drop: it has been written into state/coverage_backlog.md as an open row with its sources, to be published as soon as any technical detail is disclosed. The strategic weekly can carry it before then, where synthesis kinds are free to map nothing.
• borderline-drop: ToxicPanda 2.0 Android banking trojan — the privilege-escalation chain is genuinely novel, but three things pointed the same way. The sixteen targeted countries exist only inside a figure image with no alternative text, so no European targeting could be confirmed from the article's own words; the malware is consumer and bring-your-own-device banking fraud with no stated enterprise or government targeting; and the behaviour is mobile-specific while the pinned ATT&CK dataset is enterprise-only, so an honest mapping was not available. See the tooling note below.
• borderline-drop: Balonx Sistema phishing-as-a-service — a Mexican retail-banking operation with no European victim, and the striking half of its tradecraft, a live operator relay over a persistent WebSocket, is ground this store already covered five days ago from a different publisher. What remains new is an automated voice-phishing module built from commodity speech and language services; that is worth watching but does not change what a responder here does in the next seven days.
• borderline-drop: LMDeploy pre-auth deserialization RCE (CVE-2026-76850) — pre-authentication code execution with a fresh fix, but no exploitation reported by anyone and the vulnerable path only exists where a non-default serving mode is enabled. That is the regular patch cycle for a niche component rather than an out-of-band action.
• borderline-drop: Coldcard Wave 1 attacker traced via a data provider's query logs — an investigative-technique nugget on tracked ground, but the development is a lead shared with law enforcement, not a confirmed identification, an arrest or a charge, and nothing a defender does changes because of it.
• borderline-drop: bulletproof-hosting succession after the 2025-2026 takedowns — a landscape survey whose lesson, that infrastructure-based blocking decays as brands rotate into legitimate cloud space, belongs to the strategic horizon rather than to an operational entry.
• borderline-drop: Ukraine ARMA asset-recovery agency database access — single-source, no vector, no attribution, and the transferable theme is thin without one.

Completeness sweep. The full returned set from all six passes was re-read after triage, including every item the passes marked borderline themselves. Two items were recovered into the published set during that sweep rather than being left behind: the Oracle patch cycle, which a surfacing pass had marked borderline as a routine quarterly release and which the deep read showed carries three unauthenticated flaws scored 10.0 — one of them in a directory server, which is identity infrastructure — and the DOJ indictment, whose European relevance a surfacing pass could only support from the 2018 predicate case, and which the deep read established is stated twice in the fresh filing's own victim lists.

Coverage failure recovered inside the run. The most consequential finding of the whole verification loop was not a defect in anything written — it was something absent. The five-agency joint advisory on an active threat to Siemens S7 Series PLCs published on 2026-08-19 was never triaged, because it lives behind the agency host that has now refused every available transport for seven consecutive runs; the outlet that had linked it was fetched by a surfacing pass, but the link was not followed. It is in-window, it sits in three of the profiled additional sectors, and the store had no coverage of S7 controllers at all despite already tracking a water-utility controller campaign. It is published as this run's tenth entry. Two things follow for the operator. First, the standing block on that source is no longer only costing catalogue data that other feeds replace — it is now demonstrably costing advisory coverage, and it should be treated as a repair order rather than a documented condition. Second, PDF handling in this container is unreliable rather than absent, and the run learned that the hard way: the page-rendering path failed on both copies of the advisory retrieved through the run's own fetch bridge, the entry was composed from an outlet's reading on the assumption the primary was unreadable, and the verification pass then extracted the document's full text from the FBI mirror with nothing but a different transport and the Python standard library, confirming the entry's substance against the primary and supplying two technique ids from its mapping appendix. The lesson is not that the tooling is missing but that a failed extraction was accepted too early. A great many authority publications are PDF-first; a working recipe belongs in the fetch bridge rather than being re-derived under time pressure.

Deep dive. None this run, and the window carries none from an earlier fire. The strongest candidate was the actively exploited Zimbra command injection, which clears the exploitation criterion, but the available public detail is an advisory line, a vendor changelog entry and a database record — there is no published root-cause analysis, exploit analysis or intrusion telemetry to build a kill chain from. Depth was not manufactured to fill the slot.

Priority calibration. No entry is critical; nothing in the window met that bar. Six entries are high: four unauthenticated or pre-authentication flaw items on internet-reachable infrastructure — one under confirmed exploitation, one catalogued as exploited by a government authority, one an authentication bypass on a remote-access appliance, and one a release carrying three unauthenticated flaws scored 10.0 — plus a national-authority breach affecting two-thirds of a country's population, and the joint advisory on active targeting of controllers in the profiled energy, water and manufacturing sectors. The remaining four are notable.

Watchlist. The profile configures no product or supplier watchlist, so both sweeps are no-ops and the parseable line is omitted. The region and sector lens was applied throughout.

Action items. Four of the ten entries ship no actions at all, which is the expected outcome for entries carried for a transferable lesson rather than a task. The eight actions that did ship, across six entries, all name a specific version boundary, configuration string, package, device family or contract artefact drawn from the entry's own cited facts.

Tooling gap surfaced. The pinned ATT&CK dataset is the enterprise matrix only, with no mobile matrix pinned. That is what made an honest technique mapping impossible for the Android banking-trojan item and contributed to its drop. Mobile malware with genuine European relevance will hit this again; pinning the mobile matrix alongside the enterprise one is an operator decision rather than something this run should have done unilaterally mid-flight, and it is recorded here for the weekly audit to take up.

Backlog. Three rows were open at the start of this run and all three were worked. The Unisoc row stays open and unchanged — the source-health sweep classes that host as reachable only through the exhausted reader pool, and the three alternative transports were already tried and documented on the previous fire; the row now carries a strike date of 2026-09-17 if the pool has not returned. The Zurich verdict row stays open by its own instruction, with the verdict set for 2026-09-10. The 1Password study row stays open and marginal. One new row was added, for the Berlin compromise described above.

Coverage gaps: cisa-advisories (HTTP 403, seventh consecutive run; the KEV feed covered the exploited-vulnerability surface but not the advisory surface — this is the block that hid the Siemens S7 joint advisory from every surfacing pass); cisa-directives (HTTP 403, sixth consecutive run); ccn-cert-es (HTTP 403, and a Spanish public-sector incident published this run, so the gap had a cost); siemens-productcert-csaf (HTTP 403; CSAF mirror checked, nothing in-window lost); ssd-disclosure (anti-bot interstitial, fourth consecutive failure on an open backlog item); venarix (client-rendered listing); zaufana-trzecia-strona (Cloudflare challenge; CERT-PL covered the Polish surface); reliaquest, ibm-xforce, trellix, paradigm-shift-research, fox-it-blog (reader-pinned or stale/JS-rendered listings); doj-usao-sdny (anti-bot challenge; the department-level release for the same case was read in full).

Essential-coverage: missed=cisa-advisories (HTTP 403 on every transport), cisa-directives (HTTP 403 on every transport).