2026-09-21T0410Z-intel

Verification loop closed at the 8-iteration cap (fail-open). Iteration 8 returned NEEDS_FIXES (truth: 2, editorial: 1, advisory: 0); all three findings were remediated as recorded above and tools/check_run.py reconfirmed 49 pass · 1 warn (the run's own runaway-duration telemetry fact, non-fixable, disclosed above) · 0 fail immediately afterward. Per the loop's cap-with-fail-open rule, no iteration 9 was spawned; this run publishes on the cap rather than on a confirmed double-CLEAN. verification_residual_count (3) reflects iteration 8's own truth+editorial sum, not zero, the fixes above are believed correct but were not re-verified by a fresh cold pass before publish, which is what publishing on fail-open rather than double-CLEAN means in practice.

Verification & coverage notes

Runaway threshold exceeded (duration_seconds=12313, ~3.4h; check_run.py WARN). Cause: the verification loop ran the full 8-iteration cap, each iteration catching genuine, previously-unnoticed defects, several introduced by the prior iteration's own remediation (the conference-phishing entry's macOS payload-attribution swap, caught in iteration 5 after the document/certificate/payload structure was fixed across iterations 1-3; the Gentlemen entry's NetExec/RustHound scope error, introduced by iteration 6's own hedge-restoration fix and caught by iteration 7). No single iteration stalled past its 30-minute per-role cap; the cumulative wall-clock cost is the number of genuine correction rounds this run's initial composition needed, not a stalled sub-agent. The loop closed on the cap (fail-open) rather than a confirmed double-CLEAN; see the note at the end of the verification.iterations block. This is a run-caused, non-fixable-by-editing telemetry fact (elapsed time already happened) rather than a defect in any published entry; left for the quality audit to acknowledge per the zero-warning-discipline carve-out for a run's own telemetry facts.

Window: Standard class, gap_hours ≈ 15.0 (previous run 2026-09-20T1308Z-audit, started 2026-09-20T13:08:12Z), no catch-up/major-gap disclosure needed. Mechanical KEV sweep (tools/kev_window_diff.py) found zero CISA KEV additions in the window, independently corroborated by S1's own exhaustive sweep.

Coverage-backlog work (Phase 0 step 5b), six research items and one incident resolved. Yesterday's audit (2026-09-20T1308Z-audit) fully researched six PD-11(d) tradecraft items and one confirmed AFPA incident but hit its wall-clock cut before composing them. This run re-verified all seven live (fresh WebFetch of every primary, evidence quotes re-confirmed verbatim) and published them:

• 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft and 2026-09-21/qilin-ai-generated-wiper-locker-scripts-forensic-markers, split from the single Talos backlog row per the item-granularity rule (distinct actor, distinct victim environment within one primary source).
• 2026-09-21/nighteagle-apt-q-95-ghostcontainer-devtunnels-rdp2tcp-dcsync
• 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop
• 2026-09-21/huntress-vss-abuse-detection-correlation-ntds-shadow-copy
• 2026-09-21/conference-phishing-rogue-root-ca-mitm-persistence
• 2026-09-21/ref9334-kremlin-chromium-secure-preferences-hmac-forge
• 2026-09-21/afpa-third-party-accommodation-tool-data-extraction, this resolved TWO open backlog rows at once: the 2026-09-20-surfaced "AFPA confirmed" row and the 2026-09-16-surfaced row on the two competing xMetah/Cybernox criminal claims were treated as the same underlying event. AFPA's own AFP-quoted statement names "two hackers" claiming data "mercredi et jeudi" (Wednesday/Thursday); the verifier's iteration-1 pass flagged that Wednesday/Thursday falls on 2026-09-16/17, one day later than xMetah's own 2026-09-15 claim date (Cybernox's 2026-09-16 claim does land on the Wednesday). The published entry itself does not assert an exact day-of-week match (it says only that the two claims surfaced "within 24 hours of each other") so this is a same-incident judgment resting on the shared third-party tool, the 24-hour claim spacing and AFPA's own two-hackers framing, not on an exact calendar match; noted here rather than corrected as a published-entry defect, since the entry's own wording already avoids the overclaim.

One further backlog item, an independent researcher's SAP SM49/SM69 Security Audit Log blind-spot write-up surfaced fresh by this run's own S3 sweep (not a carried-forward row), published as 2026-09-21/sap-sm49-sm69-external-command-execution-blind-spot at reduced reliability (Admiralty F, no track record) given its single-blogger provenance, reached only via a syndication mirror after the true primary (detect.fyi) 403'd on every transport.

Verification catches during Phase 4 composition (main-agent deep-read, all fixed before publish):

• CVE mislabeling in the Talos primary itself. Talos's tool-inventory paragraph names "exploit code targeting CVE-2025-2479, a SQL injection vulnerability", that CVE resolves on MITRE's CVE API to an unrelated WordPress plugin reflected-XSS flaw. The article's own Phase 3 narrative separately and correctly describes exploiting CVE-2025-24799 (GLPI unauthenticated SQLi, confirmed via the CNA record). Per PD-12 (the per-CVE authority wins over blog prose), the Gentlemen entry cites CVE-2025-24799 only and omits the mislabeled id entirely.
• Two revoked ATT&CK ids in sub-agent-proposed mappings, caught against the pinned attack/enterprise-attack.json (v19.2) before publish: T1562.006 (NightEagle's AMSI/Event-Log tampering) → replaced with its survivor T1685; T1574.002 (REF9334/KREMLIN's DLL sideload) → replaced with its survivor T1574.001.
• An ellipsis-spliced quote in the VSS-abuse findings (two sentences joined across an omitted middle clause) was caught by literal grep -F verification against the saved primary and replaced with the full, unspliced contiguous quote.
• A DCSync id (T1003.006) misapplied to the Gentlemen entry: the Gentlemen chain extracts ntds.dit/SAM offline from a mounted VHDX backup, not via live DCSync (that is NightEagle's technique, correctly mapped there); corrected to T1003.002/T1003.003.
• Registry hygiene: actor:jade-sleet's aliases (TraderTraitor, UNC4899, PUKCHONG) added per the SentinelLabs source's own alias statement; actor:cybernox's summary extended to note the AFPA financially-motivated episode alongside its earlier hacktivist framing.

Borderline drops:

• borderline-drop: LMU Munich student enrollment-data breach — German state university, no Swiss home-region or primary-sector nexus, no global significance, no named TTP or actor plausibly targeting the profiled constituency; the breach-notification-timeliness angle is a general lesson, not a PD-11 breach-gate (a)-(d) clearance. (S2's finding; genuinely well-sourced but out of scope for this constituency.)
• borderline-drop: Swiss Federal Council "Verordnung über die militärische Cyberabwehr" (MCAV) lead — S2 investigated a kleinreport.ch story with a genuinely in-window timestamp, but the linked admin.ch press release 404s and the linked PDF is the original 2019 explanatory report; single Admiralty-C source with unresolved novelty ambiguity, dropped per PD-1/PD-6 rather than risk a fabricated-novelty claim.
• borderline-drop: Qilin leak-site claim against Touring Club Suisse (TCS) — bare leak-site listing only, no victim statement, no Admiralty A/B journalism despite a targeted multilingual search; fails PD-6 as it stands. Added as a new Open row on state/coverage_backlog.md (strong, fresh Swiss home-region nexus if corroborated) rather than dropped outright.

Single-source items (all verification: single-source, no national-CERT/victim carve-out applicable; each entry's own sourcing_note carries the detail): 2026-09-21/the-gentlemen-open-directory-vhdx-backup-ntds-theft, 2026-09-21/qilin-ai-generated-wiper-locker-scripts-forensic-markers, 2026-09-21/nighteagle-apt-q-95-ghostcontainer-devtunnels-rdp2tcp-dcsync, 2026-09-21/tradertraitor-terraform-lockfile-nostr-dead-drop, 2026-09-21/huntress-vss-abuse-detection-correlation-ntds-shadow-copy, 2026-09-21/conference-phishing-rogue-root-ca-mitm-persistence, 2026-09-21/ref9334-kremlin-chromium-secure-preferences-hmac-forge, 2026-09-21/sap-sm49-sm69-external-command-execution-blind-spot. 2026-09-21/afpa-third-party-accommodation-tool-data-extraction is multi-source, Clubic's AFP-quoted victim statement plus Cyberattaque.org/FrenchBreaches independently paraphrasing AFPA's own confirmation (not merely relaying the criminals' figures).

Deep-dive: none selected this run. No candidate met deep-dive selection criterion 1 (active in-the-wild exploitation with non-trivial exposure) or 2; several research pieces (Gentlemen, TraderTraitor, the rogue-CA phishing chain, REF9334/KREMLIN) would satisfy criterion 3 on technical depth alone, but none is clearly the single strongest pick over the others, and the closest category fits (supply-chain, apt-campaign) were both used within the prior 7 days per the rotation check, demoted rather than manufactured.

Correction to this run's own iteration-1 note: the notes previously flagged actor:gentlemen-raas-gentlekiller as an apparent unmerged duplicate of actor:thegentlemen. The verifier's iteration-2 pass caught this as wrong: the record already carries merged_into: "actor:thegentlemen", added three weeks earlier (2026-08-31T0411Z-intel); it was correctly tombstoned all along, and the main agent's own registry read simply stopped one line short of that field. No registry action needed; retracting the flag.

Coverage gaps: keycloak (dead RSS path); trustwave-spiderlabs/LevelBlue (dead feed path post-rebrand); flatt-security, mozilla-mfsa, edpb, netcraft (JS-rendered listings the current recipe can't see); ncc-research (redirects to a generic page); ic3.gov/fbi-cyber-alerts (/PSA resolves to a complaint-filing T&C page, not a PSA index; this has now recurred across multiple runs and may warrant a dedicated recipe review); cisa-advisories/cisa-directives listing pages (render as filter-form/nav shells with no visible per-item dates; cross-checked via the CISA KEV catalog instead, which stayed current); socradar (the plain bridge url subcommand returns a JS-empty shell; the jina reader recovered the real dated listing this run; recommend the source record require jina rather than plain url); franceinfo.fr and afpa.fr (403 / no dedicated press notice, AFPA's confirmation composed from Clubic's direct AFP quotation instead).

Essential-coverage: all essential-tier sources in S1's and S2's domains were attempted this run; no miss to disclose.