2026-09-02T0411Z-intel

Verification & coverage notes

Standard window (gap_hours=24.0, window_hours=26). No closed-source intake this run. Mechanical KEV sweep (tools/kev_window_diff.py) found zero in-window CISA KEV additions.

• Runaway-duration note: total wall-clock (11217s, ~3.1h) exceeds the 3h threshold. Cause: the verification loop ran the full 8-iteration cap, each of the first seven iterations returned genuine truth/editorial findings (hallucinated facts, misattributions, a stale priority calibration, a classification miscalibration, and a workflow-internal-language leak that took two iterations to fully sweep), so no double-CLEAN confirmation was reached before the cap; iteration 8 (cap, fail-open) found three more low-confidence findings, applied post-hoc without a further confirmation pass per the documented cap rule. Research (Phase 1) and composition (Phase 4) were within normal bounds; the overrun is entirely attributable to the verification loop's iteration count, not a stall.

New entries (3): Mirage Kitten (Nimbus Manticore/UNC1549) debuts NodeRabbit/PollCat, its first Node.js/JavaScript implants, delivered via fake LinkedIn technical-hiring assessments (Kaspersky Securelist, this run's deep dive, notable); a policy entry on Switzerland's averted AWS outsourcing of part of the E-ID trust infrastructure, vetoed by Justice Minister Beat Jans in February 2026 on CLOUD Act/digital-sovereignty grounds and reported for the first time by Republik (notable); a Dropbox account takeover via a Lenovo-ID SSO trust gap affecting roughly 5,000 accounts, included on the transferable identity-federation-design lesson rather than home-region nexus (notable). Updates (4): CVE-2026-82329 (JFrog Artifactory) moves from disclosed to confirmed actively exploited, with watchTowr naming the "phantom" join-key mechanism; the WatchGuard Fireware/Dimension entry gains two further CVEs (a third iked pre-auth flaw gated on a non-default diagnostic-logging setting, and a Dimension session-hijack flaw) from a follow-up NCSC-CH advisory; the Liechtenstein VwbP breach entry gains a policy-fallout development, Swiss wealth-manager and banking lobbies pressed for a delay to the country's own Transparency Register, which the Federal Council confirmed on 31 August it will launch on schedule regardless; the DGFiP/Bloctel entry gains a plausible-but-unconfirmed actor correlation (Cybernox) for the previously unattributed Bloctel leak, resolving a standing coverage-backlog row.

• Deep-dive selection: Mirage Kitten/NodeRabbit-PollCat clears criterion 3 (substantive new technical analysis with sufficient public detail to be actionable), three variants of increasing sophistication, a fully described delivery chain and C2 protocol, and a transferable hiring-pipeline hardening lesson. The rotation-demotion check looks at the prior 7 days only (2026-08-26 through 2026-09-01), and category apt-campaign was not used in that window (the three deep dives actually in that window are 2026-08-28 identity-infra, 2026-08-29 web-app-rce, 2026-08-31 cloud-saas), so no demotion applies; apt-campaign was used earlier in the wider 30-day lookback (2026-08-12, 2026-08-16), outside the 7-day window and so not relevant to this run's decision. This is the window's only deep dive.
• borderline-drop: Bavaria's 2026 annual cybersecurity situation report, a subnational (Land-level) statistics-led report for a neighbouring but non-Swiss jurisdiction; its concrete numbers (ransomware +18% YoY, 48% of German KRITIS operators with no attack-detection system) are benchmarking colour rather than a Swiss-specific hunt/detect/patch decision, and the report itself leans on situational awareness rather than tradecraft. Dropped on the quality-over-quantity bar rather than published as a thin entry.
• borderline-drop: Aesto Health third-party EHR-migration platform breach, 9.5M patients, US-only, no Swiss/EU nexus, no disclosed access vector or actor, and no ATT&CK-mappable behaviour stated by any source; fails the out-of-nexus breach gate on all four limbs.
• Held for a later fire, not published (fails PD-6 as it stands): Krybit's leak-site claim against Geneva-headquartered UICC (Union for International Cancer Control), no victim statement, no Admiralty A/B journalism, only the leak-site listing itself. Added to state/coverage_backlog.md for re-check given the home-region nexus.
• Coverage-backlog work this run: struck the DGFiP/Bloctel-Cybernox row (published as an update, hedged per the row's own instruction); advanced-but-not-struck rows for Boston Scientific (still no attacker attribution/vector, re-checked, no change), Insel Gruppe/ServiceNow (still paywalled, no corroboration found, re-checked, no change), and Ixa Systems SA/TheGentlemen (still uncorroborated, re-checked, no change; a new similarly-shaped Krybit/UICC row was opened instead of folded in, since it is a fresh in-window claim rather than a re-check); the Zurich court verdict row is not due until 2026-09-10 and got only a dated "untouched" note; the CVE-2026-16242 OpenShift row was checked against this run's KEV/CERT sweep (no fresh exploitation evidence or vendor bulletin found) and also carries a dated note; both remain open.
• dedup: 2026-09-02/mirage-kitten-noderabbit-pollcat-nodejs-rats shares its actor entity with 2026-08-28/nimbus-manticore-twostroke-backdoor-europe, deliberate: distinct malware families (NodeRabbit/PollCat vs. the TWOSTROKE-like backdoor), distinct publisher, distinct delivery mechanism and distinct disclosure date, not a delta on the same finding.
• Known pre-existing warning, not fixable this run: entries/2026-08-15/france-dgfip-tax-authority-credential-intrusion.md's 2026-08-21 changelog record's own summary field contains a pipeline self-reference ("this pipeline"). That field is part of an earlier fire's append-only changelog record and cannot be edited under the entry-lifecycle rule; the equivalent phrasing in the body's rendered ## Update section (which is revisable) was fixed as part of this run's own edit to that entry. Left for the quality audit to acknowledge.
• Essential-coverage: all essential-tier sources across the four domains were attempted and reachable this run; no miss. cisa-advisories and cisa-directives remain on a long-standing persistent 403 with no other source indicating a new CISA directive in-window.
• Registry hygiene: fixed a relation-direction error caught by the mechanical gate, uses relations belong on the actor/campaign/incident subject pointing to the tool object, not the reverse; moved the two new NodeRabbit/PollCat relations onto actor:screening-serpens-unc1549-smoke-sandstorm-nimbus-manticore-iran-apt.
• Coverage gaps (quiet this run, no fetch failure beyond ssd-disclosure): govcert-at, infoguard-ch, oneconsult-ch, paradigm-shift-research, trellix, fox-it-blog, ico-uk, venarix, cnil-fr, ransom-isac (reachable, no in-window item).